|
3 | 3 | # @param update_password If set to true, updates the password on changes. Set this to false to not modify the role's password after creation.
|
4 | 4 | # @param password_hash Sets the hash to use during password creation.
|
5 | 5 | # @param createdb Specifies whether to grant the ability to create new databases with this role.
|
6 |
| -# @param createrole Specifies whether to grant the ability to create new roles with this role. |
7 |
| -# @param db Database used to connect to. |
| 6 | +# @param createrole Specifies whether to grant the ability to create new roles with this role. |
| 7 | +# @param db Database used to connect to. |
8 | 8 | # @param port Port to use when connecting.
|
9 | 9 | # @param login Specifies whether to grant login capability for the new role.
|
10 | 10 | # @param inherit Specifies whether to grant inherit capability for the new role.
|
|
76 | 76 | $superuser_sql = $superuser ? { true => 'SUPERUSER', default => 'NOSUPERUSER' }
|
77 | 77 | $replication_sql = $replication ? { true => 'REPLICATION', default => '' }
|
78 | 78 | if ($password_hash != false) {
|
79 |
| - $environment = "NEWPGPASSWD=${password_hash}" |
80 |
| - $password_sql = "ENCRYPTED PASSWORD '\$NEWPGPASSWD'" |
| 79 | + $password_sql = "ENCRYPTED PASSWORD '${password_hash}'" |
81 | 80 | } else {
|
82 | 81 | $password_sql = ''
|
83 |
| - $environment = [] |
84 | 82 | }
|
85 | 83 |
|
86 | 84 | postgresql_psql { "CREATE ROLE ${username} ENCRYPTED PASSWORD ****":
|
87 | 85 | command => "CREATE ROLE \"${username}\" ${password_sql} ${login_sql} ${createrole_sql} ${createdb_sql} ${superuser_sql} ${replication_sql} CONNECTION LIMIT ${connection_limit}",
|
88 | 86 | unless => "SELECT 1 FROM pg_roles WHERE rolname = '${username}'",
|
89 |
| - environment => $environment, |
90 | 87 | require => undef,
|
| 88 | + sensitive => true, |
91 | 89 | }
|
92 | 90 |
|
93 | 91 | postgresql_psql { "ALTER ROLE \"${username}\" ${superuser_sql}":
|
|
136 | 134 | postgresql_psql { "ALTER ROLE ${username} ENCRYPTED PASSWORD ****":
|
137 | 135 | command => "ALTER ROLE \"${username}\" ${password_sql}",
|
138 | 136 | unless => "SELECT 1 FROM pg_shadow WHERE usename = '${username}' AND passwd = '${pwd_hash_sql}'",
|
139 |
| - environment => $environment, |
| 137 | + sensitive => true, |
140 | 138 | }
|
141 | 139 | }
|
142 | 140 | } else {
|
|
0 commit comments