aboutsummaryrefslogtreecommitdiff
path: root/modules
diff options
context:
space:
mode:
Diffstat (limited to 'modules')
-rw-r--r--modules/profile/manifests/postgresql_master.pp50
-rw-r--r--modules/role/manifests/backup/postgresql.pp98
-rw-r--r--modules/role/templates/backup/pam_ldap_pgbouncer.conf.erb2
-rw-r--r--modules/role/templates/backup/postgresql.conf.erb9
4 files changed, 124 insertions, 35 deletions
diff --git a/modules/profile/manifests/postgresql_master.pp b/modules/profile/manifests/postgresql_master.pp
index 9966f0d..6f8854d 100644
--- a/modules/profile/manifests/postgresql_master.pp
+++ b/modules/profile/manifests/postgresql_master.pp
@@ -83,33 +83,33 @@ define profile::postgresql_master (
83 ensure => present 83 ensure => present
84 } 84 }
85 } 85 }
86 }
86 87
87 $ldap_server = lookup("base_installation::ldap_server") 88 $ldap_server = lookup("base_installation::ldap_server")
88 $ldap_base = lookup("base_installation::ldap_base") 89 $ldap_base = lookup("base_installation::ldap_base")
89 $ldap_dn = lookup("base_installation::ldap_dn") 90 $ldap_dn = lookup("base_installation::ldap_dn")
90 $ldap_password = generate_password(24, $password_seed, "ldap") 91 $ldap_password = generate_password(24, $password_seed, "ldap")
91 $ldap_attribute = "cn" 92 $ldap_attribute = "cn"
92 93
93 file { "/etc/pam_ldap.d": 94 file { "/etc/pam_ldap.d":
94 ensure => directory, 95 ensure => directory,
95 mode => "0755", 96 mode => "0755",
96 owner => "root", 97 owner => "root",
97 group => "root", 98 group => "root",
98 } -> 99 } ->
99 file { "/etc/pam_ldap.d/postgresql.conf": 100 file { "/etc/pam_ldap.d/postgresql.conf":
100 ensure => "present", 101 ensure => "present",
101 mode => "0600", 102 mode => "0600",
102 owner => $::profile::postgresql::pg_user, 103 owner => $::profile::postgresql::pg_user,
103 group => "root", 104 group => "root",
104 content => template("profile/postgresql_master/pam_ldap_postgresql.conf.erb"), 105 content => template("profile/postgresql_master/pam_ldap_postgresql.conf.erb"),
105 } -> 106 } ->
106 file { "/etc/pam.d/postgresql": 107 file { "/etc/pam.d/postgresql":
107 ensure => "present", 108 ensure => "present",
108 mode => "0644", 109 mode => "0644",
109 owner => "root", 110 owner => "root",
110 group => "root", 111 group => "root",
111 source => "puppet:///modules/profile/postgresql_master/pam_postgresql" 112 source => "puppet:///modules/profile/postgresql_master/pam_postgresql"
112 }
113 } 113 }
114 114
115} 115}
diff --git a/modules/role/manifests/backup/postgresql.pp b/modules/role/manifests/backup/postgresql.pp
index b26773c..ee62a00 100644
--- a/modules/role/manifests/backup/postgresql.pp
+++ b/modules/role/manifests/backup/postgresql.pp
@@ -13,7 +13,7 @@ class role::backup::postgresql inherits role::backup {
13 $ldap_server = lookup("base_installation::ldap_server") 13 $ldap_server = lookup("base_installation::ldap_server")
14 $ldap_base = lookup("base_installation::ldap_base") 14 $ldap_base = lookup("base_installation::ldap_base")
15 $ldap_dn = lookup("base_installation::ldap_dn") 15 $ldap_dn = lookup("base_installation::ldap_dn")
16 $ldap_attribute = "uid" 16 $pgbouncer_ldap_attribute = "uid"
17 17
18 $pg_slot = regsubst($ldap_cn, '-', "_", "G") 18 $pg_slot = regsubst($ldap_cn, '-', "_", "G")
19 19
@@ -71,18 +71,13 @@ class role::backup::postgresql inherits role::backup {
71 ], 71 ],
72 } 72 }
73 73
74 file { "/etc/pam_ldap.d":
75 ensure => directory,
76 mode => "0755",
77 owner => "root",
78 group => "root",
79 } ->
80 file { "/etc/pam_ldap.d/pgbouncer.conf": 74 file { "/etc/pam_ldap.d/pgbouncer.conf":
81 ensure => "present", 75 ensure => "present",
82 mode => "0600", 76 mode => "0600",
83 owner => $pg_user, 77 owner => $pg_user,
84 group => "root", 78 group => "root",
85 content => template("role/backup/pam_ldap_pgbouncer.conf.erb"), 79 content => template("role/backup/pam_ldap_pgbouncer.conf.erb"),
80 require => File["/etc/pam_ldap.d"],
86 } -> 81 } ->
87 file { "/etc/pam.d/pgbouncer": 82 file { "/etc/pam.d/pgbouncer":
88 ensure => "present", 83 ensure => "present",
@@ -94,6 +89,29 @@ class role::backup::postgresql inherits role::backup {
94 } 89 }
95 } 90 }
96 91
92 $ldap_attribute = "cn"
93
94 file { "/etc/pam_ldap.d":
95 ensure => directory,
96 mode => "0755",
97 owner => "root",
98 group => "root",
99 } ->
100 file { "/etc/pam_ldap.d/postgresql.conf":
101 ensure => "present",
102 mode => "0600",
103 owner => $pg_user,
104 group => "root",
105 content => template("profile/postgresql_master/pam_ldap_postgresql.conf.erb"),
106 } ->
107 file { "/etc/pam.d/postgresql":
108 ensure => "present",
109 mode => "0644",
110 owner => "root",
111 group => "root",
112 source => "puppet:///modules/profile/postgresql_master/pam_postgresql"
113 }
114
97 $pg_backup_hosts.each |$backup_host_cn, $pg_infos| { 115 $pg_backup_hosts.each |$backup_host_cn, $pg_infos| {
98 $host = find_host($facts["ldapvar"]["other"], $backup_host_cn) 116 $host = find_host($facts["ldapvar"]["other"], $backup_host_cn)
99 if empty($host) { 117 if empty($host) {
@@ -103,16 +121,75 @@ class role::backup::postgresql inherits role::backup {
103 } else { 121 } else {
104 $pg_backup_host = $host["vars"]["real_hostname"][0] 122 $pg_backup_host = $host["vars"]["real_hostname"][0]
105 } 123 }
124
106 $pg_path = "$mountpoint/$pg_backup_host/postgresql" 125 $pg_path = "$mountpoint/$pg_backup_host/postgresql"
107 $pg_backup_path = "$mountpoint/$pg_backup_host/postgresql_backup" 126 $pg_backup_path = "$mountpoint/$pg_backup_host/postgresql_backup"
108 $pg_host = "$pg_backup_host" 127 $pg_host = "$pg_backup_host"
109 $pg_port = $pg_infos["dbport"] 128 $pg_port = $pg_infos["dbport"]
110 129
130 if has_key($host["vars"], "postgresql_backup_port") {
131 $pg_listen_port = $host["vars"]["postgresql_backup_port"][0]
132 file { "$pg_path/certs":
133 ensure => directory,
134 mode => "0700",
135 owner => $pg_user,
136 group => $pg_group,
137 } ->
138 ssl::self_signed_certificate { $backup_host_cn:
139 common_name => $backup_host_cn,
140 country => "FR",
141 days => "3650",
142 organization => "Immae",
143 owner => $pg_user,
144 group => $pg_group,
145 directory => "$pg_path/certs",
146 before => File["$pg_path/postgresql.conf"],
147 }
148 $ssl_key = "$pg_path/certs/$backup_host_cn.key"
149 $ssl_cert = "$pg_path/certs/$backup_host_cn.crt"
150 } else {
151 $pg_listen_port = undef
152 $ssl_key = undef
153 $ssl_cert = undef
154 }
155
156
157 unless empty($host) {
158 $host["ipHostNumber"].each |$ip| {
159 $infos = split($ip, "/")
160 $ipaddress = $infos[0]
161 if (length($infos) == 1 and $ipaddress =~ /:/) {
162 $mask = "128"
163 } elsif (length($infos) == 1) {
164 $mask = "32"
165 } else {
166 $mask = $infos[1]
167 }
168
169 postgresql::server::pg_hba_rule { "allow TCP access for initial replication from $ipaddress/$mask":
170 type => 'hostssl',
171 database => 'replication',
172 user => $backup_host_cn,
173 address => "$ipaddress/$mask",
174 auth_method => 'pam',
175 order => "06-01",
176 target => "$pg_path/pg_hba.conf",
177 postgresql_version => "10",
178 }
179 }
180 }
181
111 if !empty($ldap_filter) and ($pg_infos["pgbouncer"]) { 182 if !empty($ldap_filter) and ($pg_infos["pgbouncer"]) {
183 if empty($pg_listen_port) {
184 $pg_listen_port_key = ""
185 } else {
186 $pg_listen_port_key = "port=$pg_listen_port"
187 }
188
112 concat::fragment { "pgbouncer_$pg_backup_host": 189 concat::fragment { "pgbouncer_$pg_backup_host":
113 target => "/etc/pgbouncer/pgbouncer.ini", 190 target => "/etc/pgbouncer/pgbouncer.ini",
114 order => 02, 191 order => 02,
115 content => "${pg_infos[pgbouncer_dbname]} = host=$mountpoint/$pg_backup_host/postgresql user=${pg_infos[dbuser]} dbname=${pg_infos[dbname]}", 192 content => "${pg_infos[pgbouncer_dbname]} = host=$mountpoint/$pg_backup_host/postgresql $pg_listen_port_key user=${pg_infos[dbuser]} dbname=${pg_infos[dbname]}",
116 } 193 }
117 194
118 postgresql::server::pg_hba_rule { "$pg_backup_host - local access as ${pg_infos[dbuser]} user": 195 postgresql::server::pg_hba_rule { "$pg_backup_host - local access as ${pg_infos[dbuser]} user":
@@ -292,6 +369,11 @@ class role::backup::postgresql inherits role::backup {
292 Concat["$pg_path/pg_hba.conf"], 369 Concat["$pg_path/pg_hba.conf"],
293 Concat["$pg_path/recovery.conf"], 370 Concat["$pg_path/recovery.conf"],
294 File["$pg_path/postgresql.conf"], 371 File["$pg_path/postgresql.conf"],
372 ],
373 subscribe => [
374 Concat["$pg_path/pg_hba.conf"],
375 Concat["$pg_path/recovery.conf"],
376 File["$pg_path/postgresql.conf"],
295 ] 377 ]
296 } 378 }
297 } 379 }
diff --git a/modules/role/templates/backup/pam_ldap_pgbouncer.conf.erb b/modules/role/templates/backup/pam_ldap_pgbouncer.conf.erb
index 12fa9bb..384a418 100644
--- a/modules/role/templates/backup/pam_ldap_pgbouncer.conf.erb
+++ b/modules/role/templates/backup/pam_ldap_pgbouncer.conf.erb
@@ -3,5 +3,5 @@ host <%= @ldap_server %>
3base <%= @ldap_base %> 3base <%= @ldap_base %>
4binddn <%= @ldap_dn %> 4binddn <%= @ldap_dn %>
5bindpw <%= @ldap_password %> 5bindpw <%= @ldap_password %>
6pam_login_attribute <%= @ldap_attribute %> 6pam_login_attribute <%= @pgbouncer_ldap_attribute %>
7pam_filter <%= @ldap_filter %> 7pam_filter <%= @ldap_filter %>
diff --git a/modules/role/templates/backup/postgresql.conf.erb b/modules/role/templates/backup/postgresql.conf.erb
index 860089b..8741507 100644
--- a/modules/role/templates/backup/postgresql.conf.erb
+++ b/modules/role/templates/backup/postgresql.conf.erb
@@ -1,5 +1,12 @@
1<%- if !@pg_listen_port.nil? -%>
2listen_addresses= '*'
3port = <%= @pg_listen_port %>
4ssl = on
5ssl_key_file = '<%= @ssl_key %>'
6ssl_cert_file = '<%= @ssl_cert %>'
7<%- else -%>
1listen_addresses= '' 8listen_addresses= ''
9<%- end %>
2unix_socket_directories = '<%= @pg_path %>' 10unix_socket_directories = '<%= @pg_path %>'
3data_directory = '<%= @pg_path %>' 11data_directory = '<%= @pg_path %>'
4wal_level = logical 12wal_level = logical
5