paulmataruso/zulip
1
0
Fork 0
mirror of https://github.com/zulip/zulip.git synced 2025-11-02 13:03:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

kandra: Allow PostgreSQL primary ssh access for PostgreSQL upgrade.

Browse Source 
This allows scripting of the whole upgrade process; these grants are
temporary.
This commit is contained in:
Alex Vandiver
2025-05-09 10:00:05 -04:00
committed by Tim Abbott
parent a959f71208
commit 1b9a8dbc52
3 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
puppet/kandra/manifests/profile/postgresql.pp
View File

@@ -53,6 +53,13 @@ class kandra::profile::postgresql inherits kandra::profile::base {
before => File["${zulip::postgresql_base::postgresql_datadir}/standby.signal"],
notify => Exec[$zulip::postgresql_base::postgresql_restart],
}
Kandra::User_Dotfiles['root'] {
authorized_keys => ['common', 'postgres-upgrade'],
}
} else {
Kandra::User_Dotfiles['root'] {
keys => ['internal-read-only-deploy-key', 'postgres-upgrade'],
}
}
file { "${zulip::postgresql_base::postgresql_confdir}/pg_hba.conf":

3
puppet/kandra/manifests/profile/prod_app_frontend.pp
View File

@@ -6,7 +6,8 @@ class kandra::profile::prod_app_frontend inherits kandra::profile::base {
keys => 'internal-limited-write-deploy-key',
}
Kandra::User_Dotfiles['zulip'] {
keys => 'internal-limited-write-deploy-key',
keys => 'internal-limited-write-deploy-key',
authorized_keys => ['common', 'postgres-upgrade-only-supervisor'],
}
zulip::sysctl { 'conntrack':

4
puppet/kandra/manifests/profile/staging_app_frontend.pp
View File

@@ -2,6 +2,10 @@ class kandra::profile::staging_app_frontend inherits kandra::profile::base {
include kandra::app_frontend
Kandra::User_Dotfiles['zulip'] {
authorized_keys => ['common', 'postgres-upgrade-only-supervisor'],
}
file { '/etc/nginx/sites-available/zulip-staging':
ensure => file,
require => Package['nginx-full'],