Configure postgres recipes for VMs and zerotier access
* Remove encfs (using encrypted volumes instead) * Allow access without TLS from zerotier network
This commit is contained in:
@@ -1,90 +0,0 @@
|
||||
#
|
||||
# Cookbook:: kosmos-postgresql
|
||||
# Recipe:: default
|
||||
#
|
||||
# The MIT License (MIT)
|
||||
#
|
||||
# Copyright:: 2019, Kosmos Developers
|
||||
#
|
||||
# Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
# of this software and associated documentation files (the "Software"), to deal
|
||||
# in the Software without restriction, including without limitation the rights
|
||||
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
# copies of the Software, and to permit persons to whom the Software is
|
||||
# furnished to do so, subject to the following conditions:
|
||||
#
|
||||
# The above copyright notice and this permission notice shall be included in
|
||||
# all copies or substantial portions of the Software.
|
||||
#
|
||||
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
||||
# THE SOFTWARE.
|
||||
|
||||
postgresql_version = "12"
|
||||
postgresql_service = "postgresql@#{postgresql_version}-main"
|
||||
|
||||
service postgresql_service do
|
||||
supports restart: true, status: true, reload: true
|
||||
end
|
||||
|
||||
postgresql_custom_server postgresql_version do
|
||||
role "primary"
|
||||
end
|
||||
|
||||
# This will only be run once, if the /var/lib/postgresql/10/main directory
|
||||
# exists. The old data directory is then moved.
|
||||
execute "upgrade postgresql to 12" do
|
||||
command <<-EOF
|
||||
systemctl stop postgresql@12-main
|
||||
systemctl stop postgresql@10-main
|
||||
su - postgres -c "/usr/lib/postgresql/12/bin/pg_upgrade --old-bindir=/usr/lib/postgresql/10/bin/ --new-bindir=/usr/lib/postgresql/12/bin/ --old-datadir=/etc/postgresql/10/main/ --new-datadir=/etc/postgresql/12/main/"
|
||||
mv /var/lib/postgresql/10/main /var/lib/postgresql/10/main.old
|
||||
systemctl start postgresql@12-main
|
||||
EOF
|
||||
only_if { ::File.exist? "/var/lib/postgresql/10/main" }
|
||||
end
|
||||
|
||||
# Services that connect to PostgreSQL need to have the postgresql_client role
|
||||
# as part of their run list. See the gitea and ejabberd roles.
|
||||
postgresql_clients = search(:node, "roles:postgresql_client AND chef_environment:#{node.chef_environment}") || []
|
||||
|
||||
postgresql_clients.each do |client|
|
||||
ip = ip_for(client)
|
||||
hostname = client[:hostname]
|
||||
|
||||
postgresql_access "#{hostname} all" do
|
||||
access_type "host"
|
||||
access_db "all"
|
||||
access_user "all"
|
||||
access_addr "#{ip}/32"
|
||||
access_method "md5"
|
||||
notifies :reload, "service[#{postgresql_service}]", :immediately
|
||||
end
|
||||
|
||||
firewall_rule "postgresql #{hostname}" do
|
||||
port 5432
|
||||
protocol :tcp
|
||||
command :allow
|
||||
source ip
|
||||
end
|
||||
end
|
||||
|
||||
postgresql_replicas.each do |replica|
|
||||
postgresql_access "#{replica[:hostname]} replication" do
|
||||
access_type "host"
|
||||
access_db "replication"
|
||||
access_user "replication"
|
||||
access_addr "#{replica[:ipaddress]}/32"
|
||||
access_method "md5"
|
||||
notifies :reload, "service[#{postgresql_service}]", :immediately
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
unless node.chef_environment == "development"
|
||||
include_recipe "kosmos-postgresql::firewall_replicas"
|
||||
end
|
||||
15
site-cookbooks/kosmos-postgresql/recipes/firewall.rb
Normal file
15
site-cookbooks/kosmos-postgresql/recipes/firewall.rb
Normal file
@@ -0,0 +1,15 @@
|
||||
#
|
||||
# Cookbook:: kosmos-postgresql
|
||||
# Recipe:: firewall
|
||||
#
|
||||
|
||||
unless node.chef_environment == "development"
|
||||
include_recipe "kosmos-base::firewall"
|
||||
|
||||
firewall_rule "postgresql zerotier members" do
|
||||
port 5432
|
||||
protocol :tcp
|
||||
command :allow
|
||||
source "10.1.1.0/24"
|
||||
end
|
||||
end
|
||||
@@ -1,36 +0,0 @@
|
||||
#
|
||||
# Cookbook:: kosmos-postgresql
|
||||
# Recipe:: firewall_replicas
|
||||
#
|
||||
# The MIT License (MIT)
|
||||
#
|
||||
# Copyright:: 2020, Kosmos Developers
|
||||
#
|
||||
# Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
# of this software and associated documentation files (the "Software"), to deal
|
||||
# in the Software without restriction, including without limitation the rights
|
||||
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
# copies of the Software, and to permit persons to whom the Software is
|
||||
# furnished to do so, subject to the following conditions:
|
||||
#
|
||||
# The above copyright notice and this permission notice shall be included in
|
||||
# all copies or substantial portions of the Software.
|
||||
#
|
||||
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
||||
# THE SOFTWARE.
|
||||
|
||||
include_recipe "kosmos-base::firewall"
|
||||
|
||||
postgresql_replicas.each do |replica|
|
||||
firewall_rule "postgresql replica #{replica[:hostname]}" do
|
||||
port 5432
|
||||
protocol :tcp
|
||||
command :allow
|
||||
source replica[:ipaddress]
|
||||
end
|
||||
end
|
||||
33
site-cookbooks/kosmos-postgresql/recipes/primary.rb
Normal file
33
site-cookbooks/kosmos-postgresql/recipes/primary.rb
Normal file
@@ -0,0 +1,33 @@
|
||||
#
|
||||
# Cookbook:: kosmos-postgresql
|
||||
# Recipe:: primary
|
||||
#
|
||||
|
||||
postgresql_version = "12"
|
||||
postgresql_service = "postgresql@#{postgresql_version}-main"
|
||||
|
||||
service postgresql_service do
|
||||
supports restart: true, status: true, reload: true
|
||||
end
|
||||
|
||||
postgresql_custom_server postgresql_version do
|
||||
role "primary"
|
||||
end
|
||||
|
||||
postgresql_access "zerotier members" do
|
||||
access_type "host"
|
||||
access_db "all"
|
||||
access_user "all"
|
||||
access_addr "10.1.1.0/24"
|
||||
access_method "md5"
|
||||
notifies :reload, "service[#{postgresql_service}]", :immediately
|
||||
end
|
||||
|
||||
postgresql_access "zerotier members replication" do
|
||||
access_type "host"
|
||||
access_db "replication"
|
||||
access_user "replication"
|
||||
access_addr "10.1.1.0/24"
|
||||
access_method "md5"
|
||||
notifies :reload, "service[#{postgresql_service}]", :immediately
|
||||
end
|
||||
@@ -19,43 +19,38 @@ postgresql_data_bag_item = data_bag_item('credentials', 'postgresql')
|
||||
primary = postgresql_primary
|
||||
|
||||
unless primary.nil?
|
||||
postgresql_data_dir = "#{node["kosmos_encfs"]["data_directory"]}/postgresql/#{postgresql_version}/main"
|
||||
# TODO
|
||||
postgresql_data_dir = "/var/lib/postgresql/#{postgresql_version}/main"
|
||||
|
||||
if node['kosmos-postgresql']['ready_to_set_up_replica']
|
||||
execute "set up replication" do
|
||||
command <<-EOF
|
||||
# FIXME get zerotier IP
|
||||
execute "set up replication" do
|
||||
command <<-EOF
|
||||
systemctl stop #{postgresql_service}
|
||||
mv #{postgresql_data_dir} #{postgresql_data_dir}.old
|
||||
pg_basebackup -h #{primary[:ipaddress]} -U replication -D #{postgresql_data_dir} -R
|
||||
pg_basebackup -h 10.1.1.167 -U replication -D #{postgresql_data_dir} -R
|
||||
chown -R postgres:postgres #{postgresql_data_dir}
|
||||
systemctl start #{postgresql_service}
|
||||
EOF
|
||||
environment 'PGPASSWORD' => postgresql_data_bag_item['replication_password']
|
||||
sensitive true
|
||||
not_if { ::File.exist? "#{postgresql_data_dir}/standby.signal" }
|
||||
end
|
||||
EOF
|
||||
environment 'PGPASSWORD' => postgresql_data_bag_item['replication_password']
|
||||
sensitive true
|
||||
not_if { ::File.exist? "#{postgresql_data_dir}/standby.signal" }
|
||||
end
|
||||
|
||||
postgresql_access "replication" do
|
||||
postgresql_access "zerotier members" do
|
||||
access_type "host"
|
||||
access_db "replication"
|
||||
access_user "replication"
|
||||
access_addr "#{primary[:ipaddress]}/32"
|
||||
access_db "all"
|
||||
access_user "all"
|
||||
access_addr "10.1.1.0/24"
|
||||
access_method "md5"
|
||||
notifies :reload, "service[#{postgresql_service}]", :immediately
|
||||
end
|
||||
|
||||
# On the next Chef run the replica will be set up
|
||||
node.normal['kosmos-postgresql']['ready_to_set_up_replica'] = true
|
||||
|
||||
unless node.chef_environment == "development"
|
||||
include_recipe "kosmos-base::firewall"
|
||||
|
||||
firewall_rule "postgresql primary #{primary[:hostname]}" do
|
||||
port 5432
|
||||
protocol :tcp
|
||||
command :allow
|
||||
source primary[:ipaddress]
|
||||
end
|
||||
postgresql_access "zerotier members replication" do
|
||||
access_type "host"
|
||||
access_db "replication"
|
||||
access_user "replication"
|
||||
access_addr "10.1.1.0/24"
|
||||
access_method "md5"
|
||||
notifies :reload, "service[#{postgresql_service}]", :immediately
|
||||
end
|
||||
end
|
||||
|
||||
Reference in New Issue
Block a user