move localhost guest access in front of catch-all localhost access

[mirror/dsa-puppet.git] / modules / postgres / manifests / cluster / hba_entry.pp

diff --git a/modules/postgres/manifests/cluster/hba_entry.pp b/modules/postgres/manifests/cluster/hba_entry.pp
index 6831374..843a4a7 100644 (file)
--- a/modules/postgres/manifests/cluster/hba_entry.pp
+++ b/modules/postgres/manifests/cluster/hba_entry.pp
@@ -15,6 +15,7 @@
 # @param address          hosts that match
 # @param method           auth method
 # @param order            ordering of this entry in pg_hba.conf
+# @param firewall         also add a firewall rule
 define postgres::cluster::hba_entry (
   Optional[Integer] $pg_port = undef,
   Optional[String] $pg_cluster = undef,
@@ -25,6 +26,7 @@ define postgres::cluster::hba_entry (
   Optional[Variant[Stdlib::IP::Address, Array[Stdlib::IP::Address]]] $address = undef,
   Enum['md5', 'trust'] $method = 'md5',
   String $order = '50',
+  Boolean $firewall = true,
 ) {
   $address_methods = ['md5', 'trust']
   if $method in $address_methods {
@@ -66,7 +68,7 @@ define postgres::cluster::hba_entry (
   }
   ###
 
-  if ($address) {
+  if ($address and $firewall) {
     ferm::rule::simple { "postgres::cluster::hba_entry::${name}":
       description => "allow access to pg${real_version}/${real_cluster}: ${name}",
       saddr       => $address,