modules/profile/manifests/postgresql.pp

   1 class profile::postgresql {
   2   $password_seed = lookup("base_installation::puppet_pass_seed") |$key| { {} }
   3
   4   class { '::postgresql::globals':
   5     encoding             => 'UTF-8',
   6     locale               => 'en_US.UTF-8',
   7     pg_hba_conf_defaults => false,
   8   }
   9
  10   # FIXME: get it from the postgresql module?
  11   $pg_user = "postgres"
  12
  13   class { '::postgresql::client': }
  14
  15   # FIXME: postgresql module is buggy and doesn't create dir?
  16   file { "/var/lib/postgres":
  17     ensure  => directory,
  18     owner   => $pg_user,
  19     group   => $pg_user,
  20     before  => File["/var/lib/postgres/data"],
  21     require => Package["postgresql-server"],
  22   }
  23
  24   class { '::postgresql::server':
  25     postgres_password => generate_password(24, $password_seed, "postgres")
  26   }
  27
  28   postgresql::server::pg_hba_rule { 'local access as postgres user':
  29     description => 'Allow local access to postgres user',
  30     type        => 'local',
  31     database    => 'all',
  32     user        => $pg_user,
  33     auth_method => 'ident',
  34     order       => "a1",
  35   }
  36   postgresql::server::pg_hba_rule { 'localhost access as postgres user':
  37     description => 'Allow localhost access to postgres user',
  38     type        => 'host',
  39     database    => 'all',
  40     user        => $pg_user,
  41     address     => "127.0.0.1/32",
  42     auth_method => 'md5',
  43     order       => "a2",
  44   }
  45   postgresql::server::pg_hba_rule { 'localhost ip6 access as postgres user':
  46     description => 'Allow localhost access to postgres user',
  47     type        => 'host',
  48     database    => 'all',
  49     user        => $pg_user,
  50     address     => "::1/128",
  51     auth_method => 'md5',
  52     order       => "a3",
  53   }
  54   postgresql::server::pg_hba_rule { 'deny access to postgresql user':
  55     description => 'Deny remote access to postgres user',
  56     type        => 'host',
  57     database    => 'all',
  58     user        => $pg_user,
  59     address     => "0.0.0.0/0",
  60     auth_method => 'reject',
  61     order       => "a4",
  62   }
  63
  64   postgresql::server::pg_hba_rule { 'local access':
  65     description => 'Allow local access with password',
  66     type        => 'local',
  67     database    => 'all',
  68     user        => 'all',
  69     auth_method => 'md5',
  70     order       => "b1",
  71   }
  72
  73   postgresql::server::pg_hba_rule { 'local access with same name':
  74     description => 'Allow local access with same name',
  75     type        => 'local',
  76     database    => 'all',
  77     user        => 'all',
  78     auth_method => 'ident',
  79     order       => "b2",
  80   }
  81
  82 }
  83