From 06d5a4b60525258ffd7f4ad8d350a0785a249bf5 Mon Sep 17 00:00:00 2001 From: Peter Palfrader Date: Sun, 29 Sep 2019 12:39:59 +0200 Subject: [PATCH] Move backup replication hba_entry to backup_cluster --- modules/postgres/manifests/backup_cluster.pp | 27 ++++++++++++++++++- modules/postgres/manifests/backup_server.pp | 3 +++ .../register_backup_clienthost.pp | 2 ++ modules/postgres/manifests/cluster.pp | 3 +++ .../manifests/postgresql/cluster_bacula.pp | 9 ------- 5 files changed, 34 insertions(+), 10 deletions(-) diff --git a/modules/postgres/manifests/backup_cluster.pp b/modules/postgres/manifests/backup_cluster.pp index bd6ef0916..7741d9408 100644 --- a/modules/postgres/manifests/backup_cluster.pp +++ b/modules/postgres/manifests/backup_cluster.pp @@ -1,12 +1,26 @@ # Backup this cluster # +# This define causes the cluster to be registered on the backupservers. +# +# Furthermore, if this cluster is managed with postgresql::server and +# do_role and do_hba are set, we create the role and modify the pg_hba.conf file. +# +# Since postgresql::server only supports a single cluster per host, we are moving +# towards our own postgres::cluster, and this define also exports a hba rule for +# those (regardless of the do_hba setting). If the cluster is managed with +# postgres::cluster and has its manage_hba option set, this will then cause the +# backup hosts to be allowed to replacate. +# +# Regarless of how the cluster is managed, firewall rules are set up to allow +# access from the backup hosts. +# # @param pg_version pg version of the cluster # @param pg_cluster cluster name # @param pg_port port of the postgres cluster # @param db_backup_role replication role username # @param db_backup_role_password password of the replication role # @param do_role create the role (requires setup with postgresql::server) -# @param do_hba update pg_hba (requires setup with postgresql::server) +# @param do_hba update pg_hba (requires setup with postgresql::server) define postgres::backup_cluster( String $pg_version, String $pg_cluster = 'main', @@ -50,12 +64,23 @@ define postgres::backup_cluster( # # Any non-matching traffic will fall through and it can # be allowed elsewhere + # + # this rule is only needed for clusters that we do not manage + # with postgres::cluster. Hopefully these will go away with time ferm::rule::simple { "dsa-postgres-backup-${pg_port}": description => 'Check for postgres access from backup host', port => $pg_port, target => 'pg-backup', } + postgres::cluster::hba_entry { 'backup-replication': + pg_version => $pg_version, + pg_cluster => $pg_cluster, + pg_port => $pg_port, + database => 'replication', + user => db_backup_role, + address => $backup_servers_addrs, + } postgres::backup_server::register_backup_cluster { "backup-role-${::fqdn}}-${pg_port}": pg_port => $pg_port, pg_role => $db_backup_role, diff --git a/modules/postgres/manifests/backup_server.pp b/modules/postgres/manifests/backup_server.pp index 34a68b6c9..84f4c0dd1 100644 --- a/modules/postgres/manifests/backup_server.pp +++ b/modules/postgres/manifests/backup_server.pp @@ -103,6 +103,9 @@ class postgres::backup_server { # Let us connect to the clusters we want # # We export this, and the backup clients collect it + # + # this rule is only needed for clusters that we do not manage + # with postgres::cluster. Hopefully these will go away with time @@ferm::rule::simple { "pg-backup_server::${::fqdn}": tag => 'postgres::backup_server::to-client', description => 'Allow access access from backup host', diff --git a/modules/postgres/manifests/backup_server/register_backup_clienthost.pp b/modules/postgres/manifests/backup_server/register_backup_clienthost.pp index 8c288dd47..ff0f8f1b1 100644 --- a/modules/postgres/manifests/backup_server/register_backup_clienthost.pp +++ b/modules/postgres/manifests/backup_server/register_backup_clienthost.pp @@ -24,5 +24,7 @@ define postgres::backup_server::register_backup_clienthost ( collect_tag => $postgres::backup_server::globals::tag_source_sshkey, } + # this rule is only needed for clusters that we do not manage + # with postgres::cluster. Hopefully these will go away with time Ferm::Rule::Simple <<| tag == 'postgres::backup_server::to-client' |>> } diff --git a/modules/postgres/manifests/cluster.pp b/modules/postgres/manifests/cluster.pp index a57f5433f..47021aefc 100644 --- a/modules/postgres/manifests/cluster.pp +++ b/modules/postgres/manifests/cluster.pp @@ -24,6 +24,9 @@ define postgres::cluster( target => "pg-${pg_port}", } + # hba entries and firewall rules + Postgres::Cluster::Hba_entry <<| tag == "postgres::cluster::${pg_version}::${pg_cluster}::hba::${::fqdn}" |>> + if $manage_hba { concat { "postgres::cluster::${pg_version}::${pg_cluster}::hba": path => "${confdir}/pg_hba.conf", diff --git a/modules/roles/manifests/postgresql/cluster_bacula.pp b/modules/roles/manifests/postgresql/cluster_bacula.pp index af277cc91..1a853556a 100644 --- a/modules/roles/manifests/postgresql/cluster_bacula.pp +++ b/modules/roles/manifests/postgresql/cluster_bacula.pp @@ -28,13 +28,4 @@ class roles::postgresql::cluster_bacula { user => 'bacula-storace-reader', address => ['93.94.130.161', '2a02:158:380:280::161'], } - - postgres::cluster::hba_entry { 'replication': - pg_version => $pg_version, - pg_cluster => $pg_cluster, - pg_port => $pg_port, - database => 'replication', - user => 'debian-backup', - address => ['5.153.231.12', '2001:41c8:1000:21::21:12', '93.94.130.161', '2a02:158:380:280::161'], - } } -- 2.20.1