1 # register this host at the backup servers
3 # This class set up the ssh authorization on the backup servers
4 # so this client can push WAL segments. Furthermore, the
5 # client will be allowed to read other hosts backups -- specify
6 # the list of allowed target hosts via params.
8 # @param allow_read_basedir directory under which files can be read
9 # @param allow_read_hosts subdirectories under base to allow
10 class postgres::backup_server::register_backup_clienthost (
11 String $allow_read_basedir = '/srv/backups/pg',
12 Array[Stdlib::Fqdn] $allow_read_hosts = [],
14 include postgres::backup_server::globals
16 $allowstr = $allow_read_hosts.map |$host| { "--read-allow=${allow_read_basedir}/${host}" }.join(' ')
17 $ssh_command = "/usr/local/bin/debbackup-ssh-wrap ${allowstr} ${::hostname}"
19 ssh::authorized_key_add { 'register_backup_clienthost':
20 target_user => $postgres::backup_server::globals::backup_unix_user,
21 key => dig($facts, 'ssh_keys_users', 'postgres', 'id_rsa.pub', 'line'),
22 command => $ssh_command,
23 from => $base::public_addresses,
24 collect_tag => $postgres::backup_server::globals::tag_source_sshkey,