diff --git a/defaults/main.yml b/defaults/main.yml index 859f5ac..fbeb767 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -56,6 +56,11 @@ postgres_arguments: - max_parallel_maintenance_workers=4 - -c - checkpoint_timeout=1800 +enable_postgres_replication: false +# IP address of the interface replication +postgres_replications_arguments: [] +postgres_replication_bind_address: "" +postgres_replica_address: "" # Enable TLS for traefik enable_tls: false diff --git a/tasks/firewall.yml b/tasks/firewall.yml index 2a81b48..9b0951e 100644 --- a/tasks/firewall.yml +++ b/tasks/firewall.yml @@ -57,6 +57,15 @@ destination_port: "{{ consensus_port }}" jump: ACCEPT +- name: Allow postgres replication traffic from replica only + when: enable_postgres_replication + ansible.builtin.iptables: + chain: INPUT + protocol: tcp + destination_port: 5432 + source: "{{ postgres_replica_address }}" + jump: ACCEPT + - name: Set default policy to DROP ansible.builtin.iptables: chain: INPUT diff --git a/tasks/provision.yml b/tasks/provision.yml index 7a35120..ee526a0 100644 --- a/tasks/provision.yml +++ b/tasks/provision.yml @@ -32,6 +32,21 @@ - l2_chain_id - l1_chain_id +- name: "Verify that required variables for replication is set" + when: enable_postgres_replication + ansible.builtin.assert: + that: + - required_var != "" + fail_msg: "{{ postgress_replication_required_var }} needs to be set for the role for postgres replication to work" + success_msg: "Required variable for postgres replication {{ postgress_replication_required_var }} isn't empty" + loop_control: + loop_var: postgress_replication_required_var + with_items: + - enable_postgres_replication + - postgres_replication_bind_address + - postgres_replica_address + - postgres_replications_arguments + - name: Check required en vars empty ansible.builtin.fail: msg: "Variable '{{ item }}' is empty" diff --git a/templates/docker-compose.yaml.j2 b/templates/docker-compose.yaml.j2 index 5e7f028..ee89a4f 100644 --- a/templates/docker-compose.yaml.j2 +++ b/templates/docker-compose.yaml.j2 @@ -43,12 +43,23 @@ services: - ./restore_dump.sh:/docker-entrypoint-initdb.d/restore_dump.sh env_file: - postgres.env +{% if enable_postgres_replication %} + environment: + POSTGRES_HOST_AUTH_METHOD: "host replication replicator {{ postgres_replica_address }}/32 md5" + ports: + - "{{ postgres_replication_interface }}:5432:5432" +{% endif %} command: - postgres - -c {% for argument in postgres_arguments %} - {{ argument }} {% endfor %} +{% if enable_postgres_replication %} +{% for repl_argument in postgres_replications_arguments %} + - {{ repl_argument }} +{% endfor %} +{% endif %} external_node: {% if not external_node_raw_docker_tag %} image: "matterlabs/external-node:v{{ external_node_version }}"