Skip to content

Commit 80c79bb

Browse files
SimonHoenscheidSimonHoenscheid
committed
Add multi instance support, refactoring password.pp (5/x)
This commit adds changes a class to add multi instance support to this module. The general idea is to first copy all classes which are used and create defines from them. These classes will use the defines as is. Necessary changes for the instances itself will be added to the classes and defined types at a later point. This ensures, the module will work as it does right now and there are no breaking changes.
1 parent ffa1d59 commit 80c79bb

File tree

3 files changed

+84
-48
lines changed

3 files changed

+84
-48
lines changed

‎manifests/server/instance_passwd.pp

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
define postgresql::server::instance_passwd (
2+
$user = $postgresql::server::user,
3+
$group = $postgresql::server::group,
4+
$psql_path = $postgresql::server::psql_path,
5+
$port = $postgresql::server::port,
6+
$database = $postgresql::server::default_database,
7+
$module_workdir = $postgresql::server::module_workdir,
8+
Enum[String[1], Sensitive[1]]$postgres_password = $postgresql::server::postgres_password,
9+
10+
) {
11+
$real_postgres_password = if $postgres_password =~ Sensitive {
12+
$postgres_password.unwrap
13+
} else {
14+
$postgres_password
15+
}
16+
17+
# psql will default to connecting as $user if you don't specify name
18+
$_datbase_user_same = $database == $user
19+
$_dboption = $_datbase_user_same ? {
20+
false => " --dbname ${shell_escape($database)}",
21+
default => ''
22+
}
23+
24+
if $real_postgres_password {
25+
# NOTE: this password-setting logic relies on the pg_hba.conf being
26+
# configured to allow the postgres system user to connect via psql
27+
# without specifying a password ('ident' or 'trust' security). This is
28+
# the default for pg_hba.conf.
29+
$escaped = postgresql::postgresql_escape($real_postgres_password)
30+
$exec_command = "${shell_escape($psql_path)}${_dboption} -c \"ALTER ROLE \\\"${shell_escape($user)}\\\" PASSWORD \${NEWPASSWD_ESCAPED}\""
31+
exec { 'set_postgres_postgrespw':
32+
# This command works w/no password because we run it as postgres system
33+
# user
34+
command => $exec_command,
35+
user => $user,
36+
group => $group,
37+
logoutput => true,
38+
cwd => $module_workdir,
39+
environment => [
40+
"PGPASSWORD=${real_postgres_password}",
41+
"PGPORT=${port}",
42+
"NEWPASSWD_ESCAPED=${escaped}",
43+
],
44+
# With this command we're passing -h to force TCP authentication, which
45+
# does require a password. We specify the password via the PGPASSWORD
46+
# environment variable. If the password is correct (current), this
47+
# command will exit with an exit code of 0, which will prevent the main
48+
# command from running.
49+
unless => "${psql_path} -h localhost -p ${port} -c 'select 1' > /dev/null",
50+
path => '/usr/bin:/usr/local/bin:/bin',
51+
}
52+
}
53+
}

‎manifests/server/passwd.pp

Lines changed: 8 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -1,52 +1,12 @@
11
# @api private
22
class postgresql::server::passwd {
3-
$postgres_password = if $postgresql::server::postgres_password =~ Sensitive {
4-
$postgresql::server::postgres_password.unwrap
5-
} else {
6-
$postgresql::server::postgres_password
7-
}
8-
9-
$user = $postgresql::server::user
10-
$group = $postgresql::server::group
11-
$psql_path = $postgresql::server::psql_path
12-
$port = $postgresql::server::port
13-
$database = $postgresql::server::default_database
14-
$module_workdir = $postgresql::server::module_workdir
15-
16-
# psql will default to connecting as $user if you don't specify name
17-
$_datbase_user_same = $database == $user
18-
$_dboption = $_datbase_user_same ? {
19-
false => " --dbname ${shell_escape($database)}",
20-
default => ''
21-
}
22-
23-
if $postgres_password {
24-
# NOTE: this password-setting logic relies on the pg_hba.conf being
25-
# configured to allow the postgres system user to connect via psql
26-
# without specifying a password ('ident' or 'trust' security). This is
27-
# the default for pg_hba.conf.
28-
$escaped = postgresql::postgresql_escape($postgres_password)
29-
$exec_command = "${shell_escape($psql_path)}${_dboption} -c \"ALTER ROLE \\\"${shell_escape($user)}\\\" PASSWORD \${NEWPASSWD_ESCAPED}\""
30-
exec { 'set_postgres_postgrespw':
31-
# This command works w/no password because we run it as postgres system
32-
# user
33-
command => $exec_command,
34-
user => $user,
35-
group => $group,
36-
logoutput => true,
37-
cwd => $module_workdir,
38-
environment => [
39-
"PGPASSWORD=${postgres_password}",
40-
"PGPORT=${port}",
41-
"NEWPASSWD_ESCAPED=${escaped}",
42-
],
43-
# With this command we're passing -h to force TCP authentication, which
44-
# does require a password. We specify the password via the PGPASSWORD
45-
# environment variable. If the password is correct (current), this
46-
# command will exit with an exit code of 0, which will prevent the main
47-
# command from running.
48-
unless => "${psql_path} -h localhost -p ${port} -c 'select 1' > /dev/null",
49-
path => '/usr/bin:/usr/local/bin:/bin',
50-
}
3+
postgresql::server::instance_passwd { 'main':
4+
user => $postgresql::server::user,
5+
group => $postgresql::server::group,
6+
psql_path => $postgresql::server::psql_path,
7+
port => $postgresql::server::port,
8+
database => $postgresql::server::default_database,
9+
module_workdir => $postgresql::server::module_workdir,
10+
postgres_password => $postgresql::server::postgres_password,
5111
}
5212
}

‎spec/defines/server/instance_passwd.rb

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# frozen_string_literal: true
2+
3+
require 'spec_helper'
4+
5+
describe 'postgresql::server::instance_passwd' do
6+
let(:title) { 'main' }
7+
8+
on_supported_os.each do |os, os_facts|
9+
context "on #{os}" do
10+
let :facts do
11+
os_facts
12+
end
13+
14+
let :pre_condition do
15+
"class {'postgresql::server':}"
16+
end
17+
18+
context 'with defaults from passwd class' do
19+
it { is_expected.to compile.with_all_deps }
20+
end
21+
end
22+
end
23+
end

0 commit comments

Comments
 (0)