blob: 10bafc8f55ca0d6e55b3a2f7acdb10eca0636f9a (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
|
#!/bin/sh
# PostgreSQL jails need allow.sysvipc=1.
: ${postgres_max_connections:='128'}
: ${postgres_shared_buffers:="$(( memsize / 2 ))"}
: ${postgres_work_mem:="$(( memsize / 4 / ${postgres_max_connections} ))"}
: ${postgres_maintenance_work_mem:="$(( memsize / 20 ))"}
: ${postgres_temp_buffers:="$((32 * 1024 * 1024))"}
: ${postgres_effective_cache_size:="$(( memsize * 3 / 4 ))"}
: ${postgres_ldap_username:='s-postgresql'}
: ${postgres_ldap_password:='changeme'}
postgres_dn="uid=${postgres_ldap_username},${robots_basedn}"
postgres_user=postgres
postgres_home=/var/db/postgres
postgres_data_dir="${postgres_home}/data${postgresql_version}"
postgres_tls_cert="${postgres_home}/postgres.crt"
postgres_tls_key="${postgres_home}/postgres.key"
postgres_keytab="${keytab_dir}/postgres.keytab"
pkg install -y postgresql${postgresql_version}-server
# Create ZFS dataset for postgresql data.
create_dataset \
-o "mountpoint=${postgres_home}" \
-o recordsize=16k \
-o primarycache=metadata \
-o atime=off \
"${state_dataset}/postgres"
install_directory -m 0755 -o "$postgres_user" -g "$postgres_user" "$postgres_home"
# Initialize the database.
sysrc -v postgresql_enable=YES
[ -d "${postgres_data_dir}" ] || service postgresql initdb
# Create service principal and keytab.
add_principal -nokey -x "containerdn=${services_basedn}" "postgres/${fqdn}"
ktadd -k "$postgres_keytab" "postgres/${fqdn}"
chgrp "$postgres_user" "$postgres_keytab"
chmod 640 "$postgres_keytab"
postgres_uid=$(id -u "$postgres_user")
install_directory -o "$postgres_user" -m 0700 "/var/krb5/user/${postgres_uid}"
ln -snfv "$postgres_keytab" "/var/krb5/user/${postgres_uid}/keytab"
# Create PostgreSQL LDAP user account.
ldap_add "$postgres_dn" <<EOF
objectClass: account
objectClass: simpleSecurityObject
uid: ${postgres_ldap_username}
userPassword: {SSHA-512}
EOF
# Set LDAP password for PostgreSQL user.
ldap_passwd "$postgres_dn" "$postgres_ldap_password"
# Copy TLS certificate for postgres.
install_certificate -m 0644 -o root -g "$postgres_user" postgres "$postgres_tls_cert"
install_certificate_key -m 0640 -o root -g "$postgres_user" postgres "$postgres_tls_key"
# Generate postgresql configuration.
install_template -m 0600 -o "$postgres_user" -g "$postgres_user" \
"${postgres_data_dir}/postgresql.conf" \
"${postgres_data_dir}/pg_hba.conf"
install_file -m 0600 -o "$postgres_user" -g "$postgres_user" \
"${postgres_data_dir}/pg_ident.conf"
# The postgresql rc script seems to hold onto open descriptors, which causes
# the parent boxconf SSH process to never close.
echo 'Restarting postgresql.'
service postgresql restart > /dev/null 2>&1 < /dev/null || die 'failed to start postgresql'
# Create boxconf admin user.
psql --quiet --no-align --echo-all --tuples-only --no-password --username=postgres --dbname=postgres -c \
"DO
\$$
BEGIN
IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${boxconf_username}') THEN
CREATE ROLE \"${boxconf_username}\" WITH LOGIN SUPERUSER;
END IF;
END
\$$"
|
