ConfigLMM 0.2.0 → 0.4.0

data/Plugins/Apps/Peppermint/Peppermint.lmm.rb

@@ -0,0 +1,58 @@
+
+module ConfigLMM
+    module LMM
+        class Peppermint < Framework::NginxApp
+
+            USER = 'peppermint'
+            HOME_DIR = '/var/lib/peppermint'
+            HOST_IP = '10.0.2.2'
+
+            def actionPeppermintDeploy(id, target, activeState, context, options)
+                raise Framework::PluginProcessError.new('Domain field must be set!') unless target['Domain']
+
+                target['Database'] ||= {}
+                if target['Location'] && target['Location'] != '@me'
+                    uri = Addressable::URI.parse(target['Location'])
+                    raise Framework::PluginProcessError.new("#{id}: Unknown Protocol: #{uri.scheme}!") if uri.scheme != 'ssh'
+
+                    self.class.sshStart(uri) do |ssh|
+
+                        dbPassword = self.configurePostgreSQL(target['Database'], ssh)
+                        distroInfo = Framework::LinuxApp.currentDistroInfo(ssh)
+                        Framework::LinuxApp.configurePodmanServiceOverSSH(USER, HOME_DIR, 'Peppermint Ticket Management', distroInfo, ssh)
+
+                        path = Framework::LinuxApp::SYSTEMD_CONTAINERS_PATH.gsub('~', HOME_DIR)
+                        self.class.sshExec!(ssh, " echo 'DB_HOST=#{HOST_IP}' > #{path}/Peppermint.env")
+                        self.class.sshExec!(ssh, " echo 'DB_USERNAME=#{USER}' >> #{path}/Peppermint.env")
+                        self.class.sshExec!(ssh, " echo 'DB_PASSWORD=#{dbPassword}' >> #{path}/Peppermint.env")
+                        self.class.sshExec!(ssh, " echo 'SECRET=#{SecureRandom.urlsafe_base64(60)}' >> #{path}/Peppermint.env")
+                        self.class.sshExec!(ssh, " echo 'API_URL=https://#{target['Domain']}/api' >> #{path}/Peppermint.env")
+                        self.class.sshExec!(ssh, "chown #{USER}:#{USER} #{path}/Peppermint.env")
+                        self.class.sshExec!(ssh, "chmod 600 #{path}/Peppermint.env")
+
+                        ssh.scp.upload!(__dir__ + '/Peppermint.container', path)
+                        self.class.sshExec!(ssh, "systemctl --user --machine=#{USER}@ daemon-reload")
+                        self.class.sshExec!(ssh, "systemctl --user --machine=#{USER}@ start Peppermint")
+
+                        Framework::LinuxApp.ensurePackages([NGINX_PACKAGE], ssh)
+                        Framework::LinuxApp.ensureServiceAutoStartOverSSH(NGINX_PACKAGE, ssh)
+                        self.class.prepareNginxConfig(target, ssh)
+                        self.writeNginxConfig(__dir__, 'Peppermint', id, target, state, context, options)
+                        self.deployNginxConfig(id, target, activeState, context, options)
+                        Framework::LinuxApp.startServiceOverSSH(NGINX_PACKAGE, ssh)
+                    end
+                else
+                    # TODO
+                end
+            end
+
+            def configurePostgreSQL(settings, ssh)
+                password = SecureRandom.alphanumeric(20)
+                PostgreSQL.createRemoteUserAndDBOverSSH(settings, USER, password, ssh)
+                password
+            end
+
+        end
+    end
+end
+

data/Plugins/Apps/Postfix/Postfix.lmm.rb

@@ -4,72 +4,206 @@ module ConfigLMM
         class Postfix < Framework::Plugin
             PACKAGE_NAME = 'Postfix'
             SERVICE_NAME = 'postfix'
-            MASTER_FILE = '/etc/postfix/master.cf'
-            MAIN_FILE = '/etc/postfix/main.cf'
-            TRANSPORT_FILE = '/etc/postfix/transport'
+            MASTER_FILE = 'master.cf'
+            MAIN_FILE = 'main.cf'
+            TRANSPORT_FILE = 'transport'
 
             def actionPostfixDeploy(id, target, activeState, context, options)
-                plugins[:Linux].ensurePackage(PACKAGE_NAME, target['Location'])
+                plugins[:Linux].ensurePackages([PACKAGE_NAME, 'CyrusSASL'], target['Location'])
                 plugins[:Linux].ensureServiceAutoStart(SERVICE_NAME, target['Location'])
 
+                activeState['Instance'] = target['Instance']
+                activeState['AlternativePort'] = target['AlternativePort']
                 deploySettings(target, target['Location'], options)
 
                 plugins[:Linux].startService(SERVICE_NAME, target['Location'])
+
+                activeState['Status'] = State::STATUS_DEPLOYED
             end
 
             def deploySettings(target, location, options)
+                postfixDirName = 'postfix'
+                postfixDirName = 'postfix-' + target['Instance'] if target['Instance']
+                postfixDir = '/etc/' + postfixDirName + '/'
                 if location && location != '@me'
-                    if target['AlternativePort']
-                        updateRemoteFile(location, MASTER_FILE, options, true) do |fileLines|
-                            fileLines << "#{target['AlternativePort']}      inet  n       -       n       -       -       smtpd\n"
-                        end
-                    end
                     self.class.sshStart(location) do |ssh|
-                        domain = self.class.sshExec!(ssh, "hostname --fqdn").strip
-                        command = "sed -i 's|^myhostname = .*|myhostname = #{domain}|' #{MAIN_FILE}"
-                        command = "sed -i 's|^#myhostname = virtual.domain.tld|myhostname = #{domain}|' #{MAIN_FILE}"
+                        if target['Instance']
+                            self.class.sshExec!(ssh, "postmulti -e init")
+                            self.class.sshExec!(ssh, "postmulti -I #{postfixDirName} -e create", true)
+                            self.class.sshExec!(ssh, "sed -i 's|^master_service_disable|#master_service_disable|' #{postfixDir + MAIN_FILE}")
+                        end
+                        self.class.sshExec!(ssh, "sed -i 's|^tlsmgr|#tlsmgr|' #{postfixDir + MASTER_FILE}")
+                        if target.key?('SMTP')
+                            if !target['SMTP'] || target['SMTP'] == 'unix'
+                                self.class.sshExec!(ssh, "sed -i 's|^smtp|#smtp|' #{postfixDir + MASTER_FILE}")
+                            end
+                        end
+                        updateRemoteFile(ssh, postfixDir + MASTER_FILE, options, true) do |fileLines|
+                            if target['AlternativePort']
+                                fileLines << "#{target['AlternativePort']}      inet  n       -       n       -       -       smtpd\n"
+                                fileLines << "tlsmgr    unix  -       -       n       1000?   1       tlsmgr\n"
+                            else
+                                if !target.key?('Submission') || (target.key?('Submission') && target['Submission'])
+                                    fileLines << "submissions     inet  n       -       n       -       -       smtpd\n"
+                                    fileLines << "    -o syslog_name=postfix/submissions\n"
+                                    fileLines << "    -o smtpd_tls_wrappermode=yes\n"
+                                    fileLines << "    -o smtpd_tls_security_level=encrypt\n"
+                                    fileLines << "    -o smtpd_sasl_auth_enable=yes\n"
+                                    fileLines << "    -o cleanup_service_name=header_cleanup\n"
+                                    fileLines << "header_cleanup unix n   -       -       -       0       cleanup\n"
+                                    fileLines << "    -o header_checks=regexp:/etc/postfix/header_cleanup\n"
+
+                                    self.class.sshExec!(ssh, "echo '/^Received:/ IGNORE' > /etc/postfix/header_cleanup")
+                                    self.class.sshExec!(ssh, "echo '/^User-Agent:/ IGNORE' >> /etc/postfix/header_cleanup")
+                                end
+                                fileLines << "tlsmgr    unix  -       -       n       1000?   1       tlsmgr\n"
+                                if target['SMTP'] == 'unix'
+                                    fileLines << "smtp      unix  -       -       n       -       -       smtp\n"
+                                end
+                            end
+                            fileLines
+                        end
+
+                        domain = target['Domain']
+                        domain = self.class.sshExec!(ssh, "hostname --fqdn").strip unless domain
+                        command = "sed -i 's|^myhostname = .*|myhostname = #{domain}|' #{postfixDir + MAIN_FILE}"
                         self.class.sshExec!(ssh, command)
-                    end
-                    if target['Settings']
+                        command = "sed -i 's|^#myhostname = virtual.domain.tld|myhostname = #{domain}|' #{postfixDir + MAIN_FILE}"
+                        self.class.sshExec!(ssh, command)
+
+                        # Fix config bug
+                        command = "sed -i 's|^alias_maps = :/etc/aliases|alias_maps = lmdb:/etc/aliases|' #{postfixDir + MAIN_FILE}"
+                        self.class.sshExec!(ssh, command)
+                        command = "sed -i 's|^canonical_maps = :/etc/postfix/canonical|canonical_maps = lmdb:/etc/postfix/canonical|' #{postfixDir + MAIN_FILE}"
+                        self.class.sshExec!(ssh, command)
+                        command = "sed -i 's|^relocated_maps = :/etc/postfix/relocated|relocated_maps = lmdb:/etc/postfix/relocated|' #{postfixDir + MAIN_FILE}"
+                        self.class.sshExec!(ssh, command)
+                        command = "sed -i 's|^sender_canonical_maps = :/etc/postfix/sender_canonical|sender_canonical_maps = lmdb:/etc/postfix/sender_canonical|' #{postfixDir + MAIN_FILE}"
+                        self.class.sshExec!(ssh, command)
+                        command = "sed -i 's|^transport_maps = :/etc/postfix/transport|transport_maps = lmdb:/etc/postfix/transport|' #{postfixDir + MAIN_FILE}"
+                        self.class.sshExec!(ssh, command)
+                        command = "sed -i 's|^smtpd_sender_restrictions = :/etc/postfix/access|smtpd_sender_restrictions = lmdb:/etc/postfix/access|' #{postfixDir + MAIN_FILE}"
+                        self.class.sshExec!(ssh, command)
+                        command = "sed -i 's|^virtual_alias_maps = :/etc/postfix/virtual|virtual_alias_maps = lmdb:/etc/postfix/virtual|' #{postfixDir + MAIN_FILE}"
+                        self.class.sshExec!(ssh, command)
+                        command = "sed -i 's|^relay_domains = $mydestination :/etc/postfix/relay|relay_domains = $mydestination lmdb:/etc/postfix/relay|' #{postfixDir + MAIN_FILE}"
+                        self.class.sshExec!(ssh, command)
+                        command = "sed -i 's|^relay_recipient_maps = :/etc/postfix/relay_recipients|relay_recipient_maps = lmdb:/etc/postfix/relay_recipients|' #{postfixDir + MAIN_FILE}"
+                        self.class.sshExec!(ssh, command)
+                        command = "sed -i 's|^virtual_mailbox_maps =.*|virtual_mailbox_maps = lmdb:/etc/postfix/mailboxes|' #{postfixDir + MAIN_FILE}"
+                        self.class.sshExec!(ssh, command)
+
+
+                        if target['AlternativePort']
+                            Framework::LinuxApp.firewallAddPort("#{target['AlternativePort']}/tcp", ssh)
+                        else
+                            Framework::LinuxApp.firewallAddService('smtp', ssh)
+                        end
+                        Framework::LinuxApp.firewallAddService('smtps', ssh)
+
+                        ssh.scp.upload!(__dir__ + '/smtpd.conf', '/etc/sasl2/smtpd.conf')
+                        self.class.sshExec!(ssh, "touch /etc/sasldb2")
+                        self.class.sshExec!(ssh, "chown postfix:postfix /etc/sasldb2")
+                        self.class.sshExec!(ssh, "touch #{postfixDir}access")
+                        self.class.sshExec!(ssh, "postmap #{postfixDir}access")
+                        self.class.sshExec!(ssh, "touch #{postfixDir}sender_login")
+                        self.class.sshExec!(ssh, "postmap #{postfixDir}sender_login")
+
+                        certDir = Framework::LinuxApp.createCertificateOverSSH(ssh)
+                        target['Settings'] ||= []
+                        target['Settings']['smtpd_sender_login_maps'] = "lmdb:#{postfixDir}sender_login" unless target['Settings']['smtpd_sender_login_maps']
+                        target['Settings']['smtpd_sender_restrictions'] = "reject_sender_login_mismatch, lmdb:#{postfixDir}access" unless target['Settings']['smtpd_sender_restrictions']
+                        target['Settings']['smtp_tls_security_level'] = 'may' unless target['Settings']['smtp_tls_security_level']
+                        target['Settings']['smtpd_tls_mandatory_protocols'] = '>=TLSv1.2' unless target['Settings']['smtpd_tls_mandatory_protocols']
+                        target['Settings']['smtpd_tls_auth_only'] = 'yes' unless target['Settings']['smtpd_tls_auth_only']
+                        target['Settings']['smtpd_tls_security_level'] = 'may' unless target['Settings']['smtpd_tls_security_level']
+                        target['Settings']['smtpd_tls_cert_file'] = certDir + 'fullchain.pem' unless target['Settings']['smtpd_tls_cert_file']
+                        target['Settings']['smtpd_tls_key_file'] = certDir + 'privkey.pem' unless target['Settings']['smtpd_tls_key_file']
+                        target['Settings']['tls_preempt_cipherlist'] = 'yes' unless target['Settings']['tls_preempt_cipherlist']
+                        target['Settings']['tls_ssl_options'] = 'NO_RENEGOTIATION' unless target['Settings']['tls_ssl_options']
+
+
                         target['Settings'].each do |name, value|
-                            self.class.sshStart(location) do |ssh|
-                                command = "sed -i 's|^#{name} =.*|#{name} = #{value}|' #{MAIN_FILE}"
-                                self.class.sshExec!(ssh, command)
+                            command = "sed -i 's|^#{name} =.*|##{name} = #{value}|' #{postfixDir + MAIN_FILE}"
+                            self.class.sshExec!(ssh, command)
+                        end
+                        updateRemoteFile(ssh, postfixDir + MAIN_FILE, options) do |fileLines|
+                            target['Settings'].each do |name, value|
+                                value = 'yes' if value == true
+                                value = 'no' if value == false
+                                fileLines << "#{name} = #{value}\n"
                             end
+                            fileLines
                         end
-                    end
-                    if target['ForwardAll']
-                        updateRemoteFile(location, TRANSPORT_FILE, options, true) do |fileLines|
-                            hostname, port = target['ForwardAll'].split(':')
-                            hostname = '[' + hostname + ']'
-                            line = '* smtp:' + hostname
-                            line += ':' + port if port
-                            fileLines << line + "\n"
+
+                        if target['ForwardDovecot']
+                            command = "sed -i 's|^#virtual_transport =.*|virtual_transport = lmtp:unix:/run/dovecot/lmtp|' #{postfixDir + MAIN_FILE}"
+                            self.class.sshExec!(ssh, command)
                         end
-                        self.class.sshStart(location) do |ssh|
-                            self.class.sshExec!(ssh, "postmap #{TRANSPORT_FILE}")
+
+                        if target['ForwardAll']
+                            command = "sed -i 's|^transport_maps =.*|transport_maps = lmdb:#{postfixDir}transport|' #{postfixDir + MAIN_FILE}"
+                            self.class.sshExec!(ssh, command)
+                            updateRemoteFile(ssh, postfixDir + TRANSPORT_FILE, options, true) do |fileLines|
+                                hostname, port = target['ForwardAll'].split(':')
+                                hostname = '[' + hostname + ']'
+                                line = '* smtp:' + hostname
+                                line += ':' + port if port
+                                fileLines << line + "\n"
+                            end
+                            self.class.sshExec!(ssh, "postmap #{postfixDir + TRANSPORT_FILE}")
+                        end
+
+                        if target['Instance']
+                            self.class.sshExec!(ssh, "postmulti -i #{postfixDirName} -e enable")
+                            self.class.sshExec!(ssh, "postmulti -i #{postfixDirName} -p start", true)
                         end
                     end
                 else
                     if target['AlternativePort']
-                        updateLocalFile(MASTER_FILE, options, true) do |fileLines|
+                        updateLocalFile(postfixDir + MASTER_FILE, options, true) do |fileLines|
                             fileLines << "#{target['AlternativePort']}      inet  n       -       n       -       -       smtpd\n"
                         end
                     end
                     if target['Settings']
                         target['Settings'].each do |name, value|
-                            `sed -i 's|^#{name} =.*|#{name} = #{value}|' #{MAIN_FILE}`
+                            `sed -i 's|^#{name} =.*|#{name} = #{value}|' #{postfixDir + MAIN_FILE}`
                         end
                     end
                     if target['ForwardAll']
-                        updateLocalFile(TRANSPORT_FILE, options, true) do |fileLines|
+                        updateLocalFile(postfixDir + TRANSPORT_FILE, options, true) do |fileLines|
                             fileLines << '* smtp:[' + target['ForwardAll'] + "]\n"
                         end
-                        `postmap #{TRANSPORT_FILE}`
+                        `postmap #{postfixDir + TRANSPORT_FILE}`
                     end
                 end
             end
 
+            def cleanup(configs, state, context, options)
+                cleanupType(:Postfix, configs, state, context, options) do |item, id, state, context, options, ssh|
+                    instances = self.class.exec('postmulti -l | wc -l', ssh, true).strip.to_i
+                    if instances <= 1
+                        Framework::LinuxApp.stopService(SERVICE_NAME, ssh, options[:dry])
+                        Framework::LinuxApp.firewallRemoveService('smtps', ssh, options[:dry])
+                        if item['AlternativePort']
+                            Framework::LinuxApp.firewallRemovePort("#{item['AlternativePort']}/tcp", ssh, options[:dry])
+                        else
+                            Framework::LinuxApp.firewallRemoveService('smtp', ssh, options[:dry])
+                        end
+                        Framework::LinuxApp.removePackage(PACKAGE_NAME, ssh, options[:dry])
+
+                        state.item(id)['Status'] = State::STATUS_DELETED unless options[:dry]
+
+                        if options[:destroy]
+                            rm('/etc/postfix', options[:dry], ssh)
+
+                            state.item(id)['Status'] = State::STATUS_DESTROYED unless options[:dry]
+                        end
+                    else
+                        prompt.say('Postfix multiple instance cleanup not implemented!', :color => :red)
+                    end
+                end
+            end
         end
 
     end

data/Plugins/Apps/Postfix/smtpd.conf

@@ -0,0 +1,3 @@
+pwcheck_method: auxprop
+auxprop_plugin: sasldb
+mech_list: plain

data/Plugins/Apps/PostgreSQL/PostgreSQL.lmm.rb

@@ -12,52 +12,270 @@ module ConfigLMM
             CONFIG_FILE = 'data/postgresql.conf'
 
             def actionPostgreSQLDeploy(id, target, activeState, context, options)
-                self.ensurePackage(PACKAGE_NAME, target['Location'])
-                self.ensureServiceAutoStart(SERVICE_NAME, target['Location'])
+                target['Deploy'] = !!(target['ListenAll'] || target['Listen'] || target['Settings']) unless target.key?('Deploy')
+                activeState['Deploy'] = target['Deploy']
+                activeState['Users'] = target['Users']
+                activeState['Databases'] = target['Databases']
+                activeState['Publications'] = target['Publications']
+                activeState['Subscriptions'] = target['Subscriptions']
+
+                if target['Deploy']
+                    self.ensurePackage(PACKAGE_NAME, target['Location'])
+                    self.ensureServiceAutoStart(SERVICE_NAME, target['Location'])
+                    self.startService(SERVICE_NAME, target['Location'])
+                end
 
                 if target['Location'] && target['Location'] != '@me'
                     uri = Addressable::URI.parse(target['Location'])
                     raise Framework::PluginProcessError.new("#{id}: Unknown Protocol: #{uri.scheme}!") if uri.scheme != 'ssh'
-                    if target['ListenAll']
-                        cmd = "sed -i 's|^host    all             all             127.0.0.1/32            ident|host    all             all             0.0.0.0/0               scram-sha-256|'"
-                        dir = updateConfigOverSSH(uri, cmd)
-                        updateRemoteFile(uri, dir + CONFIG_FILE, options, false) do |configLines|
-                            configLines << "listen_addresses = '*'\n"
+
+                    self.class.sshStart(uri) do |ssh|
+                        if target['Deploy']
+                            self.updateSettingsOverSSH(target, ssh, options)
+                            self.class.sshExec!(ssh, "su --login #{USER_NAME} --command 'pg_ctl reload'")
+                        end
+                        self.class.createUsersOverSSH(target, ssh)
+                        self.class.createDatabasesOverSSH(target, ssh)
+                        self.class.createPublicationsOverSSH(target, ssh)
+                        self.class.createSubscriptionsOverSSH(target, ssh)
+                    end
+                else
+                    if target['Deploy']
+                        `pg_ctl reload`
+                    end
+                end
+
+                activeState['Status'] = State::STATUS_DEPLOYED
+            end
+
+            def cleanup(configs, state, context, options)
+                cleanupType(:PostgreSQL, configs, state, context, options) do |item, id, state, context, options, ssh|
+                    if item['Deploy']
+                        Framework::LinuxApp.stopService(SERVICE_NAME, ssh, options[:dry])
+                        Framework::LinuxApp.disableService(SERVICE_NAME, ssh, options[:dry])
+                        Framework::LinuxApp.removePackage(PACKAGE_NAME, ssh, options[:dry])
+
+                        state.item(id)['Status'] = State::STATUS_DELETED unless options[:dry]
+
+                        if options[:destroy]
+                            Framework::LinuxApp.deleteUserAndGroup(USER_NAME, ssh, options[:dry])
+
+                            state.item(id)['Status'] = State::STATUS_DESTROYED unless options[:dry]
                         end
                     else
-                        cmd = "sed -i 's|^host    all             all             127.0.0.1/32            ident|host    all             all             127.0.0.1/32            scram-sha-256|'"
-                        updateConfigOverSSH(uri, cmd)
+                        # TODO
+                    end
+                end
+            end
+
+            def updateListenLocal(target)
+                dir = pgsqlDir(self.class.distroID)
+                if target['ListenAll']
+                    `sed -i 's|^host    all             all             127.0.0.1/32            ident|host    all             all             0.0.0.0/0            scram-sha-256|' #{dir + HBA_FILE}`
+                    updateLocalFile(dir + CONFIG_FILE, options) do |configLines|
+                        configLines << "listen_addresses = '*'\n"
                     end
                 else
-                    dir = pgsqlDir(self.class.distroID)
-                    if target['ListenAll']
-                        `sed -i 's|^host    all             all             127.0.0.1/32            ident|host    all             all             0.0.0.0/0            scram-sha-256|' #{dir + HBA_FILE}`
-                        updateLocalFile(dir + CONFIG_FILE, options) do |configLines|
-                            configLines << "listen_addresses = '*'"
+                    `sed -i 's|^host    all             all             127.0.0.1/32            ident|host    all             all             127.0.0.1/32            scram-sha-256|' #{dir + HBA_FILE}`
+                end
+            end
+
+            def updateSettingsOverSSH(target, ssh, options)
+                dir = nil
+                settingLines = []
+                hbaLines = []
+                if target['ListenAll']
+                    cmd = "sed -i 's|^host    all             all             127.0.0.1/32            ident|host    all             all             0.0.0.0/0               scram-sha-256|'"
+                    dir = updateConfigOverSSH(ssh, cmd)
+                    settingLines << "listen_addresses = '*'\n"
+                    Framework::LinuxApp.firewallAddPortOverSSH('5432/tcp', ssh)
+                elsif target['Listen'] && !target['Listen'].empty?
+                    cmd = "sed -i 's|^host    all             all             127.0.0.1/32            ident|host    all             all             127.0.0.1/32            scram-sha-256|'"
+                    dir = updateConfigOverSSH(ssh, cmd)
+
+                    ips = target['Listen'].map { |addr| addr.split('/').first }.join(',')
+                    settingLines << "listen_addresses = '#{ips}'\n"
+
+                    target['Listen'].each do |addr|
+                        if addr != 'localhost' && !addr.start_with?('127.0.0.1') && !addr.start_with?('::1')
+                            hbaLines << "host    all             all             #{addr}            scram-sha-256\n"
                         end
+                    end
+                else
+                    cmd = "sed -i 's|^host    all             all             127.0.0.1/32            ident|host    all             all             127.0.0.1/32            scram-sha-256|'"
+                    dir = updateConfigOverSSH(ssh, cmd)
+                end
+                #if !target['Publications'].to_h.empty?
+                #    target['Settings'] ||= {}
+                #    target['Settings']['wal_level'] = 'logical'
+                #end
+                target['Settings'].to_h.each do |name, value|
+                    settingLines << "#{name} = #{value}\n"
+                end
+                if !hbaLines.empty?
+                    updateRemoteFile(ssh, dir + HBA_FILE, options, false) do |configLines|
+                        configLines += hbaLines
+                    end
+                end
+                if !settingLines.empty?
+                    updateRemoteFile(ssh, dir + CONFIG_FILE, options, false) do |configLines|
+                        configLines += settingLines
+                    end
+                end
+            end
+
+            def self.createUsersOverSSH(target, ssh)
+                target['Users'].to_a.each do |user, info|
+                    self.sshExec!(ssh, "su --login #{USER_NAME} --command 'createuser #{user}'", true)
+                    if !info['Password'].to_s.empty?
+                        password = self.loadVariable(info['Password'], target).to_s
+                        if !password.empty?
+                            sql = "ALTER USER #{user} WITH PASSWORD '#{password}'"
+                            self.executeSQL(sql, nil, ssh)
+                        end
+                    end
+                    if info['Replication'] && info['Replication'] != 'no'
+                        self.executeSQL("ALTER USER #{user} REPLICATION", nil, ssh)
+                        self.executeSQL("GRANT pg_read_all_data TO #{user}", nil, ssh)
+                    end
+                end
+            end
+
+            def self.createDatabasesOverSSH(target, ssh)
+                target['Databases'].to_a.each do |db, info|
+                    self.sshExec!(ssh, "su --login #{USER_NAME} --command 'createdb #{db}'", true)
+                end
+            end
+
+            def self.createPublicationsOverSSH(target, ssh)
+                return if target['Publications'].to_h.empty?
+
+                target['Publications'].each do |name, data|
+                    data['Database'] = name unless data['Database']
+                    if data['Tables'].is_a?(Array)
+                        # TODO
+                    elsif data['Tables'] == 'All'
+                        sql = "CREATE PUBLICATION #{name} FOR ALL TABLES"
+                        self.executeSQL(sql, data['Database'], ssh, true)
                     else
-                        `sed -i 's|^host    all             all             127.0.0.1/32            ident|host    all             all             127.0.0.1/32            scram-sha-256|' #{dir + HBA_FILE}`
+                        raise "Invalid Tables field: #{data['Tables']}"
                     end
                 end
+            end
+
+            def self.createSubscriptionsOverSSH(target, ssh)
+                return if target['Subscriptions'].to_h.empty?
+
+                target['Subscriptions'].each do |name, data|
+                    data['Database'] = name unless data['Database']
+                    data['Publication'] = name unless data['Publication']
+                    connection = self.loadVariable(data['Connection'], target).to_s
 
-                self.startService(SERVICE_NAME, target['Location'])
+                    authParams = '--host=' + connection.match('host=([^ ]+)')[1]
+                    authParams += ' --username=' + connection.match('user=([^ ]+)')[1]
+                    password = connection.match('password=([^ ]+)')[1]
+
+                    self.importRemoteSchemaOverSSH(name, data['Database'], password, authParams, ssh)
+
+                    sql = "CREATE SUBSCRIPTION #{name} CONNECTION '#{connection}' PUBLICATION #{data['Publication']}"
+                    self.executeSQL(sql, data['Database'], ssh, true)
+                end
             end
 
-            def updateConfigOverSSH(uri, cmd)
-                dir = ''
-                self.class.sshStart(uri) do |ssh|
-                    distroID = self.class.distroIDfromSSH(ssh)
-                    dir = pgsqlDir(distroID)
-                    self.class.sshExec!(ssh, cmd + ' ' + dir + HBA_FILE)
+            def self.importRemoteSchemaOverSSH(sourceDB, targetDB, password, authParams, ssh)
+                self.sshExec!(ssh, "su --login #{USER_NAME} --command 'createdb #{targetDB}'", true)
+                cmd = " su --login #{USER_NAME} --command 'PGPASSWORD=#{password} pg_dump --schema-only --no-owner --dbname=#{sourceDB} #{authParams} | psql --dbname=#{targetDB}'"
+                self.sshExec!(ssh, cmd)
+            end
+
+            def self.updateOwner(db, owner, ssh)
+                sql = "SELECT tablename FROM pg_tables WHERE NOT schemaname IN ('pg_catalog', 'information_schema')"
+                tables = self.executeSQL(sql, db, ssh, false, ['--csv', '--tuples-only']).strip.lines
+                tables.each do |table|
+                    self.executeSQL("ALTER TABLE public.#{table} OWNER TO #{owner};", db, ssh)
                 end
+
+                sql = "SELECT sequence_name FROM information_schema.sequences WHERE NOT sequence_schema IN ('pg_catalog', 'information_schema')"
+                sequences = self.executeSQL(sql, db, ssh, false, ['--csv', '--tuples-only']).strip.lines
+                sequences.each do |sequence|
+                    self.executeSQL("ALTER SEQUENCE public.#{sequence} OWNER TO #{owner};", db, ssh)
+                end
+
+                sql = "SELECT table_name FROM information_schema.views WHERE NOT table_schema IN ('pg_catalog', 'information_schema')"
+                views = self.executeSQL(sql, db, ssh, false, ['--csv', '--tuples-only']).strip.lines
+                views.each do |view|
+                    self.executeSQL("ALTER VIEW public.#{view} OWNER TO #{owner};", db, ssh)
+                end
+            end
+
+            def updateConfigOverSSH(ssh, cmd)
+                dir = ''
+                distroID = self.class.distroID(ssh)
+                dir = pgsqlDir(distroID)
+                self.class.sshExec!(ssh, cmd + ' ' + dir + HBA_FILE)
                 dir
             end
 
+            def self.createRemoteUserAndDBOverSSH(settings, user, password, ssh)
+                self.executeRemotely(settings, ssh) do |ssh|
+                    self.createUserAndDBOverSSH(user, password, ssh)
+                end
+            end
+
+            def self.dropUserAndDB(settings, user, ssh, dry)
+                self.executeRemotely(settings, ssh) do |ssh|
+                    self.exec("su --login #{USER_NAME} --command 'dropdb #{user}'", ssh, true, dry)
+                    self.exec("su --login #{USER_NAME} --command 'dropuser #{user}'", ssh, true, dry)
+                end
+            end
+
+            def self.createExtensions(settings, db, extensions, ssh)
+                self.executeRemotely(settings, ssh) do |ssh|
+                    extensions.each do |extension|
+                        self.executeSQL("CREATE EXTENSION #{extension}", db, ssh, true)
+                    end
+                end
+            end
+
+            def self.executeRemotely(settings, ssh = nil)
+                settings['HostName'] = 'localhost' unless settings['HostName']
+                if settings['HostName'] == 'localhost'
+                    yield(ssh)
+                else
+                    self.sshStart("ssh://#{settings['HostName']}/") do |ssh|
+                        yield(ssh)
+                    end
+                end
+            end
+
             def self.createUserAndDBOverSSH(user, password, ssh)
                 self.sshExec!(ssh, "su --login #{USER_NAME} --command 'createuser #{user}'", true)
                 self.sshExec!(ssh, "su --login #{USER_NAME} --command 'createdb --owner=#{user} #{user}'", true)
-                cmd = " su --login #{USER_NAME} --command ' psql -c \"ALTER USER #{user} WITH PASSWORD \\'#{password}\\';\"'"
-                self.sshExec!(ssh, cmd)
+                if password
+                    sql = "ALTER USER #{user} WITH PASSWORD '#{password}'"
+                    self.executeSQL(sql, nil, ssh)
+                end
+            end
+
+            def self.importSQL(owner, db, sqlFile, ssh = nil)
+                if ssh
+                    self.sshExec!(ssh, "echo \"SET ROLE '#{owner}';\" > /tmp/postgres_import.sql")
+                    self.sshExec!(ssh, "cat #{sqlFile} >> /tmp/postgres_import.sql")
+                    cmd = "su --login #{USER_NAME} --command 'psql #{db} < /tmp/postgres_import.sql'"
+                    self.sshExec!(ssh, cmd)
+                else
+                    # TODO
+                end
+            end
+
+            def self.executeSQL(sql, db, ssh = nil, allowFailure = false, options = [])
+                if ssh
+                    db = 'postgres' unless db
+                    cmd = " su --login #{USER_NAME} --command ' psql #{options.join(' ')} --dbname=#{db} --command=\"#{sql.gsub("'", "'\"'\"'")};\"'"
+                    self.sshExec!(ssh, cmd, allowFailure)
+                else
+                    # TODO
+                end
             end
 
             def pgsqlDir(distroID)