83 lines
No EOL
3.1 KiB
Nix
83 lines
No EOL
3.1 KiB
Nix
{ config, pkgs, lib, ... }:
|
|
|
|
let
|
|
# Import nodes
|
|
nodes = import ./../../nodes.nix;
|
|
myName = config.hostName;
|
|
myNode = nodes."${myName}";
|
|
|
|
# And mapping
|
|
mapping = import ./../../mapping.nix;
|
|
|
|
cfg = config.services.postgresql;
|
|
|
|
masterNode = nodes.${mapping.db.master};
|
|
masterIP = "172.19.${toString masterNode.zone}.${toString masterNode.id}";
|
|
in
|
|
{
|
|
age.secrets."repli" = {
|
|
file = ./../../secrets/db/repli.age;
|
|
owner = "postgres";
|
|
group = "postgres";
|
|
};
|
|
|
|
systemd.services.postgresql.environment = lib.mkIf (builtins.elem myName mapping.db.slaves) {
|
|
PGPASSFILE = "${config.age.secrets.repli.path}";
|
|
};
|
|
services.postgresql = {
|
|
enable = true;
|
|
# Force postgres package major version
|
|
# to avoid any unwanted upgrades
|
|
package = pkgs.postgresql_17;
|
|
identMap = ''
|
|
# ArbitraryMapName systemUser DBUser
|
|
superuser_map root postgres
|
|
superuser_map postgres postgres
|
|
'';
|
|
authentication = lib.mkOverride 10 (builtins.concatStringsSep "\n " ([''
|
|
#type database DBuser auth-method optional_ident_map
|
|
local all all peer map=superuser_map
|
|
'']
|
|
++ lib.optionals (myName == mapping.db.master)
|
|
(map (slaveName: let slaveNode = nodes.${slaveName}; in
|
|
"host replication replication 172.19.${toString slaveNode.zone}.${toString slaveNode.id}/32 md5"
|
|
) mapping.db.slaves)
|
|
++ lib.optionals (builtins.elem myName mapping.db.slaves) [''
|
|
host replication replication ${masterIP}/32 md5
|
|
'']));
|
|
ensureUsers = [{
|
|
name = "replication";
|
|
ensureClauses.replication = true;
|
|
}];
|
|
settings = {
|
|
listen_addresses = lib.mkForce "localhost,172.19.${toString myNode.zone}.${toString myNode.id}";
|
|
port = 5432;
|
|
log_connections = true;
|
|
log_statement = "none";
|
|
logging_collector = true;
|
|
log_disconnections = true;
|
|
} // lib.optionalAttrs (myName == mapping.db.master) {
|
|
wal_level = "logical";
|
|
wal_sender_timeout = 10;
|
|
max_wal_senders = 16;
|
|
wal_keep_size = 1000; # In MB
|
|
} // lib.optionalAttrs (builtins.elem myName mapping.db.slaves) {
|
|
wal_level = "logical";
|
|
wal_receiver_timeout = 10;
|
|
primary_conninfo = "host=${masterIP} port=5432 user=replication";
|
|
hot_standby = "on";
|
|
};
|
|
};
|
|
# The password looks like: "*:*:*:*:<password>"
|
|
# Cf: https://www.postgresql.org/docs/current/libpq-pgpass.html
|
|
systemd.services.postgresql.postStart = lib.mkIf (myName == mapping.db.master) ''
|
|
$PSQL -tA <<'EOF'
|
|
DO $$
|
|
DECLARE password TEXT;
|
|
BEGIN
|
|
password := trim(both from split_part(replace(pg_read_file('${config.age.secrets.repli.path}'), E'\n', '''), ':', 5));
|
|
EXECUTE format('ALTER USER replication WITH PASSWORD '''%s''';', password);
|
|
END $$;
|
|
EOF
|
|
'';
|
|
} |