diff options
Diffstat (limited to 'modules/profile/manifests/postgresql_master.pp')
-rw-r--r-- | modules/profile/manifests/postgresql_master.pp | 119 |
1 files changed, 8 insertions, 111 deletions
diff --git a/modules/profile/manifests/postgresql_master.pp b/modules/profile/manifests/postgresql_master.pp index 067345a..e28c1b0 100644 --- a/modules/profile/manifests/postgresql_master.pp +++ b/modules/profile/manifests/postgresql_master.pp | |||
@@ -2,120 +2,17 @@ define profile::postgresql_master ( | |||
2 | $letsencrypt_host = undef, | 2 | $letsencrypt_host = undef, |
3 | $backup_hosts = [], | 3 | $backup_hosts = [], |
4 | ) { | 4 | ) { |
5 | $password_seed = lookup("base_installation::puppet_pass_seed") | 5 | profile::postgresql::ssl { "/var/lib/postgres": |
6 | 6 | cert => "/etc/letsencrypt/live/$letsencrypt_host/cert.pem", | |
7 | ensure_resource("file", "/var/lib/postgres/data/certs", { | 7 | key => "/etc/letsencrypt/live/$letsencrypt_host/privkey.pem", |
8 | ensure => directory, | ||
9 | mode => "0700", | ||
10 | owner => $::profile::postgresql::pg_user, | ||
11 | group => $::profile::postgresql::pg_user, | ||
12 | require => File["/var/lib/postgres"], | ||
13 | }) | ||
14 | |||
15 | ensure_resource("file", "/var/lib/postgres/data/certs/cert.pem", { | ||
16 | source => "file:///etc/letsencrypt/live/$letsencrypt_host/cert.pem", | ||
17 | mode => "0600", | ||
18 | links => "follow", | ||
19 | owner => $::profile::postgresql::pg_user, | ||
20 | group => $::profile::postgresql::pg_user, | ||
21 | require => [Letsencrypt::Certonly[$letsencrypt_host], File["/var/lib/postgres/data/certs"]] | ||
22 | }) | ||
23 | |||
24 | ensure_resource("file", "/var/lib/postgres/data/certs/privkey.pem", { | ||
25 | source => "file:///etc/letsencrypt/live/$letsencrypt_host/privkey.pem", | ||
26 | mode => "0600", | ||
27 | links => "follow", | ||
28 | owner => $::profile::postgresql::pg_user, | ||
29 | group => $::profile::postgresql::pg_user, | ||
30 | require => [Letsencrypt::Certonly[$letsencrypt_host], File["/var/lib/postgres/data/certs"]] | ||
31 | }) | ||
32 | |||
33 | ensure_resource("postgresql::server::config_entry", "wal_level", { | ||
34 | value => "logical", | ||
35 | }) | ||
36 | |||
37 | ensure_resource("postgresql::server::config_entry", "ssl", { | ||
38 | value => "on", | ||
39 | require => Letsencrypt::Certonly[$letsencrypt_host], | 8 | require => Letsencrypt::Certonly[$letsencrypt_host], |
40 | }) | 9 | } |
41 | |||
42 | ensure_resource("postgresql::server::config_entry", "ssl_cert_file", { | ||
43 | value => "/var/lib/postgres/data/certs/cert.pem", | ||
44 | require => Letsencrypt::Certonly[$letsencrypt_host], | ||
45 | }) | ||
46 | |||
47 | ensure_resource("postgresql::server::config_entry", "ssl_key_file", { | ||
48 | value => "/var/lib/postgres/data/certs/privkey.pem", | ||
49 | require => Letsencrypt::Certonly[$letsencrypt_host], | ||
50 | }) | ||
51 | 10 | ||
52 | $backup_hosts.each |$backup_host| { | 11 | $backup_hosts.each |$backup_host| { |
53 | ensure_packages(["pam_ldap"]) | 12 | profile::postgresql::replication { $backup_host: |
54 | 13 | handle_role => true, | |
55 | $host = find_host($facts["ldapvar"]["other"], $backup_host) | 14 | handle_slot => true, |
56 | unless empty($host) { | 15 | add_self_role => true, |
57 | $host["ipHostNumber"].each |$ip| { | ||
58 | $infos = split($ip, "/") | ||
59 | $ipaddress = $infos[0] | ||
60 | if (length($infos) == 1 and $ipaddress =~ /:/) { | ||
61 | $mask = "128" | ||
62 | } elsif (length($infos) == 1) { | ||
63 | $mask = "32" | ||
64 | } else { | ||
65 | $mask = $infos[1] | ||
66 | } | ||
67 | |||
68 | postgresql::server::pg_hba_rule { "allow TCP access to replication user from backup for replication from $ipaddress/$mask": | ||
69 | type => 'hostssl', | ||
70 | database => 'replication', | ||
71 | user => $backup_host, | ||
72 | address => "$ipaddress/$mask", | ||
73 | auth_method => 'pam', | ||
74 | order => "06-01", | ||
75 | } | ||
76 | } | ||
77 | |||
78 | postgresql::server::role { $backup_host: | ||
79 | replication => true, | ||
80 | } | ||
81 | |||
82 | postgresql_replication_slot { regsubst($backup_host, '-', "_", "G"): | ||
83 | ensure => present | ||
84 | } | ||
85 | } | 16 | } |
86 | } | 17 | } |
87 | |||
88 | $ldap_server = lookup("base_installation::ldap_server") | ||
89 | $ldap_base = lookup("base_installation::ldap_base") | ||
90 | $ldap_dn = lookup("base_installation::ldap_dn") | ||
91 | $ldap_cn = lookup("base_installation::ldap_cn") | ||
92 | $ldap_password = generate_password(24, $password_seed, "ldap") | ||
93 | $ldap_attribute = "cn" | ||
94 | |||
95 | # This is to be replicated to the backup | ||
96 | postgresql::server::role { $ldap_cn: | ||
97 | replication => true, | ||
98 | } | ||
99 | |||
100 | file { "/etc/pam_ldap.d": | ||
101 | ensure => directory, | ||
102 | mode => "0755", | ||
103 | owner => "root", | ||
104 | group => "root", | ||
105 | } -> | ||
106 | file { "/etc/pam_ldap.d/postgresql.conf": | ||
107 | ensure => "present", | ||
108 | mode => "0600", | ||
109 | owner => $::profile::postgresql::pg_user, | ||
110 | group => "root", | ||
111 | content => template("profile/postgresql_master/pam_ldap_postgresql.conf.erb"), | ||
112 | } -> | ||
113 | file { "/etc/pam.d/postgresql": | ||
114 | ensure => "present", | ||
115 | mode => "0644", | ||
116 | owner => "root", | ||
117 | group => "root", | ||
118 | source => "puppet:///modules/profile/postgresql_master/pam_postgresql" | ||
119 | } | ||
120 | |||
121 | } | 18 | } |