Compare commits

...

2 Commits

Author SHA1 Message Date
Greg Karékinian
069090bf44 Remove TODOs
Access rules will not be part of this cookbook, they need to be added to
the cookbooks that use a PostgreSQL database
2020-05-14 13:15:47 +02:00
Greg Karékinian
dd92d6cdb7 Remove deploying the root cert to clients from the README
We do not want to verify the root cert so this is not needed
2020-05-14 13:14:42 +02:00
3 changed files with 0 additions and 23 deletions

View File

@ -55,20 +55,3 @@ The content of `server.crt`, `server.key` and `root.crt` an stored in the
`postgresql` encrypted data bag. The root key is stored in LastPass
("Self-signed TLS root certificate"). `server.crt` & `server.key` are used by
the PostgreSQL server.
The root certificate needs to be deployed to clients so they verify the cert
can be trusted.
For example:
```ruby
postgresql_data_bag_item = data_bag_item('credentials', 'postgresql')
root_cert_path = "/etc/ssl/certs/root.kosmos.org.crt"
file root_cert_path do
content postgresql_data_bag_item['ssl_root_cert']
mode "0644"
end
```
`/etc/ssl/certs/root.kosmos.org.crt` can be used as the CA root cert path in
the client's configuration

View File

@ -71,6 +71,3 @@ postgresql_replicas.each do |replica|
end
end
end
# TODO: We need to set up firewall rules and access rules for clients too
# (Mastodon, ejabberd, etc)

View File

@ -81,6 +81,3 @@ systemctl start #{postgresql_service}
end
end
end
# TODO: We need to set up firewall rules and access rules for clients too
# (Mastodon, ejabberd, etc)