3 # This define causes the cluster to be registered on the backupservers.
5 # Furthermore, if this cluster is managed with postgresql::server and
6 # do_role and do_hba are set, we create the role and modify the pg_hba.conf file.
8 # Since postgresql::server only supports a single cluster per host, we are moving
9 # towards our own postgres::cluster, and this define also exports a hba rule for
10 # those (regardless of the do_hba setting). If the cluster is managed with
11 # postgres::cluster and has its manage_hba option set, this will then cause the
12 # backup hosts to be allowed to replacate.
14 # Regarless of how the cluster is managed, firewall rules are set up to allow
15 # access from the backup hosts.
17 # @param pg_version pg version of the cluster
18 # @param pg_cluster cluster name
19 # @param pg_port port of the postgres cluster
20 # @param db_backup_role replication role username
21 # @param db_backup_role_password password of the replication role
22 # @param do_role create the role (requires setup with postgresql::server)
23 # @param do_hba update pg_hba (requires setup with postgresql::server)
24 define postgres::backup_cluster(
26 String $pg_cluster = 'main',
27 Integer $pg_port = 5432,
28 String $db_backup_role = lookup('postgres::backup_cluster::db_backup_role'),
29 String $db_backup_role_password = hkdf('/etc/puppet/secret', "postgresql-${::hostname}-${$pg_cluster}-${pg_port}-backup_role}"),
30 Boolean $do_role = false,
31 Boolean $do_hba = false,
33 $datadir = "/var/lib/postgresql/${pg_version}/${pg_cluster}"
34 file { "${datadir}/.nobackup":
38 ## XXX - get these from the roles and ldap
40 $backup_servers_addrs = ['5.153.231.12/32', '93.94.130.161/32', '2001:41c8:1000:21::21:12/128', '2a02:158:380:280::161/128']
43 postgresql::server::role { $db_backup_role:
44 password_hash => postgresql_password($db_backup_role, $db_backup_role_password),
49 $backup_servers_addrs.each |String $address| {
50 postgresql::server::pg_hba_rule { "debian_backup-${address}":
51 description => 'Open up PostgreSQL for backups',
53 database => 'replication',
54 user => $db_backup_role,
61 # Send connections to the port to the pg-backup chain
62 # there, the register_backup_clienthost class will have
63 # realized the exported allows from the backup servers.
65 # Any non-matching traffic will fall through and it can
66 # be allowed elsewhere
68 # this rule is only needed for clusters that we do not manage
69 # with postgres::cluster. Hopefully these will go away with time
70 ferm::rule::simple { "dsa-postgres-backup-${pg_port}":
71 description => 'Check for postgres access from backup host',
73 target => 'pg-backup',
76 postgres::cluster::hba_entry { "backup-replication::${pg_version}::${pg_cluster}":
77 pg_version => $pg_version,
78 pg_cluster => $pg_cluster,
80 database => 'replication',
81 user => db_backup_role,
82 address => $backup_servers_addrs,
84 postgres::backup_server::register_backup_cluster { "backup-role-${::fqdn}}-${pg_port}":
86 pg_role => $db_backup_role,
87 pg_password => $db_backup_role_password,
88 pg_cluster => $pg_cluster,
89 pg_version => $pg_version,