Skip to content

Commit 144d448

Browse files
SimonHoenscheidSimonHoenscheid
committedSep 27, 2023
initial server instance define
instance directories is now a hash, update example
1 parent b35f763 commit 144d448

File tree

3 files changed

+475
-1
lines changed

3 files changed

+475
-1
lines changed
 

‎README.md

+180-1
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
* [Getting started with postgresql](#getting-started-with-postgresql)
99
3. [Usage - Configuration options and additional functionality](#usage)
1010
* [Configure a server](#configure-a-server)
11+
* [Configure an instance](#configure-an-instance)
1112
* [Create a database](#create-a-database)
1213
* [Manage users, roles, and permissions](#manage-users-roles-and-permissions)
1314
* [Manage ownership of DB objects](#manage-ownership-of-db-objects)
@@ -72,6 +73,184 @@ If you get an error message from these commands, your permission settings restri
7273

7374
For more details about server configuration parameters, consult the [PostgreSQL Runtime Configuration documentation](http://www.postgresql.org/docs/current/static/runtime-config.html).
7475

76+
### Configure an instance
77+
78+
This module supports managing multiple instances (the default instance is referred to as 'main' and managed via including the server.pp class)
79+
80+
**NOTE:** This feature is currently tested on Centos 8 Streams/RHEL8 with DNF Modules enabled. Different Linux plattforms and/or the Postgresql.org
81+
packages distribute different Systemd service files or use wrapper scripts with Systemd to start Postgres. Additional adjustmentments are needed to get this working on these plattforms.
82+
83+
#### Working Plattforms
84+
85+
* Centos 8 Streams
86+
* RHEL 8
87+
88+
#### Background and example
89+
90+
creating a new instance has the following advantages:
91+
* files are owned by the postgres user
92+
* instance is running under a different user, if the instance is hacked, the hacker has no access to the file system
93+
* the instance user can be an LDAP user, higher security because of central login monitoring, password policies, password rotation policies
94+
* main instance can be disabled
95+
96+
97+
Here is a profile which can be used to create instaces
98+
99+
```puppet
100+
class profiles::postgres (
101+
Hash $instances = {},
102+
String $postgresql_version = '13',
103+
) {
104+
class { 'postgresql::globals':
105+
encoding => 'UTF-8',
106+
locale => 'en_US.UTF-8',
107+
manage_package_repo => false,
108+
manage_dnf_module => true,
109+
needs_initdb => true,
110+
version => $postgresql_version,
111+
}
112+
include postgresql::server
113+
114+
$instances.each |String $instance, Hash $instance_settings| {
115+
postgresql::server_instance { $instance:
116+
* => $instance_settings,
117+
}
118+
}
119+
}
120+
```
121+
122+
And here is data to create an instance called test1:
123+
124+
```yaml
125+
# stop default main instance
126+
postgresql::server::service_ensure: "stopped"
127+
postgresql::server::service_enable: false
128+
129+
#define an instance
130+
profiles::postgres::instances:
131+
test1:
132+
instance_user: "ins_test1"
133+
instance_group: "ins_test1"
134+
instance_directories:
135+
"/opt/pgsql":
136+
ensure: directory
137+
"/opt/pgsql/backup":
138+
ensure: directory
139+
"/opt/pgsql/data":
140+
ensure: directory
141+
"/opt/pgsql/data/13":
142+
ensure: directory
143+
"/opt/pgsql/data/home":
144+
ensure: directory
145+
"/opt/pgsql/wal":
146+
ensure: directory
147+
"/opt/pgsql/log":
148+
ensure: directory
149+
"/opt/pgsql/log/13":
150+
ensure: directory
151+
"/opt/pgsql/log/13/test1":
152+
ensure: directory
153+
config_settings:
154+
pg_hba_conf_path: "/opt/pgsql/data/13/test1/pg_hba.conf"
155+
postgresql_conf_path: "/opt/pgsql/data/13/test1/postgresql.conf"
156+
pg_ident_conf_path: "/opt/pgsql/data/13/test1/pg_ident.conf"
157+
datadir: "/opt/pgsql/data/13/test1"
158+
service_name: "postgresql@13-test1"
159+
port: 5433
160+
pg_hba_conf_defaults: false
161+
service_settings:
162+
service_name: "postgresql@13-test1"
163+
service_status: "systemctl status postgresql@13-test1.service"
164+
service_ensure: "running"
165+
service_enable: true
166+
initdb_settings:
167+
auth_local: "peer"
168+
auth_host: "md5"
169+
needs_initdb: true
170+
datadir: "/opt/pgsql/data/13/test1"
171+
encoding: "UTF-8"
172+
lc_messages: "en_US.UTF8"
173+
locale: "en_US.UTF8"
174+
data_checksums: false
175+
group: "postgres"
176+
user: "postgres"
177+
username: "ins_test1"
178+
config_entries:
179+
authentication_timeout:
180+
value: "1min"
181+
comment: "a test"
182+
log_statement_stats:
183+
value: "off"
184+
autovacuum_vacuum_scale_factor:
185+
value: 0.3
186+
databases:
187+
testdb1:
188+
encoding: "UTF8"
189+
locale: "en_US.UTF8"
190+
owner: "dba_test1"
191+
testdb2:
192+
encoding: "UTF8"
193+
locale: "en_US.UTF8"
194+
owner: "dba_test1"
195+
roles:
196+
"ins_test1":
197+
superuser: true
198+
login: true
199+
"dba_test1":
200+
createdb: true
201+
login: true
202+
"app_test1":
203+
login: true
204+
"rep_test1":
205+
replication: true
206+
login: true
207+
"rou_test1":
208+
login: true
209+
pg_hba_rules:
210+
"local all INSTANCE user":
211+
type: "local"
212+
database: "all"
213+
user: "ins_test1"
214+
auth_method: "peer"
215+
order: 1
216+
"local all DB user":
217+
type: "local"
218+
database: "all"
219+
user: "dba_test1"
220+
auth_method: "peer"
221+
order: 2
222+
"local all APP user":
223+
type: "local"
224+
database: "all"
225+
user: "app_test1"
226+
auth_method: "peer"
227+
order: 3
228+
"local all READONLY user":
229+
type: "local"
230+
database: "all"
231+
user: "rou_test1"
232+
auth_method: "peer"
233+
order: 4
234+
"remote all INSTANCE user PGADMIN server":
235+
type: "host"
236+
database: "all"
237+
user: "ins_test1"
238+
address: "192.168.22.131/32"
239+
auth_method: "md5"
240+
order: 5
241+
"local replication INSTANCE user":
242+
type: "local"
243+
database: "replication"
244+
user: "ins_test1"
245+
auth_method: "peer"
246+
order: 6
247+
"local replication REPLICATION user":
248+
type: "local"
249+
database: "replication"
250+
user: "rep_test1"
251+
auth_method: "peer"
252+
order: 7
253+
```
75254
### Create a database
76255
77256
You can set up a variety of PostgreSQL databases with the `postgresql::server::db` defined type. For instance, to set up a database for PuppetDB:
@@ -359,7 +538,7 @@ For information on the classes and types, see the [REFERENCE.md](https://github.
359538
360539
## Limitations
361540
362-
Works with versions of PostgreSQL on supported OSes.
541+
Works with versions of PostgreSQL on supported OSes.
363542
364543
For an extensive list of supported operating systems, see [metadata.json](https://github.com/puppetlabs/puppetlabs-postgresql/blob/main/metadata.json)
365544

‎REFERENCE.md

+163
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@
6363
* [`postgresql::server::schema`](#postgresql--server--schema): Create a new schema.
6464
* [`postgresql::server::table_grant`](#postgresql--server--table_grant): This resource wraps the grant resource to manage table grants specifically.
6565
* [`postgresql::server::tablespace`](#postgresql--server--tablespace): This module creates tablespace.
66+
* [`postgresql::server_instance`](#postgresql--server_instance): define to install and manage additional postgresql instances
6667

6768
#### Private Defined types
6869

@@ -4038,6 +4039,168 @@ May need to specify if '/tmp' is on volume mounted with noexec option.
40384039

40394040
Default value: `$postgresql::server::module_workdir`
40404041

4042+
### <a name="postgresql--server_instance"></a>`postgresql::server_instance`
4043+
4044+
define to install and manage additional postgresql instances
4045+
4046+
#### Parameters
4047+
4048+
The following parameters are available in the `postgresql::server_instance` defined type:
4049+
4050+
* [`instance_name`](#-postgresql--server_instance--instance_name)
4051+
* [`instance_user`](#-postgresql--server_instance--instance_user)
4052+
* [`instance_group`](#-postgresql--server_instance--instance_group)
4053+
* [`instance_user_homedirectory`](#-postgresql--server_instance--instance_user_homedirectory)
4054+
* [`manage_instance_user_and_group`](#-postgresql--server_instance--manage_instance_user_and_group)
4055+
* [`instance_directories`](#-postgresql--server_instance--instance_directories)
4056+
* [`initdb_settings`](#-postgresql--server_instance--initdb_settings)
4057+
* [`config_settings`](#-postgresql--server_instance--config_settings)
4058+
* [`service_settings`](#-postgresql--server_instance--service_settings)
4059+
* [`passwd_settings`](#-postgresql--server_instance--passwd_settings)
4060+
* [`roles`](#-postgresql--server_instance--roles)
4061+
* [`config_entries`](#-postgresql--server_instance--config_entries)
4062+
* [`pg_hba_rules`](#-postgresql--server_instance--pg_hba_rules)
4063+
* [`databases`](#-postgresql--server_instance--databases)
4064+
* [`databases_and_users`](#-postgresql--server_instance--databases_and_users)
4065+
* [`database_grants`](#-postgresql--server_instance--database_grants)
4066+
* [`table_grants`](#-postgresql--server_instance--table_grants)
4067+
4068+
##### <a name="-postgresql--server_instance--instance_name"></a>`instance_name`
4069+
4070+
Data type: `String[1]`
4071+
4072+
The name of the instance.
4073+
4074+
Default value: `$name`
4075+
4076+
##### <a name="-postgresql--server_instance--instance_user"></a>`instance_user`
4077+
4078+
Data type: `String[1]`
4079+
4080+
The user to run the instance as.
4081+
4082+
Default value: `$instance_name`
4083+
4084+
##### <a name="-postgresql--server_instance--instance_group"></a>`instance_group`
4085+
4086+
Data type: `String[1]`
4087+
4088+
The group to run the instance as.
4089+
4090+
Default value: `$instance_name`
4091+
4092+
##### <a name="-postgresql--server_instance--instance_user_homedirectory"></a>`instance_user_homedirectory`
4093+
4094+
Data type: `Stdlib::Absolutepath`
4095+
4096+
The home directory of the instance user.
4097+
4098+
Default value: `"/opt/pgsql/data/home/${instance_user}"`
4099+
4100+
##### <a name="-postgresql--server_instance--manage_instance_user_and_group"></a>`manage_instance_user_and_group`
4101+
4102+
Data type: `Boolean`
4103+
4104+
Should Puppet manage the instance user and it's primary group?.
4105+
4106+
Default value: `true`
4107+
4108+
##### <a name="-postgresql--server_instance--instance_directories"></a>`instance_directories`
4109+
4110+
Data type: `Hash`
4111+
4112+
directories needed for the instance. Option to manage the directory properties for each directory.
4113+
4114+
Default value: `{}`
4115+
4116+
##### <a name="-postgresql--server_instance--initdb_settings"></a>`initdb_settings`
4117+
4118+
Data type: `Hash`
4119+
4120+
Specifies a hash witn parameters for postgresql::server::instance::initdb
4121+
4122+
Default value: `{}`
4123+
4124+
##### <a name="-postgresql--server_instance--config_settings"></a>`config_settings`
4125+
4126+
Data type: `Hash`
4127+
4128+
Specifies a hash with parameters for postgresql::server::instance::config
4129+
4130+
Default value: `{}`
4131+
4132+
##### <a name="-postgresql--server_instance--service_settings"></a>`service_settings`
4133+
4134+
Data type: `Hash`
4135+
4136+
Specifies a hash with parameters for postgresql::server:::instance::service
4137+
4138+
Default value: `{}`
4139+
4140+
##### <a name="-postgresql--server_instance--passwd_settings"></a>`passwd_settings`
4141+
4142+
Data type: `Hash`
4143+
4144+
Specifies a hash with parameters for postgresql::server::instance::passwd
4145+
4146+
Default value: `{}`
4147+
4148+
##### <a name="-postgresql--server_instance--roles"></a>`roles`
4149+
4150+
Data type: `Hash`
4151+
4152+
Specifies a hash from which to generate postgresql::server::role resources.
4153+
4154+
Default value: `{}`
4155+
4156+
##### <a name="-postgresql--server_instance--config_entries"></a>`config_entries`
4157+
4158+
Data type: `Hash`
4159+
4160+
Specifies a hash from which to generate postgresql::server::config_entry resources.
4161+
4162+
Default value: `{}`
4163+
4164+
##### <a name="-postgresql--server_instance--pg_hba_rules"></a>`pg_hba_rules`
4165+
4166+
Data type: `Hash`
4167+
4168+
Specifies a hash from which to generate postgresql::server::pg_hba_rule resources.
4169+
4170+
Default value: `{}`
4171+
4172+
##### <a name="-postgresql--server_instance--databases"></a>`databases`
4173+
4174+
Data type: `Hash`
4175+
4176+
Specifies a hash from which to generate postgresql::server::database resources.
4177+
4178+
Default value: `{}`
4179+
4180+
##### <a name="-postgresql--server_instance--databases_and_users"></a>`databases_and_users`
4181+
4182+
Data type: `Hash`
4183+
4184+
Specifies a hash from which to generate postgresql::server::db resources.
4185+
4186+
Default value: `{}`
4187+
4188+
##### <a name="-postgresql--server_instance--database_grants"></a>`database_grants`
4189+
4190+
Data type: `Hash`
4191+
4192+
Specifies a hash from which to generate postgresql::server::database_grant resources.
4193+
4194+
Default value: `{}`
4195+
4196+
##### <a name="-postgresql--server_instance--table_grants"></a>`table_grants`
4197+
4198+
Data type: `Hash`
4199+
4200+
Specifies a hash from which to generate postgresql::server::table_grant resources.
4201+
4202+
Default value: `{}`
4203+
40414204
## Resource types
40424205

40434206
### <a name="postgresql_conf"></a>`postgresql_conf`

‎manifests/server_instance.pp

+132
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
# @summary define to install and manage additional postgresql instances
2+
# @param instance_name The name of the instance.
3+
# @param instance_user The user to run the instance as.
4+
# @param instance_group The group to run the instance as.
5+
# @param instance_user_homedirectory The home directory of the instance user.
6+
# @param manage_instance_user_and_group Should Puppet manage the instance user and it's primary group?.
7+
# @param instance_directories directories needed for the instance. Option to manage the directory properties for each directory.
8+
# @param initdb_settings Specifies a hash witn parameters for postgresql::server::instance::initdb
9+
# @param config_settings Specifies a hash with parameters for postgresql::server::instance::config
10+
# @param service_settings Specifies a hash with parameters for postgresql::server:::instance::service
11+
# @param passwd_settings Specifies a hash with parameters for postgresql::server::instance::passwd
12+
# @param roles Specifies a hash from which to generate postgresql::server::role resources.
13+
# @param config_entries Specifies a hash from which to generate postgresql::server::config_entry resources.
14+
# @param pg_hba_rules Specifies a hash from which to generate postgresql::server::pg_hba_rule resources.
15+
# @param databases Specifies a hash from which to generate postgresql::server::database resources.
16+
# @param databases_and_users Specifies a hash from which to generate postgresql::server::db resources.
17+
# @param database_grants Specifies a hash from which to generate postgresql::server::database_grant resources.
18+
# @param table_grants Specifies a hash from which to generate postgresql::server::table_grant resources.
19+
define postgresql::server_instance (
20+
String[1] $instance_name = $name,
21+
Boolean $manage_instance_user_and_group = true,
22+
Hash $instance_directories = {},
23+
String[1] $instance_user = $instance_name,
24+
String[1] $instance_group = $instance_name,
25+
Stdlib::Absolutepath $instance_user_homedirectory = "/opt/pgsql/data/home/${instance_user}",
26+
Hash $initdb_settings = {},
27+
Hash $config_settings = {},
28+
Hash $service_settings = {},
29+
Hash $passwd_settings = {},
30+
Hash $roles = {},
31+
Hash $config_entries = {},
32+
Hash $pg_hba_rules = {},
33+
Hash $databases_and_users = {},
34+
Hash $databases = {},
35+
Hash $database_grants = {},
36+
Hash $table_grants = {},
37+
) {
38+
unless($facts['os']['family'] == 'RedHat' and $facts['os']['release']['major'] == '8') {
39+
warning('This define postgresql::server_instance is only tested on RHEL8')
40+
}
41+
$instance_directories.each |Stdlib::Absolutepath $directory, Hash $directory_settings| {
42+
file { $directory:
43+
* => $directory_settings,
44+
}
45+
}
46+
47+
if $manage_instance_user_and_group {
48+
user { $instance_user:
49+
managehome => true,
50+
system => true,
51+
home => $instance_user_homedirectory,
52+
gid => $instance_group,
53+
}
54+
group { $instance_group:
55+
system => true,
56+
}
57+
}
58+
postgresql::server::instance::initdb { $instance_name:
59+
* => $initdb_settings,
60+
}
61+
postgresql::server::instance::config { $instance_name:
62+
* => $config_settings,
63+
}
64+
postgresql::server::instance::service { $instance_name:
65+
* => $service_settings,
66+
port => $config_settings['port'],
67+
user => $instance_user,
68+
}
69+
postgresql::server::instance::passwd { $instance_name:
70+
* => $passwd_settings,
71+
}
72+
73+
$roles.each |$rolename, $role| {
74+
postgresql::server::role { $rolename:
75+
* => $role,
76+
psql_user => $instance_user,
77+
psql_group => $instance_group,
78+
port => $config_settings['port'],
79+
instance => $instance_name,
80+
}
81+
}
82+
83+
$config_entries.each |$entry, $settings| {
84+
$value = $settings['value']
85+
$comment = $settings['comment']
86+
postgresql::server::config_entry { "${entry}_${$instance_name}":
87+
ensure => bool2str($value =~ Undef, 'absent', 'present'),
88+
key => $entry,
89+
value => $value,
90+
comment => $comment,
91+
path => $config_settings['postgresql_conf_path'],
92+
}
93+
}
94+
$pg_hba_rules.each |String[1] $rule_name, Postgresql::Pg_hba_rule $rule| {
95+
$rule_title = "${rule_name} for instance ${name}"
96+
postgresql::server::pg_hba_rule { $rule_title:
97+
* => $rule,
98+
target => $config_settings['pg_hba_conf_path'], # TODO: breaks if removed
99+
}
100+
}
101+
$databases_and_users.each |$database, $database_details| {
102+
postgresql::server::db { $database:
103+
* => $database_details,
104+
psql_user => $instance_user,
105+
psql_group => $instance_group,
106+
port => $config_settings['port'],
107+
}
108+
}
109+
$databases.each |$database, $database_details| {
110+
postgresql::server::database { $database:
111+
* => $database_details,
112+
user => $instance_user,
113+
group => $instance_group,
114+
port => $config_settings['port'],
115+
}
116+
}
117+
$database_grants.each |$db_grant_title, $dbgrants| {
118+
postgresql::server::database_grant { $db_grant_title:
119+
* => $dbgrants,
120+
psql_user => $instance_user,
121+
psql_group => $instance_group,
122+
port => $config_settings['port'],
123+
}
124+
}
125+
$table_grants.each |$table_grant_title, $tgrants| {
126+
postgresql::server::table_grant { $table_grant_title:
127+
* => $tgrants,
128+
psql_user => $instance_user,
129+
port => $config_settings['port'],
130+
}
131+
}
132+
}

0 commit comments

Comments
 (0)
Please sign in to comment.