From fa67a3c70b0ad6f46691ee1495dfa7f249143d52 Mon Sep 17 00:00:00 2001 From: Peter Palfrader Date: Sat, 28 Sep 2019 20:58:10 +0200 Subject: [PATCH] Replace debbackup with parameterized username in most places --- data/common.yaml | 1 + modules/postgres/manifests/backup_server.pp | 13 ++++--------- modules/postgres/manifests/backup_server/globals.pp | 6 +++++- .../backup_server/postgres-make-base-backups.erb | 2 +- .../postgres/templates/backup_server/sudoers.erb | 2 +- modules/roles/TODO | 3 +++ 6 files changed, 15 insertions(+), 12 deletions(-) diff --git a/data/common.yaml b/data/common.yaml index 4abd2a244..9fc2b8997 100644 --- a/data/common.yaml +++ b/data/common.yaml @@ -31,6 +31,7 @@ roles::dns_primary::allow_access: - '2a01:3f0:0:27::24' - '2a01:3f0:0:28::25' postgres::backup_cluster::db_backup_role: 'debian-backup' +postgres::backup_server::global::backup_unix_user: 'debbackup' # bacula # bacula::email_all: 'bacula-reports@admin.debian.org' diff --git a/modules/postgres/manifests/backup_server.pp b/modules/postgres/manifests/backup_server.pp index a4c6689db..4d78c99aa 100644 --- a/modules/postgres/manifests/backup_server.pp +++ b/modules/postgres/manifests/backup_server.pp @@ -29,13 +29,13 @@ class postgres::backup_server { } file { '/var/lib/dsa/postgres-make-base-backups': ensure => directory, - owner => 'debbackup', + owner => $postgres::backup_server::globals::backup_unix_user, mode => '0755', } concat::fragment { 'puppet-crontab--postgres-make_base_backups': target => '/etc/cron.d/puppet-crontab', content => @("EOF") - */30 * * * * debbackup sleep $(( RANDOM \% 1200 )); chronic ${make_base_backups} + */30 * * * * ${postgres::backup_server::globals::backup_unix_user} sleep $(( RANDOM \% 1200 )); chronic ${make_base_backups} | EOF } @@ -109,14 +109,9 @@ class postgres::backup_server { # Maintain .pgpass file on backup servers # # concat { $postgres::backup_server::globals::pgpassfile: - owner => 'debbackup', - group => 'debbackup', + owner => $postgres::backup_server::globals::backup_unix_user, + group => $postgres::backup_server::globals::backup_unix_group, mode => '0400' } - concat::fragment{ 'pgpass-local': - target => $postgres::backup_server::globals::pgpassfile, - source => '/home/debbackup/.pgpass-local', - order => '00' - } Concat::Fragment <<| tag == $postgres::backup_server::globals::tag_source_pgpassline |>> } diff --git a/modules/postgres/manifests/backup_server/globals.pp b/modules/postgres/manifests/backup_server/globals.pp index bdac82221..327ed6eca 100644 --- a/modules/postgres/manifests/backup_server/globals.pp +++ b/modules/postgres/manifests/backup_server/globals.pp @@ -1,9 +1,13 @@ # Global definitions for the postgres::backup_server setup # +# @param backup_unix_user unix user on the backup host +# @param backup_unix_group group of unix user on the backup host # @param pgpassfile pg password file for pg_basebackup runs # @param base_backup_clusters where to store the list of clusters to make base backups of class postgres::backup_server::globals( - String $pgpassfile = '/home/debbackup/.pgpass', + String $backup_unix_user, + String $backup_unix_group = $backup_unix_user, + String $pgpassfile = "/home/${backup_unix_user}/.pgpass", String $sshkeys_sources = '/etc/dsa/postgresql-backup/sshkeys-sources', String $base_backup_clusters = '/etc/dsa/postgresql-backup/base-backup-clusters', ) { diff --git a/modules/postgres/templates/backup_server/postgres-make-base-backups.erb b/modules/postgres/templates/backup_server/postgres-make-base-backups.erb index fc564110d..2141833a2 100755 --- a/modules/postgres/templates/backup_server/postgres-make-base-backups.erb +++ b/modules/postgres/templates/backup_server/postgres-make-base-backups.erb @@ -42,7 +42,7 @@ STATEDIR=/var/lib/dsa/postgres-make-base-backups set -u if [ "$(id -u)" = 0 ]; then - echo >&2 "Do not run me as root. Probably you want sudo -u debbackup." + echo >&2 "Do not run me as root. Probably you want sudo -u <%= @backup_unix_user %>." exit 1 fi diff --git a/modules/postgres/templates/backup_server/sudoers.erb b/modules/postgres/templates/backup_server/sudoers.erb index de633ca49..3b31cbfe6 100644 --- a/modules/postgres/templates/backup_server/sudoers.erb +++ b/modules/postgres/templates/backup_server/sudoers.erb @@ -1,3 +1,3 @@ # edit with visudo! -nagios ALL=(debbackup) NOPASSWD: /usr/lib/nagios/plugins/dsa-check-backuppg "" +nagios ALL=(<%= @backup_unix_user %>) NOPASSWD: /usr/lib/nagios/plugins/dsa-check-backuppg "" diff --git a/modules/roles/TODO b/modules/roles/TODO index 282bf2914..fd128d836 100644 --- a/modules/roles/TODO +++ b/modules/roles/TODO @@ -7,3 +7,6 @@ using exim::vdomain - move the postgres::backup_server stuff out of the salsa/database manifest + +- postgres/templates/backup_source/pg-backup-file.conf.erb: + get username from params, hosts from rolehosts -- 2.20.1