1 # Class: postgresql::config::beforeservice
5 # [*ip_mask_deny_postgres_user*] - ip mask for denying remote access for postgres user; defaults to '0.0.0.0/0',
6 # meaning that all TCP access for postgres user is denied.
7 # [*ip_mask_allow_all_users*] - ip mask for allowing remote access for other users (besides postgres);
8 # defaults to '127.0.0.1/32', meaning only allow connections from localhost
9 # [*listen_addresses*] - what IP address(es) to listen on; comma-separated list of addresses; defaults to
10 # 'localhost', '*' = all
11 # [*ipv4acls*] - list of strings for access control for connection method, users, databases, IPv4
12 # addresses; see postgresql documentation about pg_hba.conf for information
13 # [*ipv6acls*] - list of strings for access control for connection method, users, databases, IPv6
14 # addresses; see postgresql documentation about pg_hba.conf for information
15 # [*pg_hba_conf_path*] - path to pg_hba.conf file
16 # [*postgresql_conf_path*] - path to postgresql.conf file
17 # [*manage_redhat_firewall*] - boolean indicating whether or not the module should open a port in the firewall on
18 # redhat-based systems; this parameter is likely to change in future versions. Possible
19 # changes include support for non-RedHat systems and finer-grained control over the
20 # firewall rule (currently, it simply opens up the postgres port to all TCP connections).
21 # [*manage_pg_hba_conf*] - boolean indicating whether or not the module manages pg_hba.conf file.
28 # This class is not intended to be used directly; it is
29 # managed by postgresl::config. It contains resources
30 # that should be handled *before* the postgres service
31 # has been started up.
33 # class { 'postgresql::config::before_service':
34 # ip_mask_allow_all_users => '0.0.0.0/0',
37 class postgresql::config::beforeservice(
39 $postgresql_conf_path,
40 $ip_mask_deny_postgres_user = $postgresql::params::ip_mask_deny_postgres_user,
41 $ip_mask_allow_all_users = $postgresql::params::ip_mask_allow_all_users,
42 $listen_addresses = $postgresql::params::listen_addresses,
43 $ipv4acls = $postgresql::params::ipv4acls,
44 $ipv6acls = $postgresql::params::ipv6acls,
45 $manage_redhat_firewall = $postgresql::params::manage_redhat_firewall,
46 $manage_pg_hba_conf = $postgresql::params::manage_pg_hba_conf
47 ) inherits postgresql::params {
51 owner => $postgresql::params::user,
52 group => $postgresql::params::group,
55 if $manage_pg_hba_conf {
56 # Create the main pg_hba resource
57 postgresql::pg_hba { 'main':
58 notify => Exec['reload_postgresql'],
61 Postgresql::Pg_hba_rule {
66 # Lets setup the base rules
67 postgresql::pg_hba_rule { 'local access as postgres user':
69 user => $postgresql::params::user,
70 auth_method => 'ident',
71 auth_option => $postgresql::params::version ? {
77 postgresql::pg_hba_rule { 'local access to database with same name':
79 auth_method => 'ident',
80 auth_option => $postgresql::params::version ? {
86 postgresql::pg_hba_rule { 'deny access to postgresql user':
88 user => $postgresql::params::user,
89 address => $ip_mask_deny_postgres_user,
90 auth_method => 'reject',
94 # ipv4acls are passed as an array of rule strings, here we transform them into
95 # a resources hash, and pass the result to create_resources
96 $ipv4acl_resources = postgresql_acls_to_resources_hash($ipv4acls, 'ipv4acls', 10)
97 create_resources('postgresql::pg_hba_rule', $ipv4acl_resources)
99 postgresql::pg_hba_rule { 'allow access to all users':
101 address => $ip_mask_allow_all_users,
102 auth_method => 'md5',
105 postgresql::pg_hba_rule { 'allow access to ipv6 localhost':
107 address => '::1/128',
108 auth_method => 'md5',
112 # ipv6acls are passed as an array of rule strings, here we transform them into
113 # a resources hash, and pass the result to create_resources
114 $ipv6acl_resources = postgresql_acls_to_resources_hash($ipv6acls, 'ipv6acls', 102)
115 create_resources('postgresql::pg_hba_rule', $ipv6acl_resources)
118 # We must set a "listen_addresses" line in the postgresql.conf if we
119 # want to allow any connections from remote hosts.
120 file_line { 'postgresql.conf#listen_addresses':
121 path => $postgresql_conf_path,
122 match => '^listen_addresses\s*=.*$',
123 line => "listen_addresses = '${listen_addresses}'",
124 notify => Service['postgresqld'],
127 # Here we are adding an 'include' line so that users have the option of
128 # managing their own settings in a second conf file. This only works for
129 # postgresql 8.2 and higher.
130 if(versioncmp($postgresql::params::version, '8.2') >= 0) {
131 # Since we're adding an "include" for this extras config file, we need
132 # to make sure it exists.
133 exec { "create_postgresql_conf_path":
134 command => "touch `dirname ${postgresql_conf_path}`/postgresql_puppet_extras.conf",
135 path => '/usr/bin:/bin',
136 unless => "[ -f `dirname ${postgresql_conf_path}`/postgresql_puppet_extras.conf ]"
139 file_line { 'postgresql.conf#include':
140 path => $postgresql_conf_path,
141 line => "include 'postgresql_puppet_extras.conf'",
142 require => Exec["create_postgresql_conf_path"],
143 notify => Service['postgresqld'],
148 # TODO: is this a reasonable place for this firewall stuff?
149 # TODO: figure out a way to make this not platform-specific; debian and ubuntu have
150 # an out-of-the-box firewall configuration that seems trickier to manage
151 # TODO: get rid of hard-coded port
152 if ($manage_redhat_firewall and $firewall_supported) {
153 exec { 'postgresql-persist-firewall':
154 command => $persist_firewall_command,
159 notify => Exec['postgresql-persist-firewall']
162 firewall { '5432 accept - postgres':