Compare commits
2 Commits
124ee5e6f3
...
069090bf44
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
069090bf44 | ||
|
|
dd92d6cdb7 |
@ -55,20 +55,3 @@ The content of `server.crt`, `server.key` and `root.crt` an stored in the
|
||||
`postgresql` encrypted data bag. The root key is stored in LastPass
|
||||
("Self-signed TLS root certificate"). `server.crt` & `server.key` are used by
|
||||
the PostgreSQL server.
|
||||
|
||||
The root certificate needs to be deployed to clients so they verify the cert
|
||||
can be trusted.
|
||||
|
||||
For example:
|
||||
|
||||
```ruby
|
||||
postgresql_data_bag_item = data_bag_item('credentials', 'postgresql')
|
||||
root_cert_path = "/etc/ssl/certs/root.kosmos.org.crt"
|
||||
file root_cert_path do
|
||||
content postgresql_data_bag_item['ssl_root_cert']
|
||||
mode "0644"
|
||||
end
|
||||
```
|
||||
|
||||
`/etc/ssl/certs/root.kosmos.org.crt` can be used as the CA root cert path in
|
||||
the client's configuration
|
||||
|
||||
@ -71,6 +71,3 @@ postgresql_replicas.each do |replica|
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
# TODO: We need to set up firewall rules and access rules for clients too
|
||||
# (Mastodon, ejabberd, etc)
|
||||
|
||||
@ -81,6 +81,3 @@ systemctl start #{postgresql_service}
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
# TODO: We need to set up firewall rules and access rules for clients too
|
||||
# (Mastodon, ejabberd, etc)
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user