]>
Commit | Line | Data |
---|---|---|
1 | class profile::postgresql { | |
2 | $password_seed = lookup("base_installation::puppet_pass_seed") |$key| { {} } | |
3 | ||
4 | class { '::postgresql::globals': | |
5 | encoding => 'UTF-8', | |
6 | locale => 'en_US.UTF-8', | |
7 | pg_hba_conf_defaults => false, | |
8 | } | |
9 | ||
10 | # FIXME: get it from the postgresql module? | |
11 | $pg_user = "postgres" | |
12 | ||
13 | class { '::postgresql::client': } | |
14 | ||
15 | # FIXME: postgresql module is buggy and doesn't create dir? | |
16 | file { "/var/lib/postgres": | |
17 | ensure => directory, | |
18 | owner => $pg_user, | |
19 | group => $pg_user, | |
20 | before => File["/var/lib/postgres/data"], | |
21 | require => Package["postgresql-server"], | |
22 | } | |
23 | ||
24 | class { '::postgresql::server': | |
25 | postgres_password => generate_password(24, $password_seed, "postgres") | |
26 | } | |
27 | ||
28 | postgresql::server::pg_hba_rule { 'local access as postgres user': | |
29 | description => 'Allow local access to postgres user', | |
30 | type => 'local', | |
31 | database => 'all', | |
32 | user => $pg_user, | |
33 | auth_method => 'ident', | |
34 | order => "a1", | |
35 | } | |
36 | postgresql::server::pg_hba_rule { 'localhost access as postgres user': | |
37 | description => 'Allow localhost access to postgres user', | |
38 | type => 'host', | |
39 | database => 'all', | |
40 | user => $pg_user, | |
41 | address => "127.0.0.1/32", | |
42 | auth_method => 'md5', | |
43 | order => "a2", | |
44 | } | |
45 | postgresql::server::pg_hba_rule { 'localhost ip6 access as postgres user': | |
46 | description => 'Allow localhost access to postgres user', | |
47 | type => 'host', | |
48 | database => 'all', | |
49 | user => $pg_user, | |
50 | address => "::1/128", | |
51 | auth_method => 'md5', | |
52 | order => "a3", | |
53 | } | |
54 | postgresql::server::pg_hba_rule { 'deny access to postgresql user': | |
55 | description => 'Deny remote access to postgres user', | |
56 | type => 'host', | |
57 | database => 'all', | |
58 | user => $pg_user, | |
59 | address => "0.0.0.0/0", | |
60 | auth_method => 'reject', | |
61 | order => "a4", | |
62 | } | |
63 | ||
64 | postgresql::server::pg_hba_rule { 'local access': | |
65 | description => 'Allow local access with password', | |
66 | type => 'local', | |
67 | database => 'all', | |
68 | user => 'all', | |
69 | auth_method => 'md5', | |
70 | order => "b1", | |
71 | } | |
72 | ||
73 | postgresql::server::pg_hba_rule { 'local access with same name': | |
74 | description => 'Allow local access with same name', | |
75 | type => 'local', | |
76 | database => 'all', | |
77 | user => 'all', | |
78 | auth_method => 'ident', | |
79 | order => "b2", | |
80 | } | |
81 | ||
82 | } | |
83 |