From: Peter Palfrader <peter@palfrader.org>
Date: Sun, 29 Sep 2019 13:17:17 +0000 (+0200)
Subject: providing either a port or a version/clustername pair to hba_entry should suffice
X-Git-Url: https://git.adam-barratt.org.uk/?p=mirror%2Fdsa-puppet.git;a=commitdiff_plain;h=b11fd7d33b063d3710773b485563f66860fb081f

providing either a port or a version/clustername pair to hba_entry should suffice
---

diff --git a/modules/postgres/manifests/cluster/hba_entry.pp b/modules/postgres/manifests/cluster/hba_entry.pp
index a7a2f1560..2b6ff6258 100644
--- a/modules/postgres/manifests/cluster/hba_entry.pp
+++ b/modules/postgres/manifests/cluster/hba_entry.pp
@@ -16,9 +16,9 @@
 # @param method           auth method
 # @param order            ordering of this entry in pg_hba.conf
 define postgres::cluster::hba_entry (
-  Integer $pg_port,
-  String $pg_cluster,
-  String $pg_version,
+  Optional[Integer] $pg_port = undef,
+  Optional[String] $pg_cluster = undef,
+  Optional[String] $pg_version = undef,
   Enum['local', 'hostssl'] $connection_type = 'hostssl',
   Variant[String,Array[String]] $database = 'sameuser',
   Variant[String,Array[String]] $user = 'all',
@@ -37,11 +37,35 @@ define postgres::cluster::hba_entry (
     }
   }
 
+  $clusters = $facts['postgresql_clusters']
+  if $pg_port {
+    $filtered = $clusters.filter |$cluster| { $cluster['port'] == $pg_port }
+    if $filtered.length != 1 {
+      fail("Did not find exactly one cluster with port ${pg_port}")
+    }
+  } elsif $pg_cluster and $pg_version {
+    $filtered = $clusters.filter |$cluster| { $cluster['version'] == $pg_version and $cluster['cluster'] == $pg_cluster}
+    if $filtered.length != 1 {
+      fail("Did not find exactly one cluster ${pg_version}/${pg_cluster}")
+    }
+  } else {
+    fail('postgres::cluster::hba_entry needs either the port of both a pg version and cluster name')
+  }
+  $real_port    = $filtered['port']
+  $real_version = $filtered['version']
+  $real_cluster = $filtered['cluster']
+  if $pg_version and $pg_version != $real_version {
+    fail("Inconsisten cluster version information: ${pg_version} != ${real_version}")
+  }
+  if $pg_cluster and $pg_cluster != $real_cluster {
+    fail("Inconsisten cluster name information: ${pg_cluster} != ${real_cluster}")
+  }
+
   if ($address) {
     ferm::rule::simple { "postgres::cluster::hba_entry::${name}":
-      description => "allow access to pg${pg_version}/${pg_cluster}: ${name}",
+      description => "allow access to pg${real_version}/${real_cluster}: ${name}",
       saddr       => $address,
-      chain       => "pg-${pg_port}",
+      chain       => "pg-${real_port}",
     }
   }
 
@@ -59,8 +83,8 @@ define postgres::cluster::hba_entry (
   }
 
   @concat::fragment { "postgres::cluster::pg_hba::${name}":
-    tag     => "postgres::cluster::${pg_version}::${pg_cluster}::hba",
-    target  => "postgres::cluster::${pg_version}::${pg_cluster}::hba",
+    tag     => "postgres::cluster::${real_version}::${real_cluster}::hba",
+    target  => "postgres::cluster::${real_version}::${real_cluster}::hba",
     order   => $order,
     content => inline_template( @(EOF) ),
                   #