roles::postgresql::server now sets up postgres::cluster for all clusters

[mirror/dsa-puppet.git] / modules / postgres / manifests / backup_server / register_backup_clienthost.pp

diff --git a/modules/postgres/manifests/backup_server/register_backup_clienthost.pp b/modules/postgres/manifests/backup_server/register_backup_clienthost.pp
index 00ef582..fc4cc0c 100644 (file)
--- a/modules/postgres/manifests/backup_server/register_backup_clienthost.pp
+++ b/modules/postgres/manifests/backup_server/register_backup_clienthost.pp
@@ -1,19 +1,26 @@
+# register this host at the backup servers
 #
-define postgres::backup_server::register_backup_clienthost (
-       $sshpubkey = $::postgresql_key,
-       $ipaddrlist = join(getfromhash($site::nodeinfo, 'ldap', 'ipHostNumber'), ","),
-       $hostname = $::hostname,
+# This class set up the ssh authorization on the backup servers
+# so this client can push WAL segments.  Furthermore, the
+# client will be allowed to read other hosts backups -- specify
+# the list of allowed target hosts via params.
+#
+# @param allow_read_basedir  directory under which files can be read
+# @param allow_read_hosts    subdirectories under base to allow
+class postgres::backup_server::register_backup_clienthost (
+  String $allow_read_basedir = '/srv/backups/pg',
+  Array[Stdlib::Fqdn] $allow_read_hosts = [],
 ) {
-       include postgres::backup_server::globals
+  include postgres::backup_server::globals
+
+  $allowstr = $allow_read_hosts.map |$host| { "--read-allow=${allow_read_basedir}/${host}" }.join(' ')
+  $ssh_command = "/usr/local/bin/debbackup-ssh-wrap ${allowstr} ${::hostname}"
 
-       if $sshpubkey {
-               $addr = assert_type(String[1], $ipaddrlist)
-               @@concat::fragment { "postgresql::server::backup-source-clienthost::$name::$fqdn":
-                       target => $postgres::backup_server::globals::sshkeys_sources ,
-                       content  => @("EOF"),
-                                       ${hostname} ${addr} ${sshpubkey}
-                                       | EOF
-                       tag     => $postgres::backup_server::globals::tag_source_sshkey,
-               }
-       }
+  ssh::authorized_key_add { 'register_backup_clienthost':
+    target_user => $postgres::backup_server::globals::backup_unix_user,
+    key         => dig($facts, 'ssh_keys_users', 'postgres', 'id_rsa.pub', 'line'),
+    command     => $ssh_command,
+    from        => $base::public_addresses,
+    collect_tag => $postgres::backup_server::globals::tag_source_sshkey,
+  }
 }