Skip to content

Commit 6e4f005

Browse files
chelnakchelnak
authored
Merge pull request #1391 from SimonHoenscheid/shoenscheid_postgresql_instances_passwd_class_to_define
2 parents 17aca43 + ae9d85a commit 6e4f005

File tree

3 files changed

+94
-48
lines changed

3 files changed

+94
-48
lines changed

‎manifests/server/instance_passwd.pp

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# lint:ignore:140chars
2+
# @param user Overrides the default PostgreSQL super user and owner of PostgreSQL related files in the file system.
3+
# @param group Overrides the default postgres user group to be used for related files in the file system.
4+
# Default value: 5432. Meaning the Postgres server listens on TCP port 5432.
5+
# @param psql_path Specifies the path to the psql command.
6+
# @param port Specifies the port for the PostgreSQL server to listen on. Note: The same port number is used for all IP addresses the server listens on. Also, for Red Hat systems and early Debian systems, changing the port causes the server to come to a full stop before being able to make the change.
7+
# @param database Specifies the name of the database to connect with. On most systems this is 'postgres'.
8+
# @param module_workdir Working directory for the PostgreSQL module
9+
# @param postgres_password Sets the password for the postgres user to your specified value. By default, this setting uses the superuser account in the Postgres database, with a user called postgres and no password.
10+
# lint:endignore:140chars
11+
define postgresql::server::instance_passwd (
12+
$user = $postgresql::server::user,
13+
$group = $postgresql::server::group,
14+
$psql_path = $postgresql::server::psql_path,
15+
$port = $postgresql::server::port,
16+
$database = $postgresql::server::default_database,
17+
$module_workdir = $postgresql::server::module_workdir,
18+
$postgres_password = $postgresql::server::postgres_password,
19+
20+
) {
21+
$real_postgres_password = if $postgres_password =~ Sensitive {
22+
$postgres_password.unwrap
23+
} else {
24+
$postgres_password
25+
}
26+
27+
# psql will default to connecting as $user if you don't specify name
28+
$_datbase_user_same = $database == $user
29+
$_dboption = $_datbase_user_same ? {
30+
false => " --dbname ${shell_escape($database)}",
31+
default => ''
32+
}
33+
34+
if $real_postgres_password {
35+
# NOTE: this password-setting logic relies on the pg_hba.conf being
36+
# configured to allow the postgres system user to connect via psql
37+
# without specifying a password ('ident' or 'trust' security). This is
38+
# the default for pg_hba.conf.
39+
$escaped = postgresql::postgresql_escape($real_postgres_password)
40+
$exec_command = "${shell_escape($psql_path)}${_dboption} -c \"ALTER ROLE \\\"${shell_escape($user)}\\\" PASSWORD \${NEWPASSWD_ESCAPED}\"" # lint:ignore:140chars
41+
exec { 'set_postgres_postgrespw':
42+
# This command works w/no password because we run it as postgres system
43+
# user
44+
command => $exec_command,
45+
user => $user,
46+
group => $group,
47+
logoutput => true,
48+
cwd => $module_workdir,
49+
environment => [
50+
"PGPASSWORD=${real_postgres_password}",
51+
"PGPORT=${port}",
52+
"NEWPASSWD_ESCAPED=${escaped}",
53+
],
54+
# With this command we're passing -h to force TCP authentication, which
55+
# does require a password. We specify the password via the PGPASSWORD
56+
# environment variable. If the password is correct (current), this
57+
# command will exit with an exit code of 0, which will prevent the main
58+
# command from running.
59+
unless => "${psql_path} -h localhost -p ${port} -c 'select 1' > /dev/null",
60+
path => '/usr/bin:/usr/local/bin:/bin',
61+
}
62+
}
63+
}

‎manifests/server/passwd.pp

Lines changed: 8 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -1,52 +1,12 @@
11
# @api private
22
class postgresql::server::passwd {
3-
$postgres_password = if $postgresql::server::postgres_password =~ Sensitive {
4-
$postgresql::server::postgres_password.unwrap
5-
} else {
6-
$postgresql::server::postgres_password
7-
}
8-
9-
$user = $postgresql::server::user
10-
$group = $postgresql::server::group
11-
$psql_path = $postgresql::server::psql_path
12-
$port = $postgresql::server::port
13-
$database = $postgresql::server::default_database
14-
$module_workdir = $postgresql::server::module_workdir
15-
16-
# psql will default to connecting as $user if you don't specify name
17-
$_datbase_user_same = $database == $user
18-
$_dboption = $_datbase_user_same ? {
19-
false => " --dbname ${shell_escape($database)}",
20-
default => ''
21-
}
22-
23-
if $postgres_password {
24-
# NOTE: this password-setting logic relies on the pg_hba.conf being
25-
# configured to allow the postgres system user to connect via psql
26-
# without specifying a password ('ident' or 'trust' security). This is
27-
# the default for pg_hba.conf.
28-
$escaped = postgresql::postgresql_escape($postgres_password)
29-
$exec_command = "${shell_escape($psql_path)}${_dboption} -c \"ALTER ROLE \\\"${shell_escape($user)}\\\" PASSWORD \${NEWPASSWD_ESCAPED}\""
30-
exec { 'set_postgres_postgrespw':
31-
# This command works w/no password because we run it as postgres system
32-
# user
33-
command => $exec_command,
34-
user => $user,
35-
group => $group,
36-
logoutput => true,
37-
cwd => $module_workdir,
38-
environment => [
39-
"PGPASSWORD=${postgres_password}",
40-
"PGPORT=${port}",
41-
"NEWPASSWD_ESCAPED=${escaped}",
42-
],
43-
# With this command we're passing -h to force TCP authentication, which
44-
# does require a password. We specify the password via the PGPASSWORD
45-
# environment variable. If the password is correct (current), this
46-
# command will exit with an exit code of 0, which will prevent the main
47-
# command from running.
48-
unless => "${psql_path} -h localhost -p ${port} -c 'select 1' > /dev/null",
49-
path => '/usr/bin:/usr/local/bin:/bin',
50-
}
3+
postgresql::server::instance_passwd { 'main':
4+
user => $postgresql::server::user,
5+
group => $postgresql::server::group,
6+
psql_path => $postgresql::server::psql_path,
7+
port => $postgresql::server::port,
8+
database => $postgresql::server::default_database,
9+
module_workdir => $postgresql::server::module_workdir,
10+
postgres_password => $postgresql::server::postgres_password,
5111
}
5212
}

‎spec/defines/server/instance_passwd.rb

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# frozen_string_literal: true
2+
3+
require 'spec_helper'
4+
5+
describe 'postgresql::server::instance_passwd' do
6+
let(:title) { 'main' }
7+
8+
on_supported_os.each do |os, os_facts|
9+
context "on #{os}" do
10+
let :facts do
11+
os_facts
12+
end
13+
14+
let :pre_condition do
15+
"class {'postgresql::server':}"
16+
end
17+
18+
context 'with defaults from passwd class' do
19+
it { is_expected.to compile.with_all_deps }
20+
end
21+
end
22+
end
23+
end

0 commit comments

Comments
 (0)