2 class salsa::database inherits salsa {
3 class { 'postgresql::globals':
6 class { 'postgresql::server':
7 listen_addresses => '*',
9 class { 'postgresql::server::contrib': }
11 postgresql::server::db { $salsa::db_name:
12 user => $salsa::db_role,
13 password => postgresql_password($salsa::db_role, $salsa::db_password),
16 postgresql::server::extension { 'pg_trgm':
17 database => $salsa::db_name,
18 require => Class['postgresql::server::contrib'],
23 include postgres::backup_source
25 $pg_config_options = {
26 'track_counts' => 'yes',
27 'archive_mode' => 'yes',
28 'wal_level' => 'archive',
29 'max_wal_senders' => '3',
30 'archive_timeout' => '1h',
31 'archive_command' => '/usr/local/bin/pg-backup-file main WAL %p',
33 'ssl_cert_file' => '/etc/ssl/debian/certs/thishost-server.crt',
34 'ssl_key_file' => '/etc/ssl/private/thishost-server.key',
36 $pg_config_options.each |String $key, String $value| {
37 postgresql_conf { $key:
39 target => $postgresql::params::postgresql_conf_path,
40 notify => Service['postgresqld'],
44 $datadir = assert_type(String[1], $postgresql::params::datadir)
46 file { "${datadir}/.nobackup":
49 if $::postgresql_key {
50 $ipaddr = assert_type(String[1], join(getfromhash($site::nodeinfo, 'ldap', 'ipHostNumber'), ","))
52 @@concat::fragment { "onion::balance::instance::dsa-snippet::$name::$fqdn":
53 target => "/etc/dsa/postgresql-backup/sshkeys-sources",
55 ${::hostname} ${ipaddr} ${::postgresql_key}
57 tag => "postgresql::server::backup-source-sshkey",
61 $db_backup_role = 'debian-backup'
62 $db_backup_role_password = hkdf('/etc/puppet/secret', "postgresql-${::hostname}-${postgresql::params::port}-backup_role}")
64 # XXX - get these from the roles and ldap
65 $db_backup_hosts = ['5.153.231.12/32', '93.94.130.161/32', '2001:41c8:1000:21::21:12/128', '2a02:158:380:280::161/128']
67 postgresql::server::role { $db_backup_role:
68 password_hash => postgresql_password($db_backup_role, $db_backup_role_password),
71 $db_backup_hosts.each |String $address| {
72 postgresql::server::pg_hba_rule { "debian_backup-${address}":
73 description => 'Open up PostgreSQL for backups',
75 database => 'replication',
76 user => $db_backup_role,
81 @ferm::rule { "dsa-postgres-${postgresql::params::port}":
82 description => 'Allow postgress access from backup host',
84 rule => "&SERVICE_RANGE(tcp, ${postgresql::params::port}, ( @ipfilter(\$HOST_PGBACKUPHOST) ))",
87 # add cluster to make-base-backups