From 4b3905325654c4c15acf07925dc8a9a19b488a6e Mon Sep 17 00:00:00 2001
From: Peter Palfrader <peter@palfrader.org>
Date: Fri, 1 Sep 2017 13:09:28 +0000
Subject: [PATCH] next step in getting salsa pg backed up

---
 modules/salsa/manifests/database.pp | 44 +++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)

diff --git a/modules/salsa/manifests/database.pp b/modules/salsa/manifests/database.pp
index e2793c1e2..080653199 100644
--- a/modules/salsa/manifests/database.pp
+++ b/modules/salsa/manifests/database.pp
@@ -18,7 +18,29 @@ class salsa::database inherits salsa {
 		require => Class['postgresql::server::contrib'],
 	}
 
+
+
 	include postgres::backup_source
+
+	$pg_config_options = {
+		'track_counts'  => 'yes',
+		'archive_mode' => 'yes',
+		'wal_level' => 'archive',
+		'max_wal_senders' => '3',
+		'archive_timeout' => '1h',
+		'archive_command' => '/usr/local/bin/pg-backup-file main WAL %p',
+		'ssl' => 'on',
+		'ssl_cert_file' => '/etc/ssl/debian/certs/thishost-server.crt',
+		'ssl_key_file' => '/etc/ssl/private/thishost-server.key',
+	}
+	$pg_config_options.each |String $key, String $value| {
+		postgresql_conf { $key:
+			value => $value,
+			target => $postgresql::params::postgresql_conf_path,
+			notify => Service['postgresqld'],
+		}
+	}
+
 	$datadir = assert_type(String[1], $postgresql::params::datadir)
 	warning("foo ")
 	file { "${datadir}/.nobackup":
@@ -36,9 +58,31 @@ class salsa::database inherits salsa {
 		}
 	}
 
+	$db_backup_role = 'debian-backup'
+	$db_backup_role_password = hkdf('/etc/puppet/secret', "postgresql-${::hostname}-${postgresql::params::port}-backup_role}")
+
+	# XXX - get these from the roles and ldap
+	$db_backup_hosts = ['5.153.231.12/32', '93.94.130.161/32', '2001:41c8:1000:21::21:12/128', '2a02:158:380:280::161/128']
+
+	postgresql::server::role { $db_backup_role:
+		password_hash => postgresql_password($db_backup_role, $db_backup_role_password),
+		replication => true,
+	}
+	$db_backup_hosts.each |String $address| {
+		postgresql::server::pg_hba_rule { "debian_backup-${address}":
+			description => 'Open up PostgreSQL for backups',
+			type        => 'hostssl',
+			database    => 'replication',
+			user        => $db_backup_role,
+			address     => $address,
+			auth_method => 'md5',
+		}
+	}
 	@ferm::rule { "dsa-postgres-${postgresql::params::port}":
 		description => 'Allow postgress access from backup host',
 		domain      => '(ip ip6)',
 		rule        => "&SERVICE_RANGE(tcp, ${postgresql::params::port}, ( @ipfilter(\$HOST_PGBACKUPHOST) ))",
 	}
+
+	# add cluster to make-base-backups
 }
-- 
2.20.1