update url

Jenkinsfile

@@ -90,6 +90,7 @@ pipeline {
             sh '''
                 git config user.name "Jenkins Server"
                 git config user.email jenkins@confdroid.com
+                git rm -r --cached .vscode || echo "No .vscode to remove from git"
                 git add -A && git commit -am "Recommit for updates in build $BUILD_NUMBER" || echo "No changes to commit"
                 git push origin HEAD:master
             '''
@@ -111,8 +112,9 @@ pipeline {
                   git branch -D development
                   git branch -D jenkins-build-$BUILD_NUMBER
                   git rm -f Jenkinsfile
+                  git rm -r --cached .vscode || echo "No .vscode to remove from git"
                   git commit --amend --no-edit --allow-empty
-                  git remote add master https://gitea.confdroid.com/confdroid/confdroid_postgresql.git
+                  git remote add master https://sourcecode.confdroid.com/confdroid/confdroid_postgresql.git
                   git -c credential.helper="!f() { echo username=${GITEA_USER}; echo password=${GITEA_TOKEN}; }; f" \
                   push master --mirror
                 '''

README.md

@@ -1,6 +1,21 @@
 # Readme
 
 [![Build Status](https://jenkins.confdroid.com/buildStatus/icon?job=confdroid_postgresql)](https://jenkins.confdroid.com/job/postfresql_cd/)
+[![Security Hotspots](https://sonarqube.confdroid.com/api/project_badges/measure?project=confdroid_postgresql&metric=security_hotspots&token=sqb_34cadd0d17dba89c9735fca0b6cd96c55e22950d)](https://sonarqube.confdroid.com/dashboard?id=confdroid_postgresql)
+
+- [Readme](#readme)
+  - [Synopsis](#synopsis)
+  - [WARNING](#warning)
+  - [Features](#features)
+  - [Repo Documentation](#repo-documentation)
+  - [Dependencies](#dependencies)
+  - [Deployment](#deployment)
+  - [SELINUX](#selinux)
+  - [Known Problems](#known-problems)
+  - [Support](#support)
+  - [Tests](#tests)
+  - [Contact Us](#contact-us)
+  - [Disclaimer](#disclaimer)
 
 ## Synopsis
 
@@ -12,6 +27,8 @@ PostgreSQL is a powerful modern open source SQL database server.
 
 ***Attention: Never use this puppet module on systems which have been previously configured manually. It is impossible to predict how and what would have been configured, hence previous configurations outside the scope of this module may be overwritten! Automated configurations require a test environment to verify that the module suits the purpose intended by the user, as well as tune the parameters, before deploying into live production***
 
+[!["Buy Me A Coffee"](https://www.buymeacoffee.com/assets/img/custom_images/orange_img.png)](https://www.buymeacoffee.com/grizzly_coda)
+
 ## Features
 
 Installation
@@ -30,6 +47,7 @@ Optional:
 * manage roles and databases via define (set `$pl_manage_content` to true)
 * manage extensions (set `pl_manage_extensions`to `true`)
 * install and manage pg_bouncer (set `pl_use_pg_bouncer`to `true`)
+* enable SL / TLS manage TLS certificates (set `pl_ssl_enabled`to `true` and populate content externally through variables)
 
 ## Repo Documentation
 
@@ -65,8 +83,10 @@ All files and directories are configured with correct selinux context. If selinu
 
 ## Support
 
+This module has been developed for and tested with
+
 * OS: Rocky 9
-* Puppet 6 - 8
+* Puppet 8
 
 ## Tests
 
@@ -79,7 +99,8 @@ All files and directories are configured with correct selinux context. If selinu
 
 ## Contact Us
 
-[contact Us](https://confdroid.com/contact/)
+* [contact Us](https://confdroid.com/contact/)
+* [Feedback Portal](https://feedback.confdroid.com)
 
 ## Disclaimer
 

manifests/bouncer/bouncer.pp

@@ -3,11 +3,11 @@
 # Author: 12ww1160 (12ww1160@confdroid.com)
 # @summary Class manages the pgbouncer service
 # @example  confdroid_postgresql::bouncer::bouncer_rule { 'test connection':
-#     pl_bouncer_db_name  => 'test',
+#     pl_bouncer_db_name    => 'test',
-#     pl_bouncer_host     => '127.0.0.7',
+#     pl_bouncer_host       => '127.0.0.7',
-#     pl_bouncer_port     => '5432',
+#     pl_bouncer_host_port  => '5432',
-#     pl_bouncer_user     => 'test_user',
+#     pl_bouncer_user       => 'test_user',
-#     pl_bouncer_order    => '001',
+#     pl_bouncer_order      => '001',
 #   }
 ###############################################################################
 class confdroid_postgresql::bouncer::bouncer (

manifests/bouncer/bouncer_rule.pp

@@ -5,18 +5,18 @@
 # @see https://www.postgresql.org/docs/9.6/static/auth-pg-hba-conf.html
 # @param [String] pl_bouncer_db_name db name for the bouncer rule
 # @param [String] pl_bouncer_host IP of the db host to bounce to
-# @param [String] pl_bouncer_port port of the db host to bounce to
+# @param [String] pl_bouncer_host_port port of the db host to bounce to
 # @param [String] pl_bouncer_user user for the connection. Must be defined in
 #   userlist.txt
 # @param [String] pl_bouncer_order the order in which the rule should appear
 ##############################################################################
 define confdroid_postgresql::bouncer::bouncer_rule (
 
-  String $pl_bouncer_db_name  = undef,
+  String $pl_bouncer_db_name    = undef,
-  String $pl_bouncer_host     = '127.0.0.1',
+  String $pl_bouncer_host       = '127.0.0.1',
-  String $pl_bouncer_port     = '5432',
+  String $pl_bouncer_host_port  = '5432',
-  String $pl_bouncer_user     = undef,
+  String $pl_bouncer_user       = undef,
-  String $pl_bouncer_order    = undef,
+  String $pl_bouncer_order      = undef,
 
 ) {
   $pl_bouncer_ini_file    = $confdroid_postgresql::params::pl_bouncer_ini_file

manifests/exporter/dirs.pp

@@ -1,21 +0,0 @@
-## confdroid_postgresql::exporter::dirs.pp
-# Module name: confdroid_postgresql
-# Author: 12ww1160 (12ww1160@confdroid.com)
-# @summary Class manages the postgresql exporter dirs
-###############################################################################
-class confdroid_postgresql::exporter::dirs (
-
-) inherits confdroid_postgresql::params {
-  if ($fqdn == $pl_server_fqdn) and ($pl_use_exporter == true) {
-    file { $pl_install_dir:
-      ensure   => directory,
-      owner    => 'postgres',
-      group    => 'postgres',
-      mode     => '0755',
-      selrange => s0,
-      selrole  => object_r,
-      seltype  => usr_t,
-      seluser  => system_u,
-    }
-  }
-}

manifests/exporter/files.pp

@@ -1,12 +0,0 @@
-## confdroid_postgresql::exporter::files.pp
-# Module name: confdroid_postgresql
-# Author: 12ww1160 (12ww1160@confdroid.com)
-# @summary Class manages the postgresql  exporter files
-###############################################################################
-class confdroid_postgresql::exporter::files (
-
-) inherits confdroid_postgresql::params {
-  if ($fqdn == $pl_server_fqdn) and ($pl_use_exporter == true) {
-    require confdroid_postgresql::exporter::dirs
-  }
-}

manifests/exporter/service.pp

@@ -1,19 +0,0 @@
-## confdroid_postgresql::exporter::service.pp
-# Module name: confdroid_postgresql
-# Author: 12ww1160 (12ww1160@confdroid.com)
-# @summary Class manages the postgresql exporter service
-###############################################################################
-class confdroid_postgresql::exporter::service (
-
-) inherits confdroid_postgresql::params {
-  if ($fqdn == $pl_server_fqdn) and ($pl_use_exporter == true) {
-    require confdroid_postgresql::exporter::files
-
-#    service { $pl_exporter_service:
-#      ensure     => running,
-#      hasstatus  => true,
-#      hasrestart => true,
-#      enable     => true,
-#    }
-  }
-}

manifests/firewall/iptables.pp

@@ -13,5 +13,13 @@ class confdroid_postgresql::firewall::iptables (
       dport  => $pl_fw_port,
       jump   => 'accept',
     }
+    if $pl_use_pg_bouncer == true {
+      firewall { "${pl_fw_rule_order}${pl_bouncer_port} tcp port ${pl_bouncer_port}":
+        source => $pl_source_range,
+        proto  => 'tcp',
+        dport  => $pl_bouncer_port,
+        jump   => 'accept',
+      }
+    }
   }
 }

manifests/main/config.pp

@@ -10,9 +10,6 @@ class confdroid_postgresql::main::config (
 
   if $fqdn == $pl_server_fqdn {
     include confdroid_postgresql::server::service
-#    if $pl_use_exporter == true {
-#      include confdroid_postgresql::exporter::service
-#    }
     if $pl_use_pg_bouncer == true {
       include confdroid_postgresql::bouncer::service
     }

manifests/main/files.pp

@@ -22,5 +22,47 @@ class confdroid_postgresql::main::files (
       content  => template('confdroid_postgresql/postgresql.conf.erb'),
       notify   => Service[$pl_service],
     }
+    if $pl_ssl_enabled == true {
+      # manage tls certs
+      ## ca.crt
+      file { $pl_ca_crt_file:
+        ensure   => file,
+        owner    => 'postgres',
+        group    => 'postgres',
+        mode     => '0400',
+        selrange => s0,
+        selrole  => object_r,
+        seltype  => postgresql_db_t,
+        seluser  => unconfined_u,
+        content  => template($pl_ca_crt_erb),
+        notify   => Service[$pl_service],
+      }
+      ## server.crt
+      file { $pl_server_crt_file:
+        ensure   => file,
+        owner    => 'postgres',
+        group    => 'postgres',
+        mode     => '0400',
+        selrange => s0,
+        selrole  => object_r,
+        seltype  => postgresql_db_t,
+        seluser  => unconfined_u,
+        content  => template($pl_server_crt_erb),
+        notify   => Service[$pl_service],
+      }
+      ## server.key
+      file { $pl_server_key_file:
+        ensure   => file,
+        owner    => 'postgres',
+        group    => 'postgres',
+        mode     => '0400',
+        selrange => s0,
+        selrole  => object_r,
+        seltype  => postgresql_db_t,
+        seluser  => unconfined_u,
+        content  => template($pl_server_key_erb),
+        notify   => Service[$pl_service],
+      }
+    }
   }
 }

manifests/params.pp

@@ -23,8 +23,6 @@
 # @param [String] pl_ca_crt the name of the CA  crt
 # @param [Boolean] pl_manage_content whether to manage roles and databases
 # @param [Boolean] pl_manage_extensions whether to manage extensions
-# @param [Boolean] pl_use_exporter whether to use the postgresql-exporter
-# @param [String] pl_install_dir  the path for the postgres-exporter files
 # @param [String] pl_idle_timeout  idle_in_transaction_session_timeout
 # @param [Boolean] pl_use_pg_bouncer whether to use the pc_bouncer
 # @param [String] pl_bouncer_listen_addr bouncer listen address
@@ -64,10 +62,6 @@ class confdroid_postgresql::params (
   Boolean $pl_manage_content      = true,
   Boolean $pl_manage_extensions   = false,
 
-  # postgresql exporter
-  Boolean $pl_use_exporter        = false,
-  String $pl_install_dir          = '/opt/postgres-exporter',
-
   # pg bouncer
   Boolean $pl_use_pg_bouncer      = false,
   String $pl_bouncer_listen_addr  = '0.0.0.0',
@@ -97,6 +91,12 @@ class confdroid_postgresql::params (
   $pl_bouncer_auth_file     = "${pl_bouncer_dir}/userlist.txt"
   $pl_bouncer_auth_erb      = 'confdroid_postgresql/server/bouncer/bouncer_users.erb'
   $pl_bouncer_rule_erb      = 'confdroid_postgresql/server/bouncer/bouncer_rule.erb'
+  $pl_ca_crt_file           = "${pl_data_dir}/ca.crt"
+  $pl_ca_crt_erb            = 'confdroid_postgresql/server/ca.crt.erb'
+  $pl_server_crt_file       = "${pl_data_dir}/server.crt"
+  $pl_server_crt_erb        = 'confdroid_postgresql/server/server.crt.erb'
+  $pl_server_key_file       = "${pl_data_dir}/server.key"
+  $pl_server_key_erb        = 'confdroid_postgresql/server/server.key.erb'
 
   # Service
   $pl_service               = 'postgresql'

templates/postgresql.conf.erb

@@ -108,9 +108,9 @@ shared_preload_libraries = '<%= @reqpackages_extensions %>'
 
 <% if @pl_ssl_enabled == true -%>
 ssl 		= on
-ssl_ca_file 	= '<%= @pl_data_dir %><%= @pl_ca_crt -%>'
+ssl_ca_file 	= '<%= @pl_data_dir %>ca.crt'
-ssl_cert_file 	= '<%= @pl_data_dir %><%= @pl_server_crt -%>'
+ssl_cert_file 	= '<%= @pl_data_dir %>server.crt'
-ssl_key_file 	= '<%= @pl_data_dir %><%= @pl_server_key -%>'
+ssl_key_file 	= '<%= @pl_data_dir %>server.key'
 <% end -%>
 <% if @pl_ssl_enabled != true -%>
 ssl = off

templates/server/bouncer/bouncer_rule.erb

@@ -1 +1 @@
-<%= @pl_bouncer_db_name %> = host=<%= @pl_bouncer_host %> port=<%= @pl_bouncer_port %>  auth_user=<%= @pl_bouncer_user %> dbname=<%= @pl_bouncer_db_name %>
+<%= @pl_bouncer_db_name %> = host=<%= @pl_bouncer_host %> port=<%= @pl_bouncer_host_port %>  auth_user=<%= @pl_bouncer_user %> dbname=<%= @pl_bouncer_db_name %>

templates/server/ca.crt.erb

@@ -0,0 +1 @@
+<%= @pl_ca_crt %>

templates/server/server.crt.erb

@@ -0,0 +1 @@
+<%= @pl_server_crt %>

templates/server/server.key.erb

@@ -0,0 +1 @@
+<%= @pl_server_key %>