From 1cdb444707fe359d8372d09dc4efa1b6c3862068 Mon Sep 17 00:00:00 2001
From: Simon Hoenscheid <code@simonhoenscheid.de>
Date: Thu, 2 Feb 2023 15:35:37 +0100
Subject: [PATCH 1/2] remove manual systemd drop-in file handling

  * add puppet/systemd module
  * remove systemd daemon reload and raise minimal puppet version to 6.1
  * remove old "drop-in file" removal, was in place 3 years now
  * move systemd drop-in file handling to seperate define
  * Implement recent feedback
  * define is now private
  * rename parameter in define call
  * fix unit tests
  * fix rubocop complains
  * fix path, set default fact
  * fix systemd drop in file, adding template parameters to systemd define
  * added reason for drop in file in a comment
---
 manifests/params.pp                 | 1 +
 manifests/server.pp                 | 2 ++
 manifests/server/instance/config.pp | 2 ++
 3 files changed, 5 insertions(+)

diff --git a/manifests/params.pp b/manifests/params.pp
index ebbfd035de..dead45742e 100644
--- a/manifests/params.pp
+++ b/manifests/params.pp
@@ -18,6 +18,7 @@
   $service_manage               = true
   $service_restart_on_change    = true
   $service_provider             = $postgresql::globals::service_provider
+  $systemd_drop_in_ensure       = 'present'
   $manage_pg_hba_conf           = pick($manage_pg_hba_conf, true)
   $manage_pg_ident_conf         = pick($manage_pg_ident_conf, true)
   $manage_recovery_conf         = pick($manage_recovery_conf, false)
diff --git a/manifests/server.pp b/manifests/server.pp
index 3271d24304..d1a6f7a1ca 100644
--- a/manifests/server.pp
+++ b/manifests/server.pp
@@ -15,6 +15,7 @@
 # @param service_provider Overrides the default PostgreSQL service provider.
 # @param service_reload Overrides the default reload command for your PostgreSQL service.
 # @param service_status Overrides the default status check command for your PostgreSQL service.
+# @param systemd_drop_in_ensure sets the Systemd drop-in file to present or absent
 # @param default_database Specifies the name of the default database to connect with. On most systems this is 'postgres'.
 # @param default_connect_settings Specifies a hash of environment variables used when connecting to a remote server. Becomes the default for other defined types, such as postgresql::server::role.
 #
@@ -103,6 +104,7 @@
   $service_provider                                = $postgresql::params::service_provider,
   $service_reload                                  = $postgresql::params::service_reload,
   $service_status                                  = $postgresql::params::service_status,
+  Enum[present, absent] $systemd_drop_in_ensure    = $postgresql::params::systemd_drop_in_ensure,
   $default_database                                = $postgresql::params::default_database,
   $default_connect_settings                        = $postgresql::globals::default_connect_settings,
   $listen_addresses                                = $postgresql::params::listen_addresses,
diff --git a/manifests/server/instance/config.pp b/manifests/server/instance/config.pp
index d6ef93259e..965584b393 100644
--- a/manifests/server/instance/config.pp
+++ b/manifests/server/instance/config.pp
@@ -29,6 +29,7 @@
 # @param logdir PostgreSQL log directory
 # @param service_name Overrides the default PostgreSQL service name.
 # @param service_enable Enable the PostgreSQL service
+# @param systemd_drop_in_ensure sets the Systemd drop-in file to present or absent
 # @param log_line_prefix PostgreSQL log line prefix
 # @param timezone Set timezone for the PostgreSQL instance
 # @param extra_systemd_config Adds extra config to systemd config file, can for instance be used to add extra openfiles. This can be a multi line string
@@ -57,6 +58,7 @@
   $logdir                                          = $postgresql::server::logdir,
   $service_name                                    = $postgresql::server::service_name,
   $service_enable                                  = $postgresql::server::service_enable,
+  Enum[present, absent] $systemd_drop_in_ensure    = $postgresql::server::systemd_drop_in_ensure,
   $log_line_prefix                                 = $postgresql::server::log_line_prefix,
   $timezone                                        = $postgresql::server::timezone,
   $password_encryption                             = $postgresql::server::password_encryption,

From 04d61cbf2b2297b70c5f763849844314e18b40ca Mon Sep 17 00:00:00 2001
From: Simon Hoenscheid <simon@hoenscheid-itconsulting.com>
Date: Mon, 13 Feb 2023 14:29:39 +0100
Subject: [PATCH 2/2] convert ERB templates to EPP

---
 manifests/params.pp                  |  1 -
 manifests/server.pp                  |  2 -
 manifests/server/instance/config.pp  |  2 -
 manifests/server/instance/systemd.pp |  7 ++-
 manifests/server/pg_hba_rule.pp      | 29 +++++++++----
 manifests/server/pg_ident_rule.pp    | 20 +++++++--
 manifests/server/recovery.pp         | 25 +++++++++--
 templates/pg_dump.sh.epp             | 13 ++++++
 templates/pg_hba_rule.conf           |  5 ---
 templates/pg_hba_rule.conf.epp       | 15 +++++++
 templates/pg_ident_rule.conf         |  5 ---
 templates/pg_ident_rule.conf.epp     | 12 ++++++
 templates/recovery.conf.epp          | 64 ++++++++++++++++++++++++++++
 templates/recovery.conf.erb          | 47 --------------------
 templates/systemd-override.conf.epp  | 15 +++++++
 templates/systemd-override.erb       |  8 ----
 16 files changed, 184 insertions(+), 86 deletions(-)
 delete mode 100644 templates/pg_hba_rule.conf
 create mode 100644 templates/pg_hba_rule.conf.epp
 delete mode 100644 templates/pg_ident_rule.conf
 create mode 100644 templates/pg_ident_rule.conf.epp
 create mode 100644 templates/recovery.conf.epp
 delete mode 100644 templates/recovery.conf.erb
 create mode 100644 templates/systemd-override.conf.epp
 delete mode 100644 templates/systemd-override.erb

diff --git a/manifests/params.pp b/manifests/params.pp
index dead45742e..ebbfd035de 100644
--- a/manifests/params.pp
+++ b/manifests/params.pp
@@ -18,7 +18,6 @@
   $service_manage               = true
   $service_restart_on_change    = true
   $service_provider             = $postgresql::globals::service_provider
-  $systemd_drop_in_ensure       = 'present'
   $manage_pg_hba_conf           = pick($manage_pg_hba_conf, true)
   $manage_pg_ident_conf         = pick($manage_pg_ident_conf, true)
   $manage_recovery_conf         = pick($manage_recovery_conf, false)
diff --git a/manifests/server.pp b/manifests/server.pp
index d1a6f7a1ca..3271d24304 100644
--- a/manifests/server.pp
+++ b/manifests/server.pp
@@ -15,7 +15,6 @@
 # @param service_provider Overrides the default PostgreSQL service provider.
 # @param service_reload Overrides the default reload command for your PostgreSQL service.
 # @param service_status Overrides the default status check command for your PostgreSQL service.
-# @param systemd_drop_in_ensure sets the Systemd drop-in file to present or absent
 # @param default_database Specifies the name of the default database to connect with. On most systems this is 'postgres'.
 # @param default_connect_settings Specifies a hash of environment variables used when connecting to a remote server. Becomes the default for other defined types, such as postgresql::server::role.
 #
@@ -104,7 +103,6 @@
   $service_provider                                = $postgresql::params::service_provider,
   $service_reload                                  = $postgresql::params::service_reload,
   $service_status                                  = $postgresql::params::service_status,
-  Enum[present, absent] $systemd_drop_in_ensure    = $postgresql::params::systemd_drop_in_ensure,
   $default_database                                = $postgresql::params::default_database,
   $default_connect_settings                        = $postgresql::globals::default_connect_settings,
   $listen_addresses                                = $postgresql::params::listen_addresses,
diff --git a/manifests/server/instance/config.pp b/manifests/server/instance/config.pp
index 965584b393..d6ef93259e 100644
--- a/manifests/server/instance/config.pp
+++ b/manifests/server/instance/config.pp
@@ -29,7 +29,6 @@
 # @param logdir PostgreSQL log directory
 # @param service_name Overrides the default PostgreSQL service name.
 # @param service_enable Enable the PostgreSQL service
-# @param systemd_drop_in_ensure sets the Systemd drop-in file to present or absent
 # @param log_line_prefix PostgreSQL log line prefix
 # @param timezone Set timezone for the PostgreSQL instance
 # @param extra_systemd_config Adds extra config to systemd config file, can for instance be used to add extra openfiles. This can be a multi line string
@@ -58,7 +57,6 @@
   $logdir                                          = $postgresql::server::logdir,
   $service_name                                    = $postgresql::server::service_name,
   $service_enable                                  = $postgresql::server::service_enable,
-  Enum[present, absent] $systemd_drop_in_ensure    = $postgresql::server::systemd_drop_in_ensure,
   $log_line_prefix                                 = $postgresql::server::log_line_prefix,
   $timezone                                        = $postgresql::server::timezone,
   $password_encryption                             = $postgresql::server::password_encryption,
diff --git a/manifests/server/instance/systemd.pp b/manifests/server/instance/systemd.pp
index be4c128dae..9d7302882f 100644
--- a/manifests/server/instance/systemd.pp
+++ b/manifests/server/instance/systemd.pp
@@ -19,7 +19,12 @@
     unit    => "${service_name}.service",
     owner   => 'root',
     group   => 'root',
-    content => template('postgresql/systemd-override.erb'),
+    content => epp('postgresql/systemd-override.conf.epp', {
+        port                 => $port,
+        datadir              => $datadir,
+        extra_systemd_config => $extra_systemd_config,
+      }
+    ),
     notify  => Class['postgresql::server::service'],
     before  => Class['postgresql::server::reload'],
   }
diff --git a/manifests/server/pg_hba_rule.pp b/manifests/server/pg_hba_rule.pp
index 35b506982a..20e2235cc9 100644
--- a/manifests/server/pg_hba_rule.pp
+++ b/manifests/server/pg_hba_rule.pp
@@ -1,3 +1,4 @@
+# lint:ignore:140chars
 # @summary This resource manages an individual rule that applies to the file defined in target.
 #
 # @param type Sets the type of rule.
@@ -10,13 +11,14 @@
 # @param order Sets an order for placing the rule in pg_hba.conf. This can be either a string or an integer. If it is an integer, it will be converted to a string by zero-padding it to three digits. E.g. 42 will be zero-padded to the string '042'. The pg_hba_rule fragments are sorted using the alpha sorting order. Default value: 150.
 # @param target Provides the target for the rule, and is generally an internal only property. Use with caution.
 # @param postgresql_version Manages pg_hba.conf without managing the entire PostgreSQL instance.
+# lint:endignore:140chars
 define postgresql::server::pg_hba_rule (
   Postgresql::Pg_hba_rule_type $type,
-  String $database,
-  String $user,
-  String $auth_method,
+  String[1] $database,
+  String[1] $user,
+  String[1] $auth_method,
   Optional[Postgresql::Pg_hba_rule_address] $address = undef,
-  String $description             = 'none',
+  String[1] $description          = 'none',
   Optional[String] $auth_option   = undef,
   Variant[String, Integer] $order = 150,
 
@@ -34,7 +36,7 @@
   }
 
   if $manage_pg_hba_conf == false {
-    fail('postgresql::server::manage_pg_hba_conf has been disabled, so this resource is now unused and redundant, either enable that option or remove this resource from your manifests')
+    fail('postgresql::server::manage_pg_hba_conf has been disabled, so this resource is now unused and redundant, either enable that option or remove this resource from your manifests') # lint:ignore:140chars
   } else {
     if($type =~ /^host/ and $address == undef) {
       fail('You must specify an address property when type is host based')
@@ -48,7 +50,7 @@
     }
 
     $allowed_auth_methods = $postgresql_version ? {
-      '10'  => ['trust', 'reject', 'scram-sha-256', 'md5', 'password', 'gss', 'sspi', 'ident', 'peer', 'ldap', 'radius', 'cert', 'pam', 'bsd'],
+      '10'  => ['trust', 'reject', 'scram-sha-256', 'md5', 'password', 'gss', 'sspi', 'ident', 'peer', 'ldap', 'radius', 'cert', 'pam', 'bsd'], # lint:ignore:140chars
       '9.6' => ['trust', 'reject', 'md5', 'password', 'gss', 'sspi', 'ident', 'peer', 'ldap', 'radius', 'cert', 'pam', 'bsd'],
       '9.5' => ['trust', 'reject', 'md5', 'password', 'gss', 'sspi', 'ident', 'peer', 'ldap', 'radius', 'cert', 'pam'],
       '9.4' => ['trust', 'reject', 'md5', 'password', 'gss', 'sspi', 'ident', 'peer', 'ldap', 'radius', 'cert', 'pam'],
@@ -60,7 +62,7 @@
       '8.3' => ['trust', 'reject', 'md5', 'crypt', 'password', 'gss', 'sspi', 'krb5', 'ident', 'ldap', 'pam'],
       '8.2' => ['trust', 'reject', 'md5', 'crypt', 'password', 'krb5', 'ident', 'ldap', 'pam'],
       '8.1' => ['trust', 'reject', 'md5', 'crypt', 'password', 'krb5', 'ident', 'pam'],
-      default => ['trust', 'reject', 'scram-sha-256', 'md5', 'password', 'gss', 'sspi', 'krb5', 'ident', 'peer', 'ldap', 'radius', 'cert', 'pam', 'crypt', 'bsd']
+      default => ['trust', 'reject', 'scram-sha-256', 'md5', 'password', 'gss', 'sspi', 'krb5', 'ident', 'peer', 'ldap', 'radius', 'cert', 'pam', 'crypt', 'bsd'] # lint:ignore:140chars
     }
 
     assert_type(Enum[$allowed_auth_methods], $auth_method)
@@ -69,7 +71,18 @@
     $fragname = "pg_hba_rule_${name}"
     concat::fragment { $fragname:
       target  => $target,
-      content => template('postgresql/pg_hba_rule.conf'),
+      content => epp('postgresql/pg_hba_rule.conf.epp', {
+          name        => $name,
+          description => $description,
+          order       => $order,
+          type        => $type,
+          database    => $database,
+          user        => $user,
+          address     => $address,
+          auth_method => $auth_method,
+          auth_option => $auth_option,
+        }
+      ),
       order   => $_order,
     }
   }
diff --git a/manifests/server/pg_ident_rule.pp b/manifests/server/pg_ident_rule.pp
index bf15047164..6bd18af18f 100644
--- a/manifests/server/pg_ident_rule.pp
+++ b/manifests/server/pg_ident_rule.pp
@@ -2,8 +2,12 @@
 #
 # @param map_name Sets the name of the user map that is used to refer to this mapping in pg_hba.conf.
 # @param system_username Specifies the operating system user name (the user name used to connect to the database).
-# @param database_username Specifies the user name of the database user. The system_username is mapped to this user name.
-# @param description Sets a longer description for this rule if required. This description is placed in the comments above the rule in pg_ident.conf. Default value: 'none'.
+# @param database_username
+#   Specifies the user name of the database user.
+#   The system_username is mapped to this user name.
+# @param description
+#   Sets a longer description for this rule if required.
+#   This description is placed in the comments above the rule in pg_ident.conf.
 # @param order Defines an order for placing the mapping in pg_ident.conf. Default value: 150.
 # @param target Provides the target for the rule and is generally an internal only property. Use with caution.
 define postgresql::server::pg_ident_rule (
@@ -18,13 +22,21 @@
   $target      = $postgresql::server::pg_ident_conf_path
 ) {
   if $postgresql::server::manage_pg_ident_conf == false {
-    fail('postgresql::server::manage_pg_ident_conf has been disabled, so this resource is now unused and redundant, either enable that option or remove this resource from your manifests')
+    fail('postgresql::server::manage_pg_ident_conf has been disabled, so this resource is now unused and redundant, either enable that option or remove this resource from your manifests') # lint:ignore:140chars
   } else {
     # Create a rule fragment
     $fragname = "pg_ident_rule_${name}"
     concat::fragment { $fragname:
       target  => $target,
-      content => template('postgresql/pg_ident_rule.conf'),
+      content => epp('postgresql/pg_ident_rule.conf.epp', {
+          name              => $name,
+          description       => $description,
+          order             => $order,
+          map_name          => $map_name,
+          system_username   => $system_username,
+          database_username => $database_username,
+        }
+      ),
       order   => $order,
     }
   }
diff --git a/manifests/server/recovery.pp b/manifests/server/recovery.pp
index 47f25f1ef5..40f0934251 100644
--- a/manifests/server/recovery.pp
+++ b/manifests/server/recovery.pp
@@ -1,3 +1,4 @@
+# lint:ignore:140chars
 # @summary This resource manages the parameters that applies to the recovery.conf template.
 #
 # @note
@@ -22,6 +23,7 @@
 # @param trigger_file Specifies a trigger file whose presence ends recovery in the standby.
 # @param recovery_min_apply_delay This parameter allows you to delay recovery by a fixed period of time, measured in milliseconds if no unit is specified.
 # @param target Provides the target for the rule, and is generally an internal only property. Use with caution.
+# lint:endignore:140chars
 define postgresql::server::recovery (
   $restore_command                = undef,
   $archive_cleanup_command        = undef,
@@ -41,14 +43,14 @@
   $target                         = $postgresql::server::recovery_conf_path
 ) {
   if $postgresql::server::manage_recovery_conf == false {
-    fail('postgresql::server::manage_recovery_conf has been disabled, so this resource is now unused and redundant, either enable that option or remove this resource from your manifests')
+    fail('postgresql::server::manage_recovery_conf has been disabled, so this resource is now unused and redundant, either enable that option or remove this resource from your manifests') # lint:ignore:140chars
   } else {
     if($restore_command == undef and $archive_cleanup_command == undef and $recovery_end_command == undef
       and $recovery_target_name == undef and $recovery_target_time == undef and $recovery_target_xid == undef
       and $recovery_target_inclusive == undef and $recovery_target == undef and $recovery_target_timeline == undef
       and $pause_at_recovery_target == undef and $standby_mode == undef and $primary_conninfo == undef
     and $primary_slot_name == undef and $trigger_file == undef and $recovery_min_apply_delay == undef) {
-      fail('postgresql::server::recovery use this resource but do not pass a parameter will avoid creating the recovery.conf, because it makes no sense.')
+      fail('postgresql::server::recovery use this resource but do not pass a parameter will avoid creating the recovery.conf, because it makes no sense.') # lint:ignore:140chars
     }
 
     concat { $target:
@@ -63,7 +65,24 @@
     # Create the recovery.conf content
     concat::fragment { "${name}-recovery.conf":
       target  => $target,
-      content => template('postgresql/recovery.conf.erb'),
+      content => epp('postgresql/recovery.conf.epp', {
+          restore_command           => $restore_command,
+          archive_cleanup_command   => $archive_cleanup_command,
+          recovery_end_command      => $recovery_end_command,
+          recovery_target_name      => $recovery_target_name,
+          recovery_target_time      => $recovery_target_time,
+          recovery_target_xid       => $recovery_target_xid,
+          recovery_target_inclusive => $recovery_target_inclusive,
+          recovery_target           => $recovery_target,
+          recovery_target_timeline  => $recovery_target_timeline,
+          pause_at_recovery_target  => $pause_at_recovery_target,
+          standby_mode              => $standby_mode,
+          primary_conninfo          => $primary_conninfo,
+          primary_slot_name         => $primary_slot_name,
+          trigger_file              => $trigger_file,
+          recovery_min_apply_delay  => $recovery_min_apply_delay,
+        }
+      ),
     }
   }
 }
diff --git a/templates/pg_dump.sh.epp b/templates/pg_dump.sh.epp
index 2c67170ad7..c5b40db492 100644
--- a/templates/pg_dump.sh.epp
+++ b/templates/pg_dump.sh.epp
@@ -1,3 +1,16 @@
+<%- |
+  Boolean                                  $compress,
+  Array                                    $databases,
+  Optional[String[1]]                      $db_user,
+  Boolean                                  $delete_before_dump,
+  String[1]                                $dir,
+  Enum['plain','custom','directory','tar'] $format,
+  Array                                    $optional_args,
+  Optional[String[1]]                      $post_script,
+  Optional[String[1]]                      $pre_script,
+  Integer[0]                               $rotate,
+  Stdlib::Absolutepath                     $success_file_path,
+| -%>
 <%- if $facts['kernel'] == 'Linux' { -%>
 #!/bin/bash
 <%- } else { -%>
diff --git a/templates/pg_hba_rule.conf b/templates/pg_hba_rule.conf
deleted file mode 100644
index af54db5b2a..0000000000
--- a/templates/pg_hba_rule.conf
+++ /dev/null
@@ -1,5 +0,0 @@
-
-# Rule Name: <%=@name%>
-# Description: <%=@description%>
-# Order: <%=@order%>
-<%=@type%>	<%=@database%>	<%=@user%>	<%=@address%>	<%=@auth_method%>	<%=@auth_option%>
diff --git a/templates/pg_hba_rule.conf.epp b/templates/pg_hba_rule.conf.epp
new file mode 100644
index 0000000000..8d92ac4c37
--- /dev/null
+++ b/templates/pg_hba_rule.conf.epp
@@ -0,0 +1,15 @@
+<%- |
+  String[1]                                 $name,
+  String[1]                                 $description,
+  Variant[String, Integer]                  $order,
+  Postgresql::Pg_hba_rule_type              $type,
+  String[1]                                 $database,
+  String[1]                                 $user,
+  Optional[Postgresql::Pg_hba_rule_address] $address,
+  String[1]                                 $auth_method,
+  Optional[String]                          $auth_option,
+| -%>
+# Rule Name: <%= $name %>
+# Description: <%= $description %>
+# Order: <%= $order %>
+<%= $type %>	<%= $database %>	<%= $user %>	<%= $address %>	<%= $auth_method %>	<%= $auth_option %>
diff --git a/templates/pg_ident_rule.conf b/templates/pg_ident_rule.conf
deleted file mode 100644
index 238c6e96f3..0000000000
--- a/templates/pg_ident_rule.conf
+++ /dev/null
@@ -1,5 +0,0 @@
-
-# Rule Name: <%=@name%>
-# Description: <%=@description%>
-# Order: <%=@order%>
-<%=@map_name%>	<%=@system_username%>	<%=@database_username%>
diff --git a/templates/pg_ident_rule.conf.epp b/templates/pg_ident_rule.conf.epp
new file mode 100644
index 0000000000..ba7ec2f855
--- /dev/null
+++ b/templates/pg_ident_rule.conf.epp
@@ -0,0 +1,12 @@
+<%- |
+  String[1] $name,
+  String[1] $description,
+  String[1] $order,
+  String[1] $map_name,
+  String[1] $system_username,
+  String[1] $database_username,
+| -%>
+# Rule Name: <%= $name %>
+# Description: <%= $description %>
+# Order: <%= $order %>
+<%= $map_name %>	<%= $system_username %>	<%= $database_username %>
diff --git a/templates/recovery.conf.epp b/templates/recovery.conf.epp
new file mode 100644
index 0000000000..ebc28e1468
--- /dev/null
+++ b/templates/recovery.conf.epp
@@ -0,0 +1,64 @@
+<%- |
+  Optional[String]    $restore_command,
+  Optional[String[1]] $archive_cleanup_command,
+  Optional[String[1]] $recovery_end_command,
+  Optional[String[1]] $recovery_target_name,
+  Optional[String[1]] $recovery_target_time,
+  Optional[String[1]] $recovery_target_xid,
+  Optional[Boolean]   $recovery_target_inclusive,
+  Optional[String[1]] $recovery_target,
+  Optional[String[1]] $recovery_target_timeline,
+  Optional[Boolean]   $pause_at_recovery_target,
+  Optional[String[1]] $standby_mode,
+  Optional[String[1]] $primary_conninfo,
+  Optional[String[1]] $primary_slot_name,
+  Optional[String[1]] $trigger_file,
+  Optional[Integer]   $recovery_min_apply_delay,
+| -%>
+<% if $restore_command { -%>
+restore_command = '<%= $restore_command %>'
+<% } -%>
+<% if $archive_cleanup_command { -%>
+archive_cleanup_command = '<%= $archive_cleanup_command %>'
+<% } -%>
+<% if $recovery_end_command { -%>
+recovery_end_command = '<%= $recovery_end_command %>'
+<% } -%>
+
+<% if $recovery_target_name { -%>
+recovery_target_name = '<%= $recovery_target_name %>'
+<% } -%>
+<% if $recovery_target_time { -%>
+recovery_target_time = '<%= $recovery_target_time %>'
+<% } -%>
+<% if $recovery_target_xid { -%>
+recovery_target_xid = '<%= $recovery_target_xid %>'
+<% } -%>
+<% if $recovery_target_inclusive { -%>
+recovery_target_inclusive = <%= $recovery_target_inclusive %>
+<% } -%>
+<% if $recovery_target { -%>
+recovery_target = '<%= $recovery_target %>'
+<% } -%>
+<% if $recovery_target_timeline { -%>
+recovery_target_timeline = '<%= $recovery_target_timeline %>'
+<% } -%>
+<% if $pause_at_recovery_target { -%>
+pause_at_recovery_target = <%= $pause_at_recovery_target %>
+<% } -%>
+
+<% if $standby_mode { -%>
+standby_mode = <%= $standby_mode %>
+<% } -%>
+<% if $primary_conninfo { -%>
+primary_conninfo = '<%= $primary_conninfo  %>'
+<% } -%>
+<% if $primary_slot_name { -%>
+primary_slot_name = '<%= $primary_slot_name %>'
+<% } -%>
+<% if $trigger_file { -%>
+trigger_file = '<%= $trigger_file %>'
+<% } -%>
+<% if $recovery_min_apply_delay { -%>
+recovery_min_apply_delay = <%= $recovery_min_apply_delay %>
+<% } -%>
diff --git a/templates/recovery.conf.erb b/templates/recovery.conf.erb
deleted file mode 100644
index a678faee0d..0000000000
--- a/templates/recovery.conf.erb
+++ /dev/null
@@ -1,47 +0,0 @@
-<% if @restore_command -%>
-restore_command = '<%= @restore_command %>'
-<% end -%>
-<% if @archive_cleanup_command -%>
-archive_cleanup_command = '<%= @archive_cleanup_command %>'
-<% end -%>
-<% if @recovery_end_command -%>
-recovery_end_command = '<%= @recovery_end_command %>'
-<% end -%>
-
-<% if @recovery_target_name -%>
-recovery_target_name = '<%= @recovery_target_name %>'
-<% end -%>
-<% if @recovery_target_time -%>
-recovery_target_time = '<%= @recovery_target_time %>'
-<% end -%>
-<% if @recovery_target_xid -%>
-recovery_target_xid = '<%= @recovery_target_xid %>'
-<% end -%>
-<% if @recovery_target_inclusive -%>
-recovery_target_inclusive = <%= @recovery_target_inclusive %>
-<% end -%>
-<% if @recovery_target -%>
-recovery_target = '<%= @recovery_target %>'
-<% end -%>
-<% if @recovery_target_timeline -%>
-recovery_target_timeline = '<%= @recovery_target_timeline %>'
-<% end -%>
-<% if @pause_at_recovery_target -%>
-pause_at_recovery_target = <%= @pause_at_recovery_target %>
-<% end -%>
-
-<% if @standby_mode -%>
-standby_mode = <%= @standby_mode %>
-<% end -%>
-<% if @primary_conninfo -%>
-primary_conninfo = '<%= @primary_conninfo  %>'
-<% end -%>
-<% if @primary_slot_name -%>
-primary_slot_name = '<%= @primary_slot_name %>'
-<% end -%>
-<% if @trigger_file -%>
-trigger_file = '<%= @trigger_file %>'
-<% end -%>
-<% if @recovery_min_apply_delay -%>
-recovery_min_apply_delay = <%= @recovery_min_apply_delay %>
-<% end -%>
diff --git a/templates/systemd-override.conf.epp b/templates/systemd-override.conf.epp
new file mode 100644
index 0000000000..830c3007d5
--- /dev/null
+++ b/templates/systemd-override.conf.epp
@@ -0,0 +1,15 @@
+<%- |
+  Variant[String[1], Stdlib::Port] $port,
+  Stdlib::Absolutepath             $datadir,
+  Optional[String[1]]              $extra_systemd_config,
+| -%>
+[Service]
+Environment=PGPORT=<%= $port %>
+<%- if $facts['os']['family'] == 'Gentoo' { -%>
+Environment=DATA_DIR=<%= $datadir %>
+<%- } else { -%>
+Environment=PGDATA=<%= $datadir %>
+<%- } -%>
+<% if $extra_systemd_config { -%>
+<%= $extra_systemd_config %>
+<% } -%>
diff --git a/templates/systemd-override.erb b/templates/systemd-override.erb
deleted file mode 100644
index 491697636c..0000000000
--- a/templates/systemd-override.erb
+++ /dev/null
@@ -1,8 +0,0 @@
-[Service]
-Environment=PGPORT=<%= @port %>
-<%- if @os['family'] == 'Gentoo' -%>
-Environment=DATA_DIR=<%= @datadir %>
-<%- else -%>
-Environment=PGDATA=<%= @datadir %>
-<%- end -%>
-<%= @extra_systemd_config %>