From 01c8ae18739a123996081388ca68fe34459b218f Mon Sep 17 00:00:00 2001 From: Peter Palfrader Date: Sun, 29 Sep 2019 16:36:38 +0200 Subject: [PATCH] manage debsources access to its DB on bmdb1 --- data/common.yaml | 3 +++ data/nodes/bmdb1.debian.org.yaml | 1 + modules/ferm/manifests/per_host.pp | 9 --------- modules/roles/manifests/debsources.pp | 26 +++++++++++++++++++++++++- 4 files changed, 29 insertions(+), 10 deletions(-) diff --git a/data/common.yaml b/data/common.yaml index 3d4546b14..b9e458947 100644 --- a/data/common.yaml +++ b/data/common.yaml @@ -48,6 +48,9 @@ bacula::director::pool_name: 'debian' bacula::client::director_server: dinis.debian.org bacula::client::storage_server: storace.debian.org +roles::debsources::db_address: bmdb1.debian.org +roles::debsources::db_port: 5440 + # == other variables ##################### diff --git a/data/nodes/bmdb1.debian.org.yaml b/data/nodes/bmdb1.debian.org.yaml index b50c65318..32e5d8c68 100644 --- a/data/nodes/bmdb1.debian.org.yaml +++ b/data/nodes/bmdb1.debian.org.yaml @@ -3,3 +3,4 @@ classes: - roles::postgresql::server postgres::backup_server::register_backup_clienthost::allow_read_hosts: ['fasolo'] +roles::postgresql::server::manage_clusters_hba: [5440] diff --git a/modules/ferm/manifests/per_host.pp b/modules/ferm/manifests/per_host.pp index 851fa8f52..28e3c3079 100644 --- a/modules/ferm/manifests/per_host.pp +++ b/modules/ferm/manifests/per_host.pp @@ -143,15 +143,6 @@ class ferm::per_host { )) | EOF } - ferm::rule { 'dsa-postgres-debsources': - description => 'Allow postgress access to cluster: debsources', - domain => '(ip ip6)', - rule => @("EOF"/$) - &SERVICE_RANGE(tcp, 5440, ( - ${ join(getfromhash($deprecated::allnodeinfo, 'sor.debian.org', 'ipHostNumber'), " ") } - )) - | EOF - } } danzi: { ferm::rule { 'dsa-postgres-tracker': diff --git a/modules/roles/manifests/debsources.pp b/modules/roles/manifests/debsources.pp index f3af3cadc..60cb490a5 100644 --- a/modules/roles/manifests/debsources.pp +++ b/modules/roles/manifests/debsources.pp @@ -1,4 +1,11 @@ -class roles::debsources { +# sources.debian.org role + +# @param db_address hostname of the postgres server for this service +# @param db_port port of the postgres server for this service +class roles::debsources ( + String $db_address, + Integer $db_port, +) { include apache2 include apache2::ssl @@ -14,4 +21,21 @@ class roles::debsources { notify => Exec['service apache2 reload'], key => true, } + + @@postgres::cluster::hba_entry { 'debsources': + tag => "postgres::cluster::${db_port}::hba::${db_address}", + pg_port => $db_port, + database => 'debsources', + user => ['debsource_admin', 'debsource_updater'], + address => $base::public_addresses, + } + + @@postgres::cluster::hba_entry { 'debsources-guest': + tag => "postgres::cluster::${db_port}::hba::${db_address}", + pg_port => $db_port, + database => 'debsources', + user => ['guest'], + method => 'trust', + address => $base::public_addresses, + } } -- 2.20.1