Move backup replication hba_entry to backup_cluster

diff --git a/modules/postgres/manifests/backup_cluster.pp b/modules/postgres/manifests/backup_cluster.pp
index bd6ef09..7741d94 100644 (file)
--- a/modules/postgres/manifests/backup_cluster.pp
+++ b/modules/postgres/manifests/backup_cluster.pp
@@ -1,12 +1,26 @@
 # Backup this cluster
 #
+# This define causes the cluster to be registered on the backupservers.
+#
+# Furthermore, if this cluster is managed with postgresql::server and
+# do_role and do_hba are set, we create the role and modify the pg_hba.conf file.
+#
+# Since postgresql::server only supports a single cluster per host, we are moving
+# towards our own postgres::cluster, and this define also exports a hba rule for
+# those (regardless of the do_hba setting).  If the cluster is managed with
+# postgres::cluster and has its manage_hba option set, this will then cause the
+# backup hosts to be allowed to replacate.
+#
+# Regarless of how the cluster is managed, firewall rules are set up to allow
+# access from the backup hosts.
+#
 # @param pg_version      pg version of the cluster
 # @param pg_cluster      cluster name
 # @param pg_port         port of the postgres cluster
 # @param db_backup_role  replication role username
 # @param db_backup_role_password     password of the replication role
 # @param do_role         create the role (requires setup with postgresql::server)
-# @param do_hba          update pg_hba (requires setup with postgresql::server)
+# @param do_hba          update pg_hba   (requires setup with postgresql::server)
 define postgres::backup_cluster(
   String $pg_version,
   String $pg_cluster = 'main',
@@ -50,12 +64,23 @@ define postgres::backup_cluster(
   #
   # Any non-matching traffic will fall through and it can
   # be allowed elsewhere
+  #
+  # this rule is only needed for clusters that we do not manage
+  # with postgres::cluster.  Hopefully these will go away with time
   ferm::rule::simple { "dsa-postgres-backup-${pg_port}":
     description => 'Check for postgres access from backup host',
     port        => $pg_port,
     target      => 'pg-backup',
   }
 
+  postgres::cluster::hba_entry { 'backup-replication':
+    pg_version => $pg_version,
+    pg_cluster => $pg_cluster,
+    pg_port    => $pg_port,
+    database   => 'replication',
+    user       => db_backup_role,
+    address    => $backup_servers_addrs,
+  }
   postgres::backup_server::register_backup_cluster { "backup-role-${::fqdn}}-${pg_port}":
     pg_port     => $pg_port,
     pg_role     => $db_backup_role,

diff --git a/modules/postgres/manifests/backup_server.pp b/modules/postgres/manifests/backup_server.pp
index 34a68b6..84f4c0d 100644 (file)
--- a/modules/postgres/manifests/backup_server.pp
+++ b/modules/postgres/manifests/backup_server.pp
@@ -103,6 +103,9 @@ class postgres::backup_server {
   # Let us connect to the clusters we want
   #
   # We export this, and the backup clients collect it
+  #
+  # this rule is only needed for clusters that we do not manage
+  # with postgres::cluster.  Hopefully these will go away with time
   @@ferm::rule::simple { "pg-backup_server::${::fqdn}":
     tag         => 'postgres::backup_server::to-client',
     description => 'Allow access access from backup host',

diff --git a/modules/postgres/manifests/backup_server/register_backup_clienthost.pp b/modules/postgres/manifests/backup_server/register_backup_clienthost.pp
index 8c288dd..ff0f8f1 100644 (file)
--- a/modules/postgres/manifests/backup_server/register_backup_clienthost.pp
+++ b/modules/postgres/manifests/backup_server/register_backup_clienthost.pp
@@ -24,5 +24,7 @@ define postgres::backup_server::register_backup_clienthost (
     collect_tag => $postgres::backup_server::globals::tag_source_sshkey,
   }
 
+  # this rule is only needed for clusters that we do not manage
+  # with postgres::cluster.  Hopefully these will go away with time
   Ferm::Rule::Simple <<| tag == 'postgres::backup_server::to-client' |>>
 }

diff --git a/modules/postgres/manifests/cluster.pp b/modules/postgres/manifests/cluster.pp
index a57f543..47021ae 100644 (file)
--- a/modules/postgres/manifests/cluster.pp
+++ b/modules/postgres/manifests/cluster.pp
@@ -24,6 +24,9 @@ define postgres::cluster(
     target      => "pg-${pg_port}",
   }
 
+  # hba entries and firewall rules
+  Postgres::Cluster::Hba_entry <<| tag == "postgres::cluster::${pg_version}::${pg_cluster}::hba::${::fqdn}" |>>
+
   if $manage_hba {
     concat { "postgres::cluster::${pg_version}::${pg_cluster}::hba":
       path           => "${confdir}/pg_hba.conf",

diff --git a/modules/roles/manifests/postgresql/cluster_bacula.pp b/modules/roles/manifests/postgresql/cluster_bacula.pp
index af277cc..1a85355 100644 (file)
--- a/modules/roles/manifests/postgresql/cluster_bacula.pp
+++ b/modules/roles/manifests/postgresql/cluster_bacula.pp
@@ -28,13 +28,4 @@ class roles::postgresql::cluster_bacula {
     user       => 'bacula-storace-reader',
     address    => ['93.94.130.161', '2a02:158:380:280::161'],
   }
-
-  postgres::cluster::hba_entry { 'replication':
-    pg_version => $pg_version,
-    pg_cluster => $pg_cluster,
-    pg_port    => $pg_port,
-    database   => 'replication',
-    user       => 'debian-backup',
-    address    => ['5.153.231.12', '2001:41c8:1000:21::21:12', '93.94.130.161', '2a02:158:380:280::161'],
-  }
 }