Passage à postgresql 9.4 et monitor de postgres sur odlyd et soyouz
This commit is contained in:
Gabriel Detraz
parent
a6d5273da6
commit
19e062e3ce
4 changed files with 6 additions and 326 deletions
|
|
@ -23,6 +23,7 @@
|
|||
<Group name="connection-main"/>
|
||||
<Group name="firewall"/>
|
||||
<Group name="portail-captif"/>
|
||||
<Group name="pgsql-server"/>
|
||||
</Group>
|
||||
|
||||
|
||||
|
|
@ -221,7 +222,6 @@
|
|||
<Group name="db-replicat-test"/>
|
||||
<Group name="secrets-acl" />
|
||||
<Group name="intranet2-dev" />
|
||||
<Group name="pgsql-server-jessie"/>
|
||||
<Group name="pgsql-server-test"/>
|
||||
<Bundle name="fortunes"/>
|
||||
</Group>
|
||||
|
|
@ -260,8 +260,7 @@
|
|||
<Group name="non-free"/>
|
||||
<Group name="crans-jessie"/>
|
||||
<Group name="rsyslog-server"/>
|
||||
<Group name="pgsql-server"/>
|
||||
<Group name="pgsql-server-wheezy"/>
|
||||
<Group name="pgsql-server-main"/>
|
||||
<Group name="sqlgrey-localdb"/>
|
||||
<Group name="db-replicat"/>
|
||||
<Group name="generate"/>
|
||||
|
|
@ -1381,15 +1380,13 @@
|
|||
<!-- Autres serveurs que thot et vo-->
|
||||
</Group>
|
||||
|
||||
<Group name="pgsql-server-wheezy">
|
||||
<Bundle name="postgresql-9.1"/>
|
||||
</Group>
|
||||
|
||||
<Group name="pgsql-server-jessie">
|
||||
<Group name="pgsql-server-main">
|
||||
<Group name="pgsql-server"/>
|
||||
<Bundle name="postgresql-9.4"/>
|
||||
</Group>
|
||||
|
||||
<Group name="pgsql-server-test">
|
||||
<Group name="pgsql-server"/>
|
||||
<!-- Acl différents : vo-->
|
||||
</Group>
|
||||
|
||||
|
|
|
|||
|
|
@ -250,7 +250,7 @@ service("openvpn-freebox",
|
|||
init="openvpn",
|
||||
extra=["depends on openvpn-odlyd"])
|
||||
|
||||
pg_version = '9.1'
|
||||
pg_version = '9.4'
|
||||
service("pgsql-server",
|
||||
name="postgresql",
|
||||
init="postgresql",
|
||||
|
|
|
|||
|
|
@ -1,185 +0,0 @@
|
|||
info["owner"] = "postgres"
|
||||
info["group"] = "postgres"
|
||||
info["mode"] = 0640
|
||||
|
||||
include("ldap_conn")
|
||||
|
||||
conn = ldap_conn
|
||||
|
||||
comment_start = "#"
|
||||
header("Gestion du mapping avec les base de données")
|
||||
|
||||
# Ip des serveurs
|
||||
def ipv4(serveur):
|
||||
return str(conn.search(u'host=%s.adm.crans.org' % serveur)[0]['ipHostNumber'][0])
|
||||
def ipv6(serveur):
|
||||
return str(conn.search(u'host=%s.adm.crans.org' % serveur)[0]['ip6HostNumber'][0])
|
||||
|
||||
serveurs = ['o2','zamok','asterisk','kenobi','owl','roundcube','horde','mediadrop','titanic','soyouz','redisdead','owncloud']
|
||||
|
||||
ip_serveurs = dict()
|
||||
for serv in serveurs:
|
||||
ip_serveurs['ipv4'+serv] = ipv4(serv)
|
||||
ip_serveurs['ipv6'+serv] = ipv6(serv)
|
||||
|
||||
out("""# PostgreSQL Client Authentication Configuration File
|
||||
# ===================================================
|
||||
#
|
||||
# Refer to the "Client Authentication" section in the PostgreSQL
|
||||
# documentation for a complete description of this file. A short
|
||||
# synopsis follows.
|
||||
#
|
||||
# This file controls: which hosts are allowed to connect, how clients
|
||||
# are authenticated, which PostgreSQL user names they can use, which
|
||||
# databases they can access. Records take one of these forms:
|
||||
#
|
||||
# local DATABASE USER METHOD [OPTIONS]
|
||||
# host DATABASE USER ADDRESS METHOD [OPTIONS]
|
||||
# hostssl DATABASE USER ADDRESS METHOD [OPTIONS]
|
||||
# hostnossl DATABASE USER ADDRESS METHOD [OPTIONS]
|
||||
#
|
||||
# (The uppercase items must be replaced by actual values.)
|
||||
#
|
||||
# The first field is the connection type: "local" is a Unix-domain
|
||||
# socket, "host" is either a plain or SSL-encrypted TCP/IP socket,
|
||||
# "hostssl" is an SSL-encrypted TCP/IP socket, and "hostnossl" is a
|
||||
# plain TCP/IP socket.
|
||||
#
|
||||
# DATABASE can be "all", "sameuser", "samerole", "replication", a
|
||||
# database name, or a comma-separated list thereof. The "all"
|
||||
# keyword does not match "replication". Access to replication
|
||||
# must be enabled in a separate record (see example below).
|
||||
#
|
||||
# USER can be "all", a user name, a group name prefixed with "+", or a
|
||||
# comma-separated list thereof. In both the DATABASE and USER fields
|
||||
# you can also write a file name prefixed with "@" to include names
|
||||
# from a separate file.
|
||||
#
|
||||
# ADDRESS specifies the set of hosts the record matches. It can be a
|
||||
# host name, or it is made up of an IP address and a CIDR mask that is
|
||||
# an integer (between 0 and 32 (IPv4) or 128 (IPv6) inclusive) that
|
||||
# specifies the number of significant bits in the mask. A host name
|
||||
# that starts with a dot (.) matches a suffix of the actual host name.
|
||||
# Alternatively, you can write an IP address and netmask in separate
|
||||
# columns to specify the set of hosts. Instead of a CIDR-address, you
|
||||
# can write "samehost" to match any of the server's own IP addresses,
|
||||
# or "samenet" to match any address in any subnet that the server is
|
||||
# directly connected to.
|
||||
#
|
||||
# METHOD can be "trust", "reject", "md5", "password", "gss", "sspi",
|
||||
# "krb5", "ident", "peer", "pam", "ldap", "radius" or "cert". Note that
|
||||
# "password" sends passwords in clear text; "md5" is preferred since
|
||||
# it sends encrypted passwords.
|
||||
#
|
||||
# OPTIONS are a set of options for the authentication in the format
|
||||
# NAME=VALUE. The available options depend on the different
|
||||
# authentication methods -- refer to the "Client Authentication"
|
||||
# section in the documentation for a list of which options are
|
||||
# available for which authentication methods.
|
||||
#
|
||||
# Database and user names containing spaces, commas, quotes and other
|
||||
# special characters must be quoted. Quoting one of the keywords
|
||||
# "all", "sameuser", "samerole" or "replication" makes the name lose
|
||||
# its special character, and just match a database or username with
|
||||
# that name.
|
||||
#
|
||||
# This file is read on server startup and when the postmaster receives
|
||||
# a SIGHUP signal. If you edit the file on a running system, you have
|
||||
# to SIGHUP the postmaster for the changes to take effect. You can
|
||||
# use "pg_ctl reload" to do that.
|
||||
|
||||
#Attention; do not REMOVE this line
|
||||
# Database administrative login by Unix domain socket
|
||||
local all postgres peer
|
||||
""")
|
||||
|
||||
if has("pgsql-server-test"):
|
||||
out("""host all all 127.0.0.1/32 trust
|
||||
host django all 127.0.0.1/32 ident map=intranet""")
|
||||
|
||||
else:
|
||||
out("""# TYPE DATABASE USER ADDRESS METHOD
|
||||
host Syslog rsyslog 127.0.0.1/32 md5
|
||||
|
||||
#Intranet : venant d'o2, on autorise l'ecriture""")
|
||||
|
||||
out("""host django crans """ + ip_serveurs['ipv4o2'] + """/32 ident map=django""")
|
||||
out("""host django crans """ + ip_serveurs['ipv6o2'] + """/128 ident map=django""")
|
||||
|
||||
out("""
|
||||
# Asterisk a besoin d'écrire depuis asterisk et depuis zamok""")
|
||||
|
||||
out("""host django crans """ + ip_serveurs['ipv4asterisk'] + """/32 ident map=django""")
|
||||
out("""host django crans """ + ip_serveurs['ipv4zamok'] + """/32 ident map=django""")
|
||||
|
||||
out("""
|
||||
# Tout le reste sur adm est django_ro et crans_ro, pas besoin d'écrire""")
|
||||
|
||||
out("""host django crans_ro 10.231.136.0/24 ident map=django_ro""")
|
||||
out("""host django crans_ro 2a01:240:fe3d:c804::/64 ident map=django_ro""")
|
||||
|
||||
out("""
|
||||
# kenobi""")
|
||||
out("""host etherpad crans """ + ip_serveurs['ipv4kenobi'] + """/32 ident map=etherpad""")
|
||||
|
||||
out("""
|
||||
# On autorise tout pour owl TODO : à proprifier""")
|
||||
out("""host roundcube roundcube """ + ip_serveurs['ipv4owl'] + """/32 ident map=webmail""")
|
||||
out("""host roundcube roundcube """ + ip_serveurs['ipv6owl'] + """/128 ident map=webmail""")
|
||||
out("""host all all """ + ip_serveurs['ipv4owl'] + """/32 ident""")
|
||||
out("""host all all """ + ip_serveurs['ipv6owl'] + """/128 ident""")
|
||||
|
||||
out("""
|
||||
# Roundcube a accès à sa base""")
|
||||
out("""host roundcube roundcube """ + ip_serveurs['ipv4roundcube'] + """/32 ident map=webmail""")
|
||||
out("""host roundcube roundcube """ + ip_serveurs['ipv6roundcube'] + """/128 ident map=webmail""")
|
||||
|
||||
out("""
|
||||
# sql grey pour zamok""")
|
||||
out("""host sqlgrey sqlgrey """ + ip_serveurs['ipv4zamok'] + """/32 ident""")
|
||||
out("""host sqlgrey sqlgrey """ + ip_serveurs['ipv6zamok'] + """/128 ident""")
|
||||
|
||||
out("""
|
||||
#Base de horde pour root et www-data""")
|
||||
out("""host horde5 www-data """ + ip_serveurs['ipv4horde'] + """/32 ident map=horde""")
|
||||
out("""host horde5 www-data """ + ip_serveurs['ipv6horde'] + """/128 ident map=horde""")
|
||||
out("""host horde5 root """ + ip_serveurs['ipv4horde'] + """/32 ident map=horde""")
|
||||
out("""host horde5 root """ + ip_serveurs['ipv6horde'] + """/128 ident map=horde""")
|
||||
|
||||
|
||||
out("""
|
||||
#mediadrop""")
|
||||
out("""host mediadrop mediadrop """ + ip_serveurs['ipv4mediadrop'] + """/32 ident map=mediadrop""")
|
||||
out("""host mediadrop mediadrop """ + ip_serveurs['ipv6mediadrop'] + """/128 ident map=mediadrop""")
|
||||
|
||||
out("""
|
||||
# SQLgrey depuis titanic""")
|
||||
out("""host sqlgrey sqlgrey """ + ip_serveurs['ipv4titanic'] + """/32 ident""")
|
||||
out("""host sqlgrey sqlgrey """ + ip_serveurs['ipv6titanic'] + """/128 ident""")
|
||||
|
||||
out("""
|
||||
# SQLgrey depuis soyouz""")
|
||||
out("""host sqlgrey sqlgrey """ + ip_serveurs['ipv4soyouz'] + """/32 ident""")
|
||||
|
||||
out("""
|
||||
# SQLgrey depuis redisdead""")
|
||||
out("""host sqlgrey sqlgrey """ + ip_serveurs['ipv4redisdead'] + """/32 ident""")
|
||||
out("""host sqlgrey sqlgrey """ + ip_serveurs['ipv6redisdead'] + """/128 ident""")
|
||||
|
||||
out("""
|
||||
# SQLgrey local""")
|
||||
out("""local sqlgrey sqlgrey ident map=sqlgrey""")
|
||||
|
||||
out("""
|
||||
# Base de correspondance mac_prises pour surveillance""")
|
||||
out("""host mac_prises crans 10.231.136.0/24 ident map=mac_prises""")
|
||||
out("""host mac_prises crans 2a01:240:fe3d:c804::/64 ident map=mac_prises""")
|
||||
out("""local mac_prises crans ident map=mac_prises""")
|
||||
|
||||
out("""
|
||||
#Base pour owncloud""")
|
||||
out("""host owncloud owncloud """ + ip_serveurs['ipv4owncloud'] + """/24 md5""")
|
||||
out("""host owncloud owncloud """ + ip_serveurs['ipv6owncloud'] + """/128 md5""")
|
||||
|
||||
|
||||
|
||||
|
|
@ -1,132 +0,0 @@
|
|||
info["owner"] = "postgres"
|
||||
info["group"] = "postgres"
|
||||
info["mode"] = 0640
|
||||
|
||||
|
||||
include("ldap_conn")
|
||||
|
||||
conn = ldap_conn
|
||||
|
||||
comment_start = "#"
|
||||
header("Gestion des acces ident pour les utilisateurs")
|
||||
|
||||
# Liste des nounous/apprentis
|
||||
adm_objects = conn.search(u'droits=nounou')
|
||||
nounous = [adm['uid'][0] for adm in adm_objects]
|
||||
apprentis_objects = conn.search(u'droits=apprenti')
|
||||
apprentis = [appr['uid'][0] for appr in apprentis_objects]
|
||||
|
||||
out("""#PostgreSQL User Name Maps
|
||||
# =========================
|
||||
#
|
||||
# Refer to the PostgreSQL documentation, chapter "Client
|
||||
# Authentication" for a complete description. A short synopsis
|
||||
# follows.
|
||||
#
|
||||
# This file controls PostgreSQL user name mapping. It maps external
|
||||
# user names to their corresponding PostgreSQL user names. Records
|
||||
# are of the form:
|
||||
#
|
||||
# MAPNAME SYSTEM-USERNAME PG-USERNAME
|
||||
#
|
||||
# (The uppercase quantities must be replaced by actual values.)
|
||||
#
|
||||
# MAPNAME is the (otherwise freely chosen) map name that was used in
|
||||
# pg_hba.conf. SYSTEM-USERNAME is the detected user name of the
|
||||
# client. PG-USERNAME is the requested PostgreSQL user name. The
|
||||
# existence of a record specifies that SYSTEM-USERNAME may connect as
|
||||
# PG-USERNAME.
|
||||
#
|
||||
# If SYSTEM-USERNAME starts with a slash (/), it will be treated as a
|
||||
# regular expression. Optionally this can contain a capture (a
|
||||
# parenthesized subexpression). The substring matching the capture
|
||||
# will be substituted for 1 (backslash-one) if present in
|
||||
# PG-USERNAME.
|
||||
#
|
||||
# Multiple maps may be specified in this file and used by pg_hba.conf.
|
||||
#
|
||||
# No map names are defined in the default configuration. If all
|
||||
# system user names and PostgreSQL user names are the same, you don't
|
||||
# need anything in this file.
|
||||
#
|
||||
# This file is read on server startup and when the postmaster receives
|
||||
# a SIGHUP signal. If you edit the file on a running system, you have
|
||||
# to SIGHUP the postmaster for the changes to take effect. You can
|
||||
# use "pg_ctl reload" to do that.
|
||||
|
||||
# Put your actual configuration here""")
|
||||
|
||||
if has("pgsql-server-test"):
|
||||
out("""# MAPNAME SYSTEM-USERNAME PG-USERNAME
|
||||
intranet www-data crans_ro
|
||||
intranet www-data crans""")
|
||||
for nounou in nounous:
|
||||
out("""intranet """ + str(nounou) + """ crans""")
|
||||
for apprenti in apprentis:
|
||||
out("""intranet """ + str(apprenti) + """ crans""")
|
||||
|
||||
else:
|
||||
|
||||
#Syslog
|
||||
out("""# MAPNAME SYSTEM-USERNAME PG-USERNAME
|
||||
syslog postgres rsyslog
|
||||
syslog root rsyslog""")
|
||||
|
||||
#Ensuite les nounous
|
||||
|
||||
for nounou in nounous:
|
||||
out("""syslog """ + str(nounou) + """ crans""")
|
||||
|
||||
#Db django rw
|
||||
out("""
|
||||
django www-data crans
|
||||
django asterisk crans
|
||||
django respbats crans
|
||||
django root crans""")
|
||||
|
||||
# Etherpad
|
||||
out("""
|
||||
etherpad etherpad crans""")
|
||||
|
||||
|
||||
# mac_prises
|
||||
out("""
|
||||
mac_prises root crans""")
|
||||
for nounou in nounous:
|
||||
out("""mac_prises """ + str(nounou) + """ crans""")
|
||||
|
||||
|
||||
#Filtrage
|
||||
out("""filtrage root crans""")
|
||||
|
||||
#Sqlgrey
|
||||
out("""sqlgrey postgres sqlgrey""")
|
||||
|
||||
# cluebringer
|
||||
out("""cluebringer www-data cluebringer
|
||||
cluebringer cluebringer cluebringer""")
|
||||
|
||||
#Webmail
|
||||
out("""webmail www-data roundcube""")
|
||||
|
||||
#horde
|
||||
out("""horde www-data www-data""")
|
||||
|
||||
#Mediadrop
|
||||
|
||||
out("""mediadrop root mediadrop
|
||||
mediadrop www-data mediadrop""")
|
||||
|
||||
#Db django ro
|
||||
out("""
|
||||
django_ro respbats crans_ro
|
||||
django_ro freerad crans_ro
|
||||
django_ro arpwatch crans_ro
|
||||
django_ro munin crans_ro
|
||||
django_ro asterisk crans_ro
|
||||
django_ro www-data crans_ro
|
||||
django_ro root crans_ro""")
|
||||
|
||||
for nounou in nounous:
|
||||
out("""django_ro """ + str(nounou) + """ crans_ro""")
|
||||
|
||||
Loading…
Add table
Add a link
Reference in a new issue