History

Greg 7ce8b7d461 Enable PostgreSQL service		2021-01-23 19:14:55 +01:00
..
attributes	Add a custom resource to set up PostgreSQL 12	2020-05-11 18:23:11 +02:00
libraries	Use the PG primary private Zerotier IP if it exists	2021-01-22 18:41:45 +01:00
recipes	Replace the hardcoded primary pg IP with a hostname	2021-01-23 17:34:58 +01:00
resources	Enable PostgreSQL service	2021-01-23 19:14:55 +01:00
.gitignore	Add initial kosmos-postgresql cookbook	2019-04-03 11:34:34 +02:00
Berksfile	Add initial kosmos-postgresql cookbook	2019-04-03 11:34:34 +02:00
CHANGELOG.md	Remove boilerplate from the CHANGELOG	2019-04-12 11:42:29 +02:00
LICENSE	Remove extra license copy from recipe, update year	2021-01-07 12:53:44 +01:00
README.md	Remove deploying the root cert to clients from the README	2020-05-14 13:14:42 +02:00
chefignore	Add initial kosmos-postgresql cookbook	2019-04-03 11:34:34 +02:00
metadata.rb	Add a recipe to set up a hosts entry for the PG primary	2021-01-22 18:41:45 +01:00

README.md

kosmos-postgresql

Usage

On the primary:

Set the postgresql_primary role on the node

On the replica:

Add the postgresql_replica role to the node's run list. Run Chef on the node a first time. After the initial Chef run on the replica, run Chef on the primary to add the firewall rules and PostgreSQL access rules, then run Chef again on the replica to set up replication.

Caveat

firewall_rules and postgresql_access are declared in recipes, not resources because of the way custom resources work currently in Chef. See the default.rb and replica.rb recipes.

The primary gives access to the replication db to the replication user connecting from a replica, and replicas to the primary. For more information about PostgreSQL client authentication, see the official docs

The primary opens up the PostgreSQL port (5432 TCP) to replicas, and replicas to the primary.

TLS self-signed certificate

A wildcard (*.kosmos.org certificate) was generated with the following commands:

openssl req -new -nodes -text -out root.csr -keyout root.key \
  -subj "/CN=root.kosmos.org"
chmod og-rwx root.key
openssl x509 -req -in root.csr -text -days 3650 \
  -extfile /etc/ssl/openssl.cnf -extensions v3_ca \
  -signkey root.key -out root.crt
openssl req -new -nodes -text -out server.csr \
  -keyout server.key -subj "/CN=*.kosmos.org"
chmod og-rwx server.key
openssl x509 -req -in server.csr -text -days 1825 \
  -CA root.crt -CAkey root.key -CAcreateserial \
  -out server.crt

It is valid until May 12 2025.

The content of server.crt, server.key and root.crt an stored in the postgresql encrypted data bag. The root key is stored in LastPass ("Self-signed TLS root certificate"). server.crt & server.key are used by the PostgreSQL server.