From 2b98dc4e52597a88e1266ce371e5d3c7a69cf1af Mon Sep 17 00:00:00 2001
From: Misha Bragin <bangvalo@gmail.com>
Date: Sun, 22 Feb 2026 11:58:17 +0200
Subject: [PATCH] [self-hosted] Support activity store engine in the combined
 server (#5406)

---
 combined/cmd/config.go       |  1 +
 combined/cmd/root.go         | 16 +++++++++++++++-
 combined/config.yaml.example |  5 +++++
 3 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/combined/cmd/config.go b/combined/cmd/config.go
index 04155f72e..d0ffa4ba4 100644
--- a/combined/cmd/config.go
+++ b/combined/cmd/config.go
@@ -70,6 +70,7 @@ type ServerConfig struct {
 	DisableGeoliteUpdate    bool               `yaml:"disableGeoliteUpdate"`
 	Auth                    AuthConfig         `yaml:"auth"`
 	Store                   StoreConfig        `yaml:"store"`
+	ActivityStore           StoreConfig        `yaml:"activityStore"`
 	ReverseProxy            ReverseProxyConfig `yaml:"reverseProxy"`
 }
 
diff --git a/combined/cmd/root.go b/combined/cmd/root.go
index b8ea7064c..00edcb5d4 100644
--- a/combined/cmd/root.go
+++ b/combined/cmd/root.go
@@ -141,6 +141,17 @@ func initializeConfig() error {
 		}
 	}
 
+	if engine := config.Server.ActivityStore.Engine; engine != "" {
+		engineLower := strings.ToLower(engine)
+		if engineLower == "postgres" && config.Server.ActivityStore.DSN == "" {
+			return fmt.Errorf("activityStore.dsn is required when activityStore.engine is postgres")
+		}
+		os.Setenv("NB_ACTIVITY_EVENT_STORE_ENGINE", engineLower)
+		if dsn := config.Server.ActivityStore.DSN; dsn != "" {
+			os.Setenv("NB_ACTIVITY_EVENT_POSTGRES_DSN", dsn)
+		}
+	}
+
 	log.Infof("Starting combined NetBird server")
 	logConfig(config)
 	logEnvVars()
@@ -668,8 +679,11 @@ func logEnvVars() {
 		if strings.HasPrefix(env, "NB_") {
 			key, _, _ := strings.Cut(env, "=")
 			value := os.Getenv(key)
-			if strings.Contains(strings.ToLower(key), "secret") || strings.Contains(strings.ToLower(key), "key") || strings.Contains(strings.ToLower(key), "password") {
+			keyLower := strings.ToLower(key)
+			if strings.Contains(keyLower, "secret") || strings.Contains(keyLower, "key") || strings.Contains(keyLower, "password") {
 				value = maskSecret(value)
+			} else if strings.Contains(keyLower, "dsn") {
+				value = maskDSNPassword(value)
 			}
 			log.Infof("  %s=%s", key, value)
 			found = true
diff --git a/combined/config.yaml.example b/combined/config.yaml.example
index b3b38c5a9..ad033396d 100644
--- a/combined/config.yaml.example
+++ b/combined/config.yaml.example
@@ -104,6 +104,11 @@ server:
     dsn: ""  # Connection string for postgres or mysql
     encryptionKey: ""
 
+  # Activity events store configuration (optional, defaults to sqlite in dataDir)
+  # activityStore:
+  #   engine: "sqlite"  # sqlite or postgres
+  #   dsn: ""  # Connection string for postgres
+
   # Reverse proxy settings (optional)
   # reverseProxy:
   #   trustedHTTPProxies: []