Added puppetlabs-firewall (required by puppetlabs-postgresql), updated the other modules.

This commit is contained in:
Ciaby 2014-07-11 14:51:15 -05:00
parent 5f4b7a3b72
commit dee66abcdd
137 changed files with 11118 additions and 419 deletions

View file

@ -8,8 +8,10 @@ class postgresql::globals (
$contrib_package_name = undef,
$devel_package_name = undef,
$java_package_name = undef,
$perl_package_name = undef,
$plperl_package_name = undef,
$python_package_name = undef,
$postgis_package_name = undef,
$service_name = undef,
$service_provider = undef,
@ -33,6 +35,7 @@ class postgresql::globals (
$group = undef,
$version = undef,
$postgis_version = undef,
$needs_initdb = undef,
@ -56,6 +59,7 @@ class postgresql::globals (
},
'Amazon' => '9.2',
default => $::operatingsystemrelease ? {
/^7\./ => '9.2',
/^6\./ => '8.4',
/^5\./ => '8.1',
default => undef,
@ -83,12 +87,28 @@ class postgresql::globals (
default => undef,
}
$globals_version = pick($version, $default_version, 'unknown')
if($globals_version == 'unknown') {
fail('No preferred version defined or automatically detected.')
}
$default_postgis_version = $globals_version ? {
'8.1' => '1.3.6',
'8.4' => '1.5',
'9.0' => '1.5',
'9.1' => '1.5',
'9.2' => '2.0',
'9.3' => '2.1',
}
$globals_postgis_version = pick($postgis_version, $default_postgis_version)
# Setup of the repo only makes sense globally, so we are doing this here.
if($manage_package_repo) {
class { 'postgresql::repo':
ensure => $ensure,
version => $globals_version
# Workaround the lack of RHEL7 repositories for now.
if ! ($::operatingsystem == 'RedHat' and $::operatingsystemrelease =~ /^7/) {
class { 'postgresql::repo':
ensure => $ensure,
version => $globals_version
}
}
}
}

View file

@ -0,0 +1,13 @@
# This class installs the perl libs for postgresql. See README.md for more
# details.
class postgresql::lib::perl(
$package_name = $postgresql::params::perl_package_name,
$package_ensure = 'present'
) inherits postgresql::params {
package { 'perl-DBD-Pg':
ensure => $package_ensure,
name => $package_name,
}
}

View file

@ -1,16 +1,17 @@
# PRIVATE CLASS: do not use directly
class postgresql::params inherits postgresql::globals {
$ensure = true
$ensure = present
$version = $globals_version
$postgis_version = $globals_postgis_version
$listen_addresses = 'localhost'
$port = 5432
$ip_mask_deny_postgres_user = '0.0.0.0/0'
$ip_mask_allow_all_users = '127.0.0.1/32'
$ipv4acls = []
$ipv6acls = []
$user = pick($user, 'postgres')
$group = pick($group, 'postgres')
$encoding = $encoding
$locale = $locale
$service_ensure = undef
$service_provider = $service_provider
$manage_firewall = $manage_firewall
$manage_pg_hba_conf = pick($manage_pg_hba_conf, true)
@ -18,8 +19,12 @@ class postgresql::params inherits postgresql::globals {
# Amazon Linux's OS Family is 'Linux', operating system 'Amazon'.
case $::osfamily {
'RedHat', 'Linux': {
$user = pick($user, 'postgres')
$group = pick($group, 'postgres')
$needs_initdb = pick($needs_initdb, true)
$firewall_supported = pick($firewall_supported, true)
$version_parts = split($version, '[.]')
$package_version = "${version_parts[0]}${version_parts[1]}"
if $version == $default_version {
$client_package_name = pick($client_package_name, 'postgresql')
@ -36,8 +41,6 @@ class postgresql::params inherits postgresql::globals {
}
$confdir = pick($confdir, $datadir)
} else {
$version_parts = split($version, '[.]')
$package_version = "${version_parts[0]}${version_parts[1]}"
$client_package_name = pick($client_package_name, "postgresql${package_version}")
$server_package_name = pick($server_package_name, "postgresql${package_version}-server")
$contrib_package_name = pick($contrib_package_name,"postgresql${package_version}-contrib")
@ -55,7 +58,18 @@ class postgresql::params inherits postgresql::globals {
$psql_path = pick($psql_path, "${bindir}/psql")
$service_status = $service_status
$perl_package_name = pick($perl_package_name, 'perl-DBD-Pg')
$python_package_name = pick($python_package_name, 'python-psycopg2')
$postgis_package_name = pick(
$postgis_package_name,
$::operatingsystemrelease ? {
/5/ => 'postgis',
default => versioncmp($postgis_version, '2') ? {
'-1' => "postgis${package_version}",
default => "postgis2_${package_version}",}
}
)
}
'Archlinux': {
@ -64,6 +78,8 @@ class postgresql::params inherits postgresql::globals {
# so they can set it themself
$firewall_supported = pick($firewall_supported, true)
$needs_initdb = pick($needs_initdb, true)
$user = pick($user, 'postgres')
$group = pick($group, 'postgres')
# Archlinux doesn't have a client-package but has a libs package which
# pulls in postgresql server
@ -84,9 +100,13 @@ class postgresql::params inherits postgresql::globals {
$service_status = $service_status
$python_package_name = pick($python_package_name, 'python-psycopg2')
# Archlinux does not have a perl::DBD::Pg package
$perl_package_name = pick($perl_package_name, 'undef')
}
'Debian': {
$user = pick($user, 'postgres')
$group = pick($group, 'postgres')
if $manage_package_repo == true {
$needs_initdb = pick($needs_initdb, true)
@ -106,8 +126,16 @@ class postgresql::params inherits postgresql::globals {
$client_package_name = pick($client_package_name, "postgresql-client-${version}")
$server_package_name = pick($server_package_name, "postgresql-${version}")
$contrib_package_name = pick($contrib_package_name, "postgresql-contrib-${version}")
$postgis_package_name = pick(
$postgis_package_name,
versioncmp($postgis_version, '2') ? {
'-1' => "postgresql-${version}-postgis",
default => "postgresql-${version}-postgis-${postgis_version}",
}
)
$devel_package_name = pick($devel_package_name, 'libpq-dev')
$java_package_name = pick($java_package_name, 'libpostgresql-jdbc-java')
$perl_package_name = pick($perl_package_name, 'libdbd-pg-perl')
$plperl_package_name = pick($plperl_package_name, "postgresql-plperl-${version}")
$python_package_name = pick($python_package_name, 'python-psycopg2')
@ -121,19 +149,22 @@ class postgresql::params inherits postgresql::globals {
}
'FreeBSD': {
$user = pick($user, 'pgsql')
$group = pick($group, 'pgsql')
$client_package_name = pick($client_package_name, "databases/postgresql${version}-client")
$server_package_name = pick($server_package_name, "databases/postgresql${version}-server")
$contrib_package_name = pick($contrib_package_name, "databases/postgresql${version}-contrib")
$devel_package_name = pick($devel_package_name, 'databases/postgresql-libpqxx3')
$java_package_name = pick($java_package_name, 'databases/postgresql-jdbc')
$perl_package_name = pick($plperl_package_name, 'databases/p5-DBD-Pg')
$plperl_package_name = pick($plperl_package_name, "databases/postgresql${version}-plperl")
$python_package_name = pick($python_package_name, 'databases/py-psycopg2')
$service_name = pick($service_name, 'postgresql')
$bindir = pick($bindir, '/usr/local/bin')
$datadir = pick($datadir, '/usr/local/pgsql/data')
$confdir = pick($confdir, '/usr/local/share/postgresql')
$confdir = pick($confdir, $datadir)
$service_status = pick($service_status, "/usr/local/etc/rc.d/${service_name} status")
$psql_path = pick($psql_path, "${bindir}/psql")
@ -168,8 +199,4 @@ class postgresql::params inherits postgresql::globals {
$pg_hba_conf_defaults = pick($pg_hba_conf_defaults, true)
$postgresql_conf_path = pick($postgresql_conf_path, "${confdir}/postgresql.conf")
$default_database = pick($default_database, 'postgres')
if($version == 'unknown') {
fail('No preferred version defined or automatically detected.')
}
}

View file

@ -1,5 +1,6 @@
# PRIVATE CLASS: do not use directly
class postgresql::repo::apt_postgresql_org inherits postgresql::repo {
include ::apt
if($ensure == 'present' or $ensure == true) {
# Here we have tried to replicate the instructions on the PostgreSQL site:
#

View file

@ -2,8 +2,6 @@
class postgresql::server (
$ensure = $postgresql::params::ensure,
$version = $postgresql::params::version,
$postgres_password = undef,
$package_name = $postgresql::params::server_package_name,
@ -12,12 +10,14 @@ class postgresql::server (
$plperl_package_name = $postgresql::params::plperl_package_name,
$service_ensure = $postgresql::params::service_ensure,
$service_name = $postgresql::params::service_name,
$service_provider = $postgresql::params::service_provider,
$service_status = $postgresql::params::service_status,
$default_database = $postgresql::params::default_database,
$listen_addresses = $postgresql::params::listen_addresses,
$port = $postgresql::params::port,
$ip_mask_deny_postgres_user = $postgresql::params::ip_mask_deny_postgres_user,
$ip_mask_allow_all_users = $postgresql::params::ip_mask_allow_all_users,
$ipv4acls = $postgresql::params::ipv4acls,
@ -44,10 +44,20 @@ class postgresql::server (
$manage_firewall = $postgresql::params::manage_firewall,
$manage_pg_hba_conf = $postgresql::params::manage_pg_hba_conf,
$firewall_supported = $postgresql::params::firewall_supported
$firewall_supported = $postgresql::params::firewall_supported,
#Deprecated
$version = $postgresql::params::version,
) inherits postgresql::params {
$pg = 'postgresql::server'
if $version != undef {
warning('Passing "version" to postgresql::server is deprecated; please use postgresql::globals instead.')
$_version = $postgresql::params::version
} else {
$_version = $version
}
if ($ensure == 'present' or $ensure == true) {
# Reload has its own ordering, specified by other defines
class { "${pg}::reload": require => Class["${pg}::install"] }

View file

@ -4,6 +4,7 @@ class postgresql::server::config {
$ip_mask_deny_postgres_user = $postgresql::server::ip_mask_deny_postgres_user
$ip_mask_allow_all_users = $postgresql::server::ip_mask_allow_all_users
$listen_addresses = $postgresql::server::listen_addresses
$port = $postgresql::server::port
$ipv4acls = $postgresql::server::ipv4acls
$ipv6acls = $postgresql::server::ipv6acls
$pg_hba_conf_path = $postgresql::server::pg_hba_conf_path
@ -19,7 +20,7 @@ class postgresql::server::config {
if ($manage_pg_hba_conf == true) {
# Prepare the main pg_hba file
concat { $pg_hba_conf_path:
owner => 0,
owner => $user,
group => $group,
mode => '0640',
warn => true,
@ -97,6 +98,18 @@ class postgresql::server::config {
postgresql::server::config_entry { 'listen_addresses':
value => $listen_addresses,
}
postgresql::server::config_entry { 'port':
value => "${port}",
}
# RedHat-based systems hardcode some PG* variables in the init script, and need to be overriden
# in /etc/sysconfig/pgsql/postgresql. Create a blank file so we can manage it with augeas later.
if ($::osfamily == 'RedHat') and ($::operatingsystemrelease !~ /^7/) {
file { '/etc/sysconfig/pgsql/postgresql':
ensure => present,
replace => false,
}
}
} else {
file { $pg_hba_conf_path:
ensure => absent,

View file

@ -11,6 +11,10 @@ define postgresql::server::config_entry (
default => $path,
}
Exec {
logoutput => 'on_failure',
}
case $name {
/data_directory|hba_file|ident_file|include|listen_addresses|port|max_connections|superuser_reserved_connections|unix_socket_directory|unix_socket_group|unix_socket_permissions|bonjour|bonjour_name|ssl|ssl_ciphers|shared_buffers|max_prepared_transactions|max_files_per_process|shared_preload_libraries|wal_level|wal_buffers|archive_mode|max_wal_senders|hot_standby|logging_collector|silent_mode|track_activity_query_size|autovacuum_max_workers|autovacuum_freeze_max_age|max_locks_per_transaction|max_pred_locks_per_transaction|restart_after_crash|lc_messages|lc_monetary|lc_numeric|lc_time/: {
Postgresql_conf {
@ -26,6 +30,52 @@ define postgresql::server::config_entry (
}
}
# We have to handle ports in a weird and special way. On Redhat we either
# have to create a systemd override for the port or update the sysconfig
# file.
if $::osfamily == 'RedHat' {
if $::operatingsystemrelease =~ /^7/ {
if $name == 'port' {
file { 'systemd-port-override':
ensure => present,
path => '/etc/systemd/system/postgresql.service',
owner => root,
group => root,
content => template('postgresql/systemd-port-override.erb'),
notify => [ Exec['restart-systemd'], Class['postgresql::server::service'] ],
before => Class['postgresql::server::reload'],
}
exec { 'restart-systemd':
command => 'systemctl daemon-reload',
refreshonly => true,
path => '/bin:/usr/bin:/usr/local/bin'
}
}
} else {
if $name == 'port' {
# We need to force postgresql to stop before updating the port
# because puppet becomes confused and is unable to manage the
# service appropriately.
exec { 'postgresql_stop':
command => "service ${::postgresql::server::service_name} stop",
onlyif => "service ${::postgresql::server::service_name} status",
unless => "grep 'PGPORT=${value}' /etc/sysconfig/pgsql/postgresql",
path => '/sbin:/bin:/usr/bin:/usr/local/bin',
require => File['/etc/sysconfig/pgsql/postgresql'],
} ->
augeas { 'override PGPORT in /etc/sysconfig/pgsql/postgresql':
lens => 'Shellvars.lns',
incl => '/etc/sysconfig/pgsql/*',
context => '/files/etc/sysconfig/pgsql/postgresql',
changes => "set PGPORT ${value}",
require => File['/etc/sysconfig/pgsql/postgresql'],
notify => Class['postgresql::server::service'],
before => Class['postgresql::server::reload'],
}
}
}
}
case $ensure {
/present|absent/: {
postgresql_conf { $name:

View file

@ -12,13 +12,16 @@ define postgresql::server::database(
$user = $postgresql::server::user
$group = $postgresql::server::group
$psql_path = $postgresql::server::psql_path
$port = $postgresql::server::port
$version = $postgresql::server::version
$default_db = $postgresql::server::default_database
# Set the defaults for the postgresql_psql resource
Postgresql_psql {
psql_user => $user,
psql_group => $group,
psql_path => $psql_path,
port => $port,
}
# Optionally set the locale switch. Older versions of createdb may not accept
@ -44,11 +47,13 @@ define postgresql::server::database(
default => "--tablespace='${tablespace}' ",
}
$createdb_command = "${createdb_path} --owner='${owner}' --template=${template} ${encoding_option}${locale_option}${tablespace_option} '${dbname}'"
$createdb_command = "${createdb_path} --port='${port}' --owner='${owner}' --template=${template} ${encoding_option}${locale_option}${tablespace_option} '${dbname}'"
postgresql_psql { "Check for existence of db '${dbname}'":
command => 'SELECT 1',
unless => "SELECT datname FROM pg_database WHERE datname='${dbname}'",
db => $default_db,
port => $port,
require => Class['postgresql::server::service']
}~>
exec { $createdb_command :
@ -60,13 +65,15 @@ define postgresql::server::database(
# This will prevent users from connecting to the database unless they've been
# granted privileges.
postgresql_psql {"REVOKE ${public_revoke_privilege} ON DATABASE \"${dbname}\" FROM public":
db => $user,
db => $default_db,
port => $port,
refreshonly => true,
}
Exec [ $createdb_command ]->
postgresql_psql {"UPDATE pg_database SET datistemplate = ${istemplate} WHERE datname = '${dbname}'":
unless => "SELECT datname FROM pg_database WHERE datname = '${dbname}' AND datistemplate = ${istemplate}",
db => $default_db,
}
# Build up dependencies on tablespace

View file

@ -3,6 +3,7 @@
define postgresql::server::db (
$user,
$password,
$dbname = $title,
$encoding = $postgresql::server::encoding,
$locale = $postgresql::server::locale,
$grant = 'ALL',
@ -11,13 +12,16 @@ define postgresql::server::db (
$istemplate = false,
$owner = undef
) {
postgresql::server::database { $name:
encoding => $encoding,
tablespace => $tablespace,
template => $template,
locale => $locale,
istemplate => $istemplate,
owner => $owner,
if ! defined(Postgresql::Server::Database[$dbname]) {
postgresql::server::database { $dbname:
encoding => $encoding,
tablespace => $tablespace,
template => $template,
locale => $locale,
istemplate => $istemplate,
owner => $owner,
}
}
if ! defined(Postgresql::Server::Role[$user]) {
@ -26,10 +30,12 @@ define postgresql::server::db (
}
}
postgresql::server::database_grant { "GRANT ${user} - ${grant} - ${name}":
privilege => $grant,
db => $name,
role => $user,
if ! defined(Postgresql::Server::Database_grant["GRANT ${user} - ${grant} - ${dbname}"]) {
postgresql::server::database_grant { "GRANT ${user} - ${grant} - ${dbname}":
privilege => $grant,
db => $dbname,
role => $user,
}
}
if($tablespace != undef and defined(Postgresql::Server::Tablespace[$tablespace])) {

View file

@ -3,17 +3,17 @@ class postgresql::server::firewall {
$ensure = $postgresql::server::ensure
$manage_firewall = $postgresql::server::manage_firewall
$firewall_supported = $postgresql::server::firewall_supported
$port = $postgresql::server::port
if ($manage_firewall and $firewall_supported) {
if ($ensure == 'present' or $ensure == true) {
# TODO: get rid of hard-coded port
firewall { '5432 accept - postgres':
port => '5432',
firewall { "$port accept - postgres":
port => $port,
proto => 'tcp',
action => 'accept',
}
} else {
firewall { '5432 accept - postgres':
firewall { "$port accept - postgres":
ensure => absent,
}
}

View file

@ -5,8 +5,9 @@ define postgresql::server::grant (
$privilege = undef,
$object_type = 'database',
$object_name = $db,
$psql_db = $postgresql::server::user,
$psql_user = $postgresql::server::user
$psql_db = $postgresql::server::default_database,
$psql_user = $postgresql::server::user,
$port = $postgresql::server::port
) {
$group = $postgresql::server::group
$psql_path = $postgresql::server::psql_path
@ -68,6 +69,7 @@ define postgresql::server::grant (
$grant_cmd = "GRANT ${_privilege} ON ${_object_type} \"${object_name}\" TO \"${role}\""
postgresql_psql { $grant_cmd:
db => $on_db,
port => $port,
psql_user => $psql_user,
psql_group => $group,
psql_path => $psql_path,

View file

@ -23,7 +23,7 @@ class postgresql::server::install {
# This will clean up anything we miss
exec { 'apt-get-autoremove-postgresql-client-brute':
command => "dpkg -P postgresql*",
command => 'dpkg -P postgresql*',
onlyif => "dpkg -l postgresql* | grep -e '^ii'",
logoutput => on_failure,
path => '/usr/bin:/bin:/usr/sbin/:/sbin',

View file

@ -0,0 +1,32 @@
# Install the postgis postgresql packaging. See README.md for more details.
class postgresql::server::postgis (
$package_name = $postgresql::params::postgis_package_name,
$package_ensure = 'present'
) inherits postgresql::params {
validate_string($package_name)
package { 'postgresql-postgis':
ensure => $package_ensure,
name => $package_name,
tag => 'postgresql',
}
if($package_ensure == 'present' or $package_ensure == true) {
anchor { 'postgresql::server::postgis::start': }->
Class['postgresql::server::install']->
Package['postgresql-postgis']->
Class['postgresql::server::service']->
anchor { 'postgresql::server::postgis::end': }
if $postgresql::globals::manage_package_repo {
Class['postgresql::repo'] ->
Package['postgresql-postgis']
}
} else {
anchor { 'postgresql::server::postgis::start': }->
Class['postgresql::server::service']->
Package['postgresql-postgis']->
Class['postgresql::server::install']->
anchor { 'postgresql::server::postgis::end': }
}
}

View file

@ -10,6 +10,7 @@ class postgresql::server::reload {
command => "service ${service_name} reload",
onlyif => $service_status,
refreshonly => true,
require => Class['postgresql::server::service'],
}
}
}

View file

@ -3,8 +3,10 @@ define postgresql::server::role(
$password_hash = false,
$createdb = false,
$createrole = false,
$db = $postgresql::server::user,
$db = $postgresql::server::default_database,
$port = $postgresql::server::port,
$login = true,
$inherit = true,
$superuser = false,
$replication = false,
$connection_limit = '-1',
@ -16,6 +18,7 @@ define postgresql::server::role(
$version = $postgresql::server::version
$login_sql = $login ? { true => 'LOGIN', default => 'NOLOGIN' }
$inherit_sql = $inherit ? { true => 'INHERIT', default => 'NOINHERIT' }
$createrole_sql = $createrole ? { true => 'CREATEROLE', default => 'NOCREATEROLE' }
$createdb_sql = $createdb ? { true => 'CREATEDB', default => 'NOCREATEDB' }
$superuser_sql = $superuser ? { true => 'SUPERUSER', default => 'NOSUPERUSER' }
@ -28,6 +31,7 @@ define postgresql::server::role(
Postgresql_psql {
db => $db,
port => $port,
psql_user => $psql_user,
psql_group => $psql_group,
psql_path => $psql_path,
@ -55,6 +59,10 @@ define postgresql::server::role(
unless => "SELECT rolname FROM pg_roles WHERE rolname='${username}' and rolcanlogin=${login}",
}
postgresql_psql {"ALTER ROLE \"${username}\" ${inherit_sql}":
unless => "SELECT rolname FROM pg_roles WHERE rolname='${username}' and rolinherit=${inherit}",
}
if(versioncmp($version, '9.1') >= 0) {
if $replication_sql == '' {
postgresql_psql {"ALTER ROLE \"${username}\" NOREPLICATION":

View file

@ -1,13 +1,25 @@
# PRIVATE CLASS: do not call directly
class postgresql::server::service {
$ensure = $postgresql::server::ensure
$service_ensure = $postgresql::server::service_ensure
$service_name = $postgresql::server::service_name
$service_provider = $postgresql::server::service_provider
$service_status = $postgresql::server::service_status
$user = $postgresql::server::user
$port = $postgresql::server::port
$default_database = $postgresql::server::default_database
$service_ensure = $ensure ? {
if $service_ensure {
$real_service_ensure = $service_ensure
} else {
$real_service_ensure = $ensure ? {
present => 'running',
absent => 'stopped',
default => $ensure
}
}
$service_enable = $ensure ? {
present => true,
absent => false,
default => $ensure
@ -16,15 +28,15 @@ class postgresql::server::service {
anchor { 'postgresql::server::service::begin': }
service { 'postgresqld':
ensure => $service_ensure,
ensure => $real_service_ensure,
name => $service_name,
enable => $service_ensure,
enable => $service_enable,
provider => $service_provider,
hasstatus => true,
status => $service_status,
}
if($service_ensure) {
if $real_service_ensure == 'running' {
# This blocks the class before continuing if chained correctly, making
# sure the service really is 'up' before continuing.
#
@ -33,6 +45,7 @@ class postgresql::server::service {
postgresql::validate_db_connection { 'validate_service_is_running':
run_as => $user,
database_name => $default_database,
database_port => $port,
sleep => 1,
tries => 60,
create_db_first => false,

View file

@ -5,12 +5,14 @@ define postgresql::server::table_grant(
$table,
$db,
$role,
$port = $postgresql::server::port,
$psql_db = undef,
$psql_user = undef
) {
postgresql::server::grant { "table:${name}":
role => $role,
db => $db,
port => $port,
privilege => $privilege,
object_type => 'TABLE',
object_name => $table,

View file

@ -6,12 +6,14 @@ define postgresql::server::tablespace(
) {
$user = $postgresql::server::user
$group = $postgresql::server::group
$port = $postgresql::server::port
$psql_path = $postgresql::server::psql_path
Postgresql_psql {
psql_user => $user,
psql_group => $group,
psql_path => $psql_path,
port => $port,
}
if ($owner == undef) {

View file

@ -55,7 +55,7 @@ define postgresql::validate_db_connection(
environment => $env,
logoutput => 'on_failure',
user => $run_as,
path => '/bin',
path => '/bin:/usr/bin:/usr/local/bin',
timeout => $timeout,
require => Package['postgresql-client'],
}