Configure postgres recipes for VMs and zerotier access

* Remove encfs (using encrypted volumes instead)
* Allow access without TLS from zerotier network

site-cookbooks/kosmos-postgresql/recipes/replica.rb

@@ -19,43 +19,38 @@ postgresql_data_bag_item = data_bag_item('credentials', 'postgresql')
 primary = postgresql_primary
 
 unless primary.nil?
-  postgresql_data_dir = "#{node["kosmos_encfs"]["data_directory"]}/postgresql/#{postgresql_version}/main"
+  # TODO
+  postgresql_data_dir = "/var/lib/postgresql/#{postgresql_version}/main"
 
-  if node['kosmos-postgresql']['ready_to_set_up_replica']
-    execute "set up replication" do
-      command <<-EOF
+  # FIXME get zerotier IP
+  execute "set up replication" do
+    command <<-EOF
 systemctl stop #{postgresql_service}
 mv #{postgresql_data_dir} #{postgresql_data_dir}.old
-pg_basebackup -h #{primary[:ipaddress]} -U replication -D #{postgresql_data_dir} -R
+pg_basebackup -h 10.1.1.167 -U replication -D #{postgresql_data_dir} -R
 chown -R postgres:postgres #{postgresql_data_dir}
 systemctl start #{postgresql_service}
-      EOF
-      environment 'PGPASSWORD' => postgresql_data_bag_item['replication_password']
-      sensitive true
-      not_if { ::File.exist? "#{postgresql_data_dir}/standby.signal" }
-    end
+    EOF
+    environment 'PGPASSWORD' => postgresql_data_bag_item['replication_password']
+    sensitive true
+    not_if { ::File.exist? "#{postgresql_data_dir}/standby.signal" }
   end
 
-  postgresql_access "replication" do
+  postgresql_access "zerotier members" do
     access_type "host"
-    access_db "replication"
-    access_user "replication"
-    access_addr "#{primary[:ipaddress]}/32"
+    access_db "all"
+    access_user "all"
+    access_addr "10.1.1.0/24"
     access_method "md5"
     notifies :reload, "service[#{postgresql_service}]", :immediately
   end
 
-  # On the next Chef run the replica will be set up
-  node.normal['kosmos-postgresql']['ready_to_set_up_replica'] = true
-
-  unless node.chef_environment == "development"
-    include_recipe "kosmos-base::firewall"
-
-    firewall_rule "postgresql primary #{primary[:hostname]}" do
-      port        5432
-      protocol    :tcp
-      command     :allow
-      source primary[:ipaddress]
-    end
+  postgresql_access "zerotier members replication" do
+    access_type "host"
+    access_db "replication"
+    access_user "replication"
+    access_addr "10.1.1.0/24"
+    access_method "md5"
+    notifies :reload, "service[#{postgresql_service}]", :immediately
   end
 end