opuppet/module-postgresql
5
0
Fork 0
Code Issues Pull requests Releases Wiki Activity
module-postgresql/manifests/params.pp

94 lines
3.5 KiB
ObjectPascal
Raw Normal View History

Working version of postgresql::server This is a first working version of postgresql::server. It includes a very simple test manifest, which has been tried out on CentOS6 and Ubuntu 10.04; initial tests were successful both from a clean state and for subsequent runs. Includes a new fact called 'postgres_default_version', which detects what the default version of postgres is for a given OS. This is needed because some of the commands and directory names include this version string. Current implementation *only* supports managing the system default version; in the future it would be nice to allow the user to explicitly specify a postgres version, but that isn't yet supported. The "postgresql::server" class includes a call to postgres's initdb command on redhat systems, because they don't do this automatically when the package is installed.
2012-06-08 22:37:21 +02:00
# Class: postgresql::params
#
# The postgresql configuration settings.
#
# Parameters:
#
# Actions:
#
# Requires:
#
# Sample Usage:
#
class postgresql::params {
Add postgresql::db convenience type, improve security This commit adds a postgresql::db type for convenience; it mirrors the 'db' type from the mysql module, which allows you to create a database instance and user plus grant privileges to that user all in one succint resource. This commit also improves security in the following ways: * Revoke "CONNECT" privilege from the 'public' role for newly created databases; without this, any database created via this module will allow connections from any database user, and will allow them to do things like create tables. * Change to a 'reject'-based policy for dealing with remote connections by the postgres user in pg_hba.conf. Prior to this commit, if you tried to restrict access to the postgres user by IP, the rule would simply not match for disallowed IPs; then it would fall through to the rule for "all" users, which could still match and thus allow the postgres user to connect remotely.
2012-06-09 18:23:11 +02:00
$user = 'postgres'
$group = 'postgres'
$ip_mask_deny_postgres_user = '0.0.0.0/0'
$ip_mask_allow_all_users = '127.0.0.1/32'
$listen_addresses = 'localhost'
Improve configuration for initial postgres install This commit adds some configuration management for postgres, to allow users to get a more complete setup from their initial install. Prior to this commit, we were basically only ensuring that the package was installed and the service was running. Now, we support limited configuration for the pg_hba.conf file to enable md5 authentication for remote hosts, and for the postgresql.conf file to specify the listener addresses where TCP connections should be accepted. Without these two changes the initial postgres configuration doesn't allow *any* connections from outside of the local host. This commit also adds an option for opening up the postgres port in the firewall on redhat-based systems, and an option to allow setting the password for the 'postgres' database user. As of this commit, this module now has dependencies on puppetlabs-stdlib (version > 2.3.4, which includes the new 'match' parameter for the 'file_line' resource type), and on puppetlabs-firewall.
2012-06-08 23:00:24 +02:00
# TODO: figure out a way to make this not platform-specific
Add postgresql::db convenience type, improve security This commit adds a postgresql::db type for convenience; it mirrors the 'db' type from the mysql module, which allows you to create a database instance and user plus grant privileges to that user all in one succint resource. This commit also improves security in the following ways: * Revoke "CONNECT" privilege from the 'public' role for newly created databases; without this, any database created via this module will allow connections from any database user, and will allow them to do things like create tables. * Change to a 'reject'-based policy for dealing with remote connections by the postgres user in pg_hba.conf. Prior to this commit, if you tried to restrict access to the postgres user by IP, the rule would simply not match for disallowed IPs; then it would fall through to the rule for "all" users, which could still match and thus allow the postgres user to connect remotely.
2012-06-09 18:23:11 +02:00
$manage_redhat_firewall = false
Improve configuration for initial postgres install This commit adds some configuration management for postgres, to allow users to get a more complete setup from their initial install. Prior to this commit, we were basically only ensuring that the package was installed and the service was running. Now, we support limited configuration for the pg_hba.conf file to enable md5 authentication for remote hosts, and for the postgresql.conf file to specify the listener addresses where TCP connections should be accepted. Without these two changes the initial postgres configuration doesn't allow *any* connections from outside of the local host. This commit also adds an option for opening up the postgres port in the firewall on redhat-based systems, and an option to allow setting the password for the 'postgres' database user. As of this commit, this module now has dependencies on puppetlabs-stdlib (version > 2.3.4, which includes the new 'match' parameter for the 'file_line' resource type), and on puppetlabs-firewall.
2012-06-08 23:00:24 +02:00
Add a type for validating a postgres connection This commit adds a new resource type that can be used to validate that a successful postgres connection can be established from a puppet node to a (potentially remote) postgres database instance.
2012-09-14 22:09:31 +02:00
# This is a bit hacky, but if the puppet nodes don't have pluginsync enabled,
# they will fail with a not-so-helpful error message. Here we are explicitly
# verifying that the custom fact exists (which implies that pluginsync is
# enabled and succeeded). If not, we fail with a hint that tells the user
# that pluginsync might not be enabled. Ideally this would be handled directly
# in puppet.
if ($::postgres_default_version == undef) {
fail "No value for postgres_default_version facter fact; it's possible that you don't have pluginsync enabled."
}
Working version of postgresql::server This is a first working version of postgresql::server. It includes a very simple test manifest, which has been tried out on CentOS6 and Ubuntu 10.04; initial tests were successful both from a clean state and for subsequent runs. Includes a new fact called 'postgres_default_version', which detects what the default version of postgres is for a given OS. This is needed because some of the commands and directory names include this version string. Current implementation *only* supports managing the system default version; in the future it would be nice to allow the user to explicitly specify a postgres version, but that isn't yet supported. The "postgresql::server" class includes a call to postgres's initdb command on redhat systems, because they don't do this automatically when the package is installed.
2012-06-08 22:37:21 +02:00
case $::operatingsystem {
default: {
$service_provider = undef
}
}
case $::osfamily {
'RedHat': {
Improve configuration for initial postgres install This commit adds some configuration management for postgres, to allow users to get a more complete setup from their initial install. Prior to this commit, we were basically only ensuring that the package was installed and the service was running. Now, we support limited configuration for the pg_hba.conf file to enable md5 authentication for remote hosts, and for the postgresql.conf file to specify the listener addresses where TCP connections should be accepted. Without these two changes the initial postgres configuration doesn't allow *any* connections from outside of the local host. This commit also adds an option for opening up the postgres port in the firewall on redhat-based systems, and an option to allow setting the password for the 'postgres' database user. As of this commit, this module now has dependencies on puppetlabs-stdlib (version > 2.3.4, which includes the new 'match' parameter for the 'file_line' resource type), and on puppetlabs-firewall.
2012-06-08 23:00:24 +02:00
$service_name = 'postgresql'
$client_package_name = 'postgresql'
$server_package_name = 'postgresql-server'
Add postgresql::devel for development dependencies
2012-10-17 02:36:53 +02:00
$devel_package_name = 'postgresql-devel'
Improve configuration for initial postgres install This commit adds some configuration management for postgres, to allow users to get a more complete setup from their initial install. Prior to this commit, we were basically only ensuring that the package was installed and the service was running. Now, we support limited configuration for the pg_hba.conf file to enable md5 authentication for remote hosts, and for the postgresql.conf file to specify the listener addresses where TCP connections should be accepted. Without these two changes the initial postgres configuration doesn't allow *any* connections from outside of the local host. This commit also adds an option for opening up the postgres port in the firewall on redhat-based systems, and an option to allow setting the password for the 'postgres' database user. As of this commit, this module now has dependencies on puppetlabs-stdlib (version > 2.3.4, which includes the new 'match' parameter for the 'file_line' resource type), and on puppetlabs-firewall.
2012-06-08 23:00:24 +02:00
$needs_initdb = true
$initdb_path = '/usr/bin/initdb'
Bring database, database_user, and database_grant into alignment with mysql module Renamed a few files and made some tweaks to try to get database_grant, database_user, and database types into a state where they work very similarly to the ones in the mysql module. Also introduced a "postgresql_password" function that can be used to generate an md5 password hash for a postgres user.
2012-06-09 07:30:27 +02:00
$createdb_path = '/usr/bin/createdb'
$psql_path = '/usr/bin/psql'
Improve configuration for initial postgres install This commit adds some configuration management for postgres, to allow users to get a more complete setup from their initial install. Prior to this commit, we were basically only ensuring that the package was installed and the service was running. Now, we support limited configuration for the pg_hba.conf file to enable md5 authentication for remote hosts, and for the postgresql.conf file to specify the listener addresses where TCP connections should be accepted. Without these two changes the initial postgres configuration doesn't allow *any* connections from outside of the local host. This commit also adds an option for opening up the postgres port in the firewall on redhat-based systems, and an option to allow setting the password for the 'postgres' database user. As of this commit, this module now has dependencies on puppetlabs-stdlib (version > 2.3.4, which includes the new 'match' parameter for the 'file_line' resource type), and on puppetlabs-firewall.
2012-06-08 23:00:24 +02:00
$datadir = '/var/lib/pgsql/data/'
$pg_hba_conf_path = '/var/lib/pgsql/data/pg_hba.conf'
$postgresql_conf_path = '/var/lib/pgsql/data/postgresql.conf'
$firewall_supported = true
$persist_firewall_command = '/sbin/iptables-save > /etc/sysconfig/iptables'
Working version of postgresql::server This is a first working version of postgresql::server. It includes a very simple test manifest, which has been tried out on CentOS6 and Ubuntu 10.04; initial tests were successful both from a clean state and for subsequent runs. Includes a new fact called 'postgres_default_version', which detects what the default version of postgres is for a given OS. This is needed because some of the commands and directory names include this version string. Current implementation *only* supports managing the system default version; in the future it would be nice to allow the user to explicitly specify a postgres version, but that isn't yet supported. The "postgresql::server" class includes a call to postgres's initdb command on redhat systems, because they don't do this automatically when the package is installed.
2012-06-08 22:37:21 +02:00
}
'Debian': {
Fix for debian 6 service name It turns out that Ubuntu and Debian have different names for the postgres service; this fix makes the module compatible with debian 6.
2012-06-15 00:12:51 +02:00
case $::operatingsystem {
'Debian': {
$service_name = "postgresql"
}
'Ubuntu': {
Add a type for validating a postgres connection This commit adds a new resource type that can be used to validate that a successful postgres connection can be established from a puppet node to a (potentially remote) postgres database instance.
2012-09-14 22:09:31 +02:00
case $::lsbmajdistrelease {
# thanks, ubuntu
'10': { $service_name = "postgresql-${::postgres_default_version}" }
default: { $service_name = "postgresql" }
}
Fix for debian 6 service name It turns out that Ubuntu and Debian have different names for the postgres service; this fix makes the module compatible with debian 6.
2012-06-15 00:12:51 +02:00
}
}
Improve configuration for initial postgres install This commit adds some configuration management for postgres, to allow users to get a more complete setup from their initial install. Prior to this commit, we were basically only ensuring that the package was installed and the service was running. Now, we support limited configuration for the pg_hba.conf file to enable md5 authentication for remote hosts, and for the postgresql.conf file to specify the listener addresses where TCP connections should be accepted. Without these two changes the initial postgres configuration doesn't allow *any* connections from outside of the local host. This commit also adds an option for opening up the postgres port in the firewall on redhat-based systems, and an option to allow setting the password for the 'postgres' database user. As of this commit, this module now has dependencies on puppetlabs-stdlib (version > 2.3.4, which includes the new 'match' parameter for the 'file_line' resource type), and on puppetlabs-firewall.
2012-06-08 23:00:24 +02:00
$client_package_name = 'postgresql-client'
$server_package_name = 'postgresql'
Add postgresql::devel for development dependencies
2012-10-17 02:36:53 +02:00
$devel_package_name = 'libpq-dev'
Improve configuration for initial postgres install This commit adds some configuration management for postgres, to allow users to get a more complete setup from their initial install. Prior to this commit, we were basically only ensuring that the package was installed and the service was running. Now, we support limited configuration for the pg_hba.conf file to enable md5 authentication for remote hosts, and for the postgresql.conf file to specify the listener addresses where TCP connections should be accepted. Without these two changes the initial postgres configuration doesn't allow *any* connections from outside of the local host. This commit also adds an option for opening up the postgres port in the firewall on redhat-based systems, and an option to allow setting the password for the 'postgres' database user. As of this commit, this module now has dependencies on puppetlabs-stdlib (version > 2.3.4, which includes the new 'match' parameter for the 'file_line' resource type), and on puppetlabs-firewall.
2012-06-08 23:00:24 +02:00
$needs_initdb = false
$initdb_path = "/usr/lib/postgresql/${::postgres_default_version}/bin/initdb"
Bring database, database_user, and database_grant into alignment with mysql module Renamed a few files and made some tweaks to try to get database_grant, database_user, and database types into a state where they work very similarly to the ones in the mysql module. Also introduced a "postgresql_password" function that can be used to generate an md5 password hash for a postgres user.
2012-06-09 07:30:27 +02:00
$createdb_path = "/usr/lib/postgresql/${::postgres_default_version}/bin/createdb"
$psql_path = "/usr/lib/postgresql/${::postgres_default_version}/bin/psql"
Improve configuration for initial postgres install This commit adds some configuration management for postgres, to allow users to get a more complete setup from their initial install. Prior to this commit, we were basically only ensuring that the package was installed and the service was running. Now, we support limited configuration for the pg_hba.conf file to enable md5 authentication for remote hosts, and for the postgresql.conf file to specify the listener addresses where TCP connections should be accepted. Without these two changes the initial postgres configuration doesn't allow *any* connections from outside of the local host. This commit also adds an option for opening up the postgres port in the firewall on redhat-based systems, and an option to allow setting the password for the 'postgres' database user. As of this commit, this module now has dependencies on puppetlabs-stdlib (version > 2.3.4, which includes the new 'match' parameter for the 'file_line' resource type), and on puppetlabs-firewall.
2012-06-08 23:00:24 +02:00
$datadir = "/var/lib/postgresql/${::postgres_default_version}/main"
$pg_hba_conf_path = "/etc/postgresql/${::postgres_default_version}/main/pg_hba.conf"
$postgresql_conf_path = "/etc/postgresql/${::postgres_default_version}/main/postgresql.conf"
$firewall_supported = false
Update status for postgres service on Debian The postgresql init script on debian/ubuntu returns 0 no matter whether postgresql is started or stopped, so puppet has no way of knowing whether to start postgresql when the service is set to 'ensure => running'. This commit adds a param to the params class called $service_status which is set to the status piped to an egrep on debian/ubuntu, which reliably returns 0 if there are clusters running and 1 if there are none. The output before and after this patch can be seen below. If the init script is fixed at some point, the logic would need to be revisited. Before patch postgresql remains stopped after puppet run. $ # service postgresql stop $ # * Stopping PostgreSQL 9.1 database server $ # puppet apply -e "class {'postgresql::server':}" $ # notice: Finished catalog run in 0.15 seconds $ # service postgresql status $ # Running clusters: After patch postgresql is started after puppet run. $ # service postgresql stop $ # * Stopping PostgreSQL 9.1 database server $ # puppet apply -e "class {'postgresql::server':}" $ # notice: /Stage[main]/Postgresql::Server/Service[postgresqld]/ensure: ensure changed 'stopped' to 'running' $ # notice: Finished catalog run in 2.26 seconds $ # service postgresql status $ # Running clusters: 9.1/main
2012-09-29 00:41:53 +02:00
$service_status = "/etc/init.d/${service_name} status | /bin/egrep -q 'Running clusters: .+'"
Improve configuration for initial postgres install This commit adds some configuration management for postgres, to allow users to get a more complete setup from their initial install. Prior to this commit, we were basically only ensuring that the package was installed and the service was running. Now, we support limited configuration for the pg_hba.conf file to enable md5 authentication for remote hosts, and for the postgresql.conf file to specify the listener addresses where TCP connections should be accepted. Without these two changes the initial postgres configuration doesn't allow *any* connections from outside of the local host. This commit also adds an option for opening up the postgres port in the firewall on redhat-based systems, and an option to allow setting the password for the 'postgres' database user. As of this commit, this module now has dependencies on puppetlabs-stdlib (version > 2.3.4, which includes the new 'match' parameter for the 'file_line' resource type), and on puppetlabs-firewall.
2012-06-08 23:00:24 +02:00
# TODO: not exactly sure yet what the right thing to do for Debian/Ubuntu is.
#$persist_firewall_command = '/sbin/iptables-save > /etc/iptables/rules.v4'
Working version of postgresql::server This is a first working version of postgresql::server. It includes a very simple test manifest, which has been tried out on CentOS6 and Ubuntu 10.04; initial tests were successful both from a clean state and for subsequent runs. Includes a new fact called 'postgres_default_version', which detects what the default version of postgres is for a given OS. This is needed because some of the commands and directory names include this version string. Current implementation *only* supports managing the system default version; in the future it would be nice to allow the user to explicitly specify a postgres version, but that isn't yet supported. The "postgresql::server" class includes a call to postgres's initdb command on redhat systems, because they don't do this automatically when the package is installed.
2012-06-08 22:37:21 +02:00
}
default: {
fail("Unsupported osfamily: ${::osfamily} operatingsystem: ${::operatingsystem}, module ${module_name} currently only supports osfamily RedHat and Debian")
}
}
}
Reference in a new issue Copy permalink