modules/salsa/manifests/database.pp

   1 #
   2 class salsa::database inherits salsa {
   3         class { 'postgresql::globals':
   4                 version => '9.6',
   5         }
   6         class { 'postgresql::server':
   7                 listen_addresses => '*',
   8         }
   9         class { 'postgresql::server::contrib': }
  10
  11         postgresql::server::db { $salsa::db_name:
  12                 user     => $salsa::db_role,
  13                 password => postgresql_password($salsa::db_role, $salsa::db_password),
  14         }
  15
  16         postgresql::server::extension { 'pg_trgm':
  17                 database => $salsa::db_name,
  18                 require => Class['postgresql::server::contrib'],
  19         }
  20
  21
  22
  23         include postgres::backup_source
  24
  25         $pg_config_options = {
  26                 'track_counts'  => 'yes',
  27                 'archive_mode' => 'yes',
  28                 'wal_level' => 'archive',
  29                 'max_wal_senders' => '3',
  30                 'archive_timeout' => '1h',
  31                 'archive_command' => '/usr/local/bin/pg-backup-file main WAL %p',
  32                 'ssl' => 'on',
  33                 'ssl_cert_file' => '/etc/ssl/debian/certs/thishost-server.crt',
  34                 'ssl_key_file' => '/etc/ssl/private/thishost-server.key',
  35         }
  36         $pg_config_options.each |String $key, String $value| {
  37                 postgresql_conf { $key:
  38                         value => $value,
  39                         target => $postgresql::params::postgresql_conf_path,
  40                         notify => Service['postgresqld'],
  41                 }
  42         }
  43
  44         $datadir = assert_type(String[1], $postgresql::params::datadir)
  45         warning("foo ")
  46         file { "${datadir}/.nobackup":
  47                 content  => ""
  48         }
  49         if $::postgresql_key {
  50                 $ipaddr = assert_type(String[1], join(getfromhash($site::nodeinfo, 'ldap', 'ipHostNumber'), ","))
  51
  52                 @@concat::fragment { "onion::balance::instance::dsa-snippet::$name::$fqdn":
  53                         target  => "/etc/dsa/postgresql-backup/sshkeys-sources",
  54                         content  => @("EOF"),
  55                                         ${::hostname} ${ipaddr} ${::postgresql_key}
  56                                         | EOF
  57                         tag     => "postgresql::server::backup-source-sshkey",
  58                 }
  59         }
  60
  61         $db_backup_role = 'debian-backup'
  62         $db_backup_role_password = hkdf('/etc/puppet/secret', "postgresql-${::hostname}-${postgresql::params::port}-backup_role}")
  63
  64         # XXX - get these from the roles and ldap
  65         $db_backup_hosts = ['5.153.231.12/32', '93.94.130.161/32', '2001:41c8:1000:21::21:12/128', '2a02:158:380:280::161/128']
  66
  67         postgresql::server::role { $db_backup_role:
  68                 password_hash => postgresql_password($db_backup_role, $db_backup_role_password),
  69                 replication => true,
  70         }
  71         $db_backup_hosts.each |String $address| {
  72                 postgresql::server::pg_hba_rule { "debian_backup-${address}":
  73                         description => 'Open up PostgreSQL for backups',
  74                         type        => 'hostssl',
  75                         database    => 'replication',
  76                         user        => $db_backup_role,
  77                         address     => $address,
  78                         auth_method => 'md5',
  79                 }
  80         }
  81         @ferm::rule { "dsa-postgres-${postgresql::params::port}":
  82                 description => 'Allow postgress access from backup host',
  83                 domain      => '(ip ip6)',
  84                 rule        => "&SERVICE_RANGE(tcp, ${postgresql::params::port}, ( @ipfilter(\$HOST_PGBACKUPHOST) ))",
  85         }
  86
  87         # add cluster to make-base-backups
  88 }