Merge pull request #35 from matter-labs/backup-user

feat: Added user with backup permissions only

defaults/main.yml

@@ -59,8 +59,14 @@ postgres_arguments:
 enable_postgres_replication: false
 # IP address of the interface replication
 postgres_replications_arguments: []
+postgres_replica_user_name: ""
+postgres_replica_user_password: ""
+postgres_replica_auth_method: "scram-sha-256"
 postgres_replication_bind_address: ""
 postgres_replica_address: ""
+backup_db_user: ""
+backup_db_password: ""
+backup_db_name: ""
 
 # Enable TLS for traefik
 enable_tls: false

example_playbooks/mainnet_with_snapshots_recovery/requirements.yml

@@ -10,3 +10,6 @@ roles:
 collections:
   - name: community.general
     version: 8.4.0
+  # Collection for the replication only.
+  - name: community.postgresql
+    version: 3.7.0

tasks/main.yml

@@ -9,3 +9,7 @@
 
 - name: Prepare configs
   ansible.builtin.include_tasks: provision.yml
+
+- name: Configure replication on main instance
+  ansible.builtin.include_tasks: replication.yml
+  when: enable_postgres_replication

tasks/provision.yml

@@ -36,7 +36,7 @@
   when: enable_postgres_replication
   ansible.builtin.assert:
     that:
-      - required_var != ""
+      - postgress_replication_required_var != ""
     fail_msg: "{{ postgress_replication_required_var }} needs to be set for the role for postgres replication to work"
     success_msg: "Required variable for postgres replication {{ postgress_replication_required_var }} isn't empty"
   loop_control:
@@ -46,6 +46,8 @@
     - postgres_replication_bind_address
     - postgres_replica_address
     - postgres_replications_arguments
+    - postgres_replica_user_name
+    - postgres_replica_user_password
 
 - name: Check required en vars empty
   ansible.builtin.fail:

tasks/replication.yml

@@ -0,0 +1,60 @@
+---
+
+- name: Install libpq-dev packages
+  ansible.builtin.apt:
+    update_cache: true
+    name: libpq-dev
+
+- name: Install psycopg2 python package
+  ansible.builtin.pip:
+    name: psycopg2
+
+- name: Grant user replication access for replication.
+  community.postgresql.postgresql_pg_hba:
+    dest: "{{ storage_directory }}/postgres/pg_hba.conf"
+    contype: host
+    users: "{{ postgres_replica_user_name }}"
+    source: "{{ postgres_replica_address }}/32"
+    databases: replication
+    method: "{{ postgres_replica_auth_method }}"
+
+- name: Create postgres replication user
+  community.postgresql.postgresql_user:
+    login_host: "{{ postgres_replication_bind_address }}"
+    login_user: "{{ database_username }}"
+    login_password: "{{ database_password }}"
+    name: "{{ postgres_replica_user_name }}"
+    password: "{{ postgres_replica_user_password }}"
+    role_attr_flags: "REPLICATION"
+
+- name: Create replication slot if doesn't exist
+  community.postgresql.postgresql_slot:
+    login_host: "{{ postgres_replication_bind_address }}"
+    login_user: "{{ database_username }}"
+    login_password: "{{ database_password }}"
+    slot_name: replica
+
+- name: Reload postgres configuration
+  community.postgresql.postgresql_query:
+    login_host: "{{ postgres_replication_bind_address }}"
+    login_user: "{{ database_username }}"
+    login_password: "{{ database_password }}"
+    query: "SELECT pg_reload_conf()"
+
+- name: Create postgres backup user
+  community.postgresql.postgresql_user:
+    login_host: "{{ postgres_replication_bind_address }}"
+    login_user: "{{ database_username }}"
+    login_password: "{{ database_password }}"
+    name: "{{ backup_db_user }}"
+    password: "{{ backup_db_password }}"
+
+- name: Grant role pg_read_all_data to backup user
+  community.postgresql.postgresql_membership:
+    login_host: "{{ postgres_replication_bind_address }}"
+    login_user: "{{ database_username }}"
+    login_password: "{{ database_password }}"
+    group: pg_read_all_data
+    target_roles:
+      - "{{ backup_db_user }}"
+    state: present

templates/docker-compose.yaml.j2

@@ -44,10 +44,8 @@ services:
     env_file:
       - postgres.env
 {% if enable_postgres_replication %}
-    environment:
-      POSTGRES_HOST_AUTH_METHOD: "host replication replicator {{ postgres_replica_address }}/32 md5"
     ports:
-      - "{{ postgres_replication_interface }}:5432:5432"
+      - "{{ postgres_replication_bind_address }}:5432:5432"
 {% endif %}
     command:
       - postgres