Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add pg_hba rule to allow zabbix server #411 #412

Merged
merged 11 commits into from
Jun 26, 2017
Merged

Add pg_hba rule to allow zabbix server #411 #412

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
b66d8a0
Add pg_hba rule to allow zabbix server
RaphaelNeumann Jun 21, 2017
b4f3bd7
Rake fix
RaphaelNeumann Jun 21, 2017
aa3b0fa
Add database_host_ip param
RaphaelNeumann Jun 23, 2017
55fa6e9
Include validation for database host ip and server ip
RaphaelNeumann Jun 23, 2017
2187846
include spec for zabbix_database in another server than zabbix_server…
RaphaelNeumann Jun 23, 2017
3d5d6e2
fix param
RaphaelNeumann Jun 23, 2017
a369696
Include databsse_host_ip on spec for multiple module
RaphaelNeumann Jun 23, 2017
cd9fce6
allow create pg_hba rule for zabbix_server alson when database_host i…
RaphaelNeumann Jun 23, 2017
e65e08e
if fixing
RaphaelNeumann Jun 23, 2017
292ea16
Spell fix
RaphaelNeumann Jun 23, 2017
3b530f7
fix spell
RaphaelNeumann Jun 26, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 9 additions & 5 deletions manifests/database.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,6 +126,7 @@
$database_user = $zabbix::params::server_database_user,
$database_password = $zabbix::params::server_database_password,
$database_host = $zabbix::params::server_database_host,
$database_host_ip = $zabbix::params::server_database_host_ip,
$database_charset = $zabbix::params::server_database_charset,
$database_collate = $zabbix::params::server_database_collate,
) inherits zabbix::params {
Expand All @@ -144,11 +145,8 @@
require => Class['postgresql::server'],
}

# When every component has its own server, we have to allow those servers to
# access the database from the network. Postgresl allows this via the
# pg_hba.conf file. As this file only accepts ip addresses, the ip address
# of server and web has to be supplied as an parameter.
if $zabbix_web_ip != $zabbix_server_ip {
# When database not in some server with zabbix server include pg_hba_rule to server
if ($database_host_ip != $zabbix_server_ip) or ($zabbix_web_ip != $zabbix_server_ip){
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is this logic correct? Shouldn't it be: if ($database_host_ip != $zabbix_server_ip){} ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, I agree with this logic, but on current and old versions of this module has this rule, if I change this logic, current implements will stop working.

For warrant the retro-compatibility I just added an "or" condition for this existent rule.

postgresql::server::pg_hba_rule { 'Allow zabbix-server to access database':
description => 'Open up postgresql for access from zabbix-server',
type => 'host',
Expand All @@ -157,7 +155,13 @@
address => "${zabbix_server_ip}/32",
auth_method => 'md5',
}
}

# When every component has its own server, we have to allow those servers to
# access the database from the network. Postgresql allows this via the
# pg_hba.conf file. As this file only accepts ip addresses, the ip address
# of server and web has to be supplied as an parameter.
if $zabbix_web_ip != $zabbix_server_ip {
postgresql::server::pg_hba_rule { 'Allow zabbix-web to access database':
description => 'Open up postgresql for access from zabbix-web',
type => 'host',
Expand Down
1 change: 1 addition & 0 deletions manifests/params.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,6 +130,7 @@
$server_database_charset = 'utf8'
$server_database_collate = 'utf8_general_ci'
$server_database_host = 'localhost'
$server_database_host_ip = '127.0.0.1'
$server_database_name = 'zabbix_server'
$server_database_password = 'zabbix_server'
$server_database_port = undef
Expand Down
29 changes: 28 additions & 1 deletion spec/classes/database_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,8 @@
database_user: 'zabbix-server',
zabbix_type: 'server',
zabbix_web_ip: '127.0.0.2',
zabbix_server_ip: '127.0.0.1'
zabbix_server_ip: '127.0.0.1',
database_host_ip: '127.0.0.3'
}
end

Expand Down Expand Up @@ -65,6 +66,32 @@
it { is_expected.to contain_class('zabbix::params') }
end

describe 'database_type is postgresql, zabbix_type is server and zabbbix_server and a zabbix_web in the some server but zabbix_database is on other server' do
let :params do
{
database_type: 'postgresql',
database_name: 'zabbix-server',
database_user: 'zabbix-server',
zabbix_type: 'server',
zabbix_web_ip: '127.0.0.1',
zabbix_server_ip: '127.0.0.1',
database_host_ip: '127.0.0.2'
}
end

it { is_expected.to contain_postgresql__server__db('zabbix-server').with_name('zabbix-server') }
it { is_expected.to contain_postgresql__server__db('zabbix-server').with_user('zabbix-server') }

it { is_expected.to contain_postgresql__server__pg_hba_rule('Allow zabbix-server to access database').with_database('zabbix-server') }
it { is_expected.to contain_postgresql__server__pg_hba_rule('Allow zabbix-server to access database').with_user('zabbix-server') }
it { is_expected.to contain_postgresql__server__pg_hba_rule('Allow zabbix-server to access database').with_address('127.0.0.1/32') }

it { is_expected.not_to contain_postgresql__server__pg_hba_rule('Allow zabbix-web to access database').with_database('zabbix-server') }
it { is_expected.not_to contain_postgresql__server__pg_hba_rule('Allow zabbix-web to access database').with_user('zabbix-server') }
it { is_expected.not_to contain_postgresql__server__pg_hba_rule('Allow zabbix-web to access database').with_address('127.0.0.2/32') }
it { is_expected.to contain_class('zabbix::params') }
end

describe 'database_type is postgresql, zabbix_type is proxy' do
let :params do
{
Expand Down