active_postgres 0.6.0 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cccb8eff8b3ff2ae0f3413bef89b81a1b5b487e474222a9ff3e85fc74e57c5e9
-  data.tar.gz: 05a21ba9f1a29b6b5d451b3c059fd6a15135b8d6ecd7bad7d6232e6c30a5d63a
+  metadata.gz: 503ec5557f2365458cfe544af059bb5636e82be153a58926978c62ff43384b6f
+  data.tar.gz: 20d9bad0c0cbde26d214d304f379854d8d8dd548f06f86462840dad56f0f4580
 SHA512:
-  metadata.gz: '05819a2a73506fb087831e9ad69b6901b8bd6f14f0559a8e08d8c7fbbbff5c20eabc616bf0c862dd95757dab18a52666d8c0c1c00a63dc23b2094849160ce80b'
-  data.tar.gz: 2733384099851358c38788c41f77768e7a781cd99b7492aa4c10c85758a520167ad954657e0842d7b55681b2f932515933e887706ba3e2d39a50c44fdbd1e7e5
+  metadata.gz: 26ad8c310458b4e4ecdce1586b98cce9b062260b060e8779481e965c3d2c3d092a93691956372dbf62bd3e138d2b68e97b9dc135748da8a5f4481b683d739c1b
+  data.tar.gz: c9ee9f54f725cf43398815a79c621579ac1dad70b36ab997a413905a8cd5222eea42ca0e3397928f26ccf48fc1f1c10da18d9aef31cabfd62eff4ab3aadd0f84

data/lib/active_postgres/components/base.rb

@@ -23,6 +23,16 @@ module ActivePostgres
 
       protected
 
+      def substitute_private_ip(pg_config, private_ip)
+        pg_config.transform_values do |value|
+          if value.is_a?(String)
+            value.gsub('${private_ip}', private_ip)
+          else
+            value
+          end
+        end
+      end
+
       def render_template(template_name, binding_context)
         template_path = File.join(ActivePostgres.root, 'templates', template_name)
         template = ERB.new(File.read(template_path), trim_mode: '-')

data/lib/active_postgres/components/core.rb

@@ -96,16 +96,6 @@ module ActivePostgres
         optimal_settings.merge(user_postgresql)
       end
 
-      def substitute_private_ip(pg_config, private_ip)
-        pg_config.transform_values do |value|
-          if value.is_a?(String)
-            value.gsub('${private_ip}', private_ip)
-          else
-            value
-          end
-        end
-      end
-
       def install_packages_only(host)
         puts "  Installing packages on #{host} (cluster will be created by repmgr)..."
         ssh_executor.install_postgres(host, config.version)

data/lib/active_postgres/components/pgbouncer.rb

@@ -52,37 +52,50 @@ module ActivePostgres
       def install_on_host(host)
         puts "  Installing PgBouncer on #{host}..."
 
-        # Get user config
         user_config = config.component_config(:pgbouncer)
 
-        # Calculate optimal pool settings based on PostgreSQL max_connections
         max_connections = get_postgres_max_connections(host)
         optimal_pool = ConnectionPooler.calculate_optimal_pool_sizes(max_connections)
 
-        # Merge: user config overrides calculated settings
         pgbouncer_config = optimal_pool.merge(user_config)
-        _ = pgbouncer_config # Used in ERB template
+        ssl_enabled = config.component_enabled?(:ssl)
 
         puts "  Calculated pool settings for max_connections=#{max_connections}"
 
-        # Install package
         ssh_executor.execute_on_host(host) do
           execute :sudo, 'apt-get', 'install', '-y', '-qq', 'pgbouncer'
         end
 
-        # Upload configuration
         upload_template(host, 'pgbouncer.ini.erb', '/etc/pgbouncer/pgbouncer.ini', binding, mode: '644')
 
-        # Create userlist with postgres superuser and app user
+        setup_ssl_certs(host) if ssl_enabled
+
         create_userlist(host)
 
-        # Enable and start
         ssh_executor.execute_on_host(host) do
           execute :sudo, 'systemctl', 'enable', 'pgbouncer'
           execute :sudo, 'systemctl', 'restart', 'pgbouncer'
         end
       end
 
+      def setup_ssl_certs(host)
+        puts '  Setting up SSL certificates for PgBouncer...'
+        version = config.version
+
+        ssh_executor.execute_on_host(host) do
+          execute :sudo, 'cp', "/etc/postgresql/#{version}/main/server.crt", '/etc/pgbouncer/server.crt'
+          execute :sudo, 'cp', "/etc/postgresql/#{version}/main/server.key", '/etc/pgbouncer/server.key'
+          execute :sudo, 'chmod', '640', '/etc/pgbouncer/server.key'
+          execute :sudo, 'chown', 'postgres:postgres', '/etc/pgbouncer/server.key'
+          execute :sudo, 'chown', 'postgres:postgres', '/etc/pgbouncer/server.crt'
+        end
+
+        ssl_chain = secrets.resolve('ssl_chain')
+        if ssl_chain
+          ssh_executor.upload_file(host, ssl_chain, '/etc/pgbouncer/ca.crt', mode: '644', owner: 'postgres:postgres')
+        end
+      end
+
       def get_postgres_max_connections(host)
         # Try to get max_connections from running PostgreSQL
         postgres_user = config.postgres_user

data/lib/active_postgres/components/repmgr.rb

@@ -107,6 +107,9 @@ module ActivePostgres
 
         # Performance tuning is handled by the Core component
         pg_config = component_config[:postgresql] || {}
+        # Substitute ${private_ip} with the host's actual private IP
+        private_ip = config.replication_host_for(host)
+        pg_config = substitute_private_ip(pg_config, private_ip)
         _ = pg_config # Used in ERB template
 
         upload_template(host, 'postgresql.conf.erb', "/etc/postgresql/#{version}/main/postgresql.conf", binding,
@@ -307,6 +310,9 @@ module ActivePostgres
 
         # Performance tuning is handled by the Core component
         pg_config = component_config[:postgresql] || {}
+        # Substitute ${private_ip} with the standby's actual private IP
+        private_ip = config.replication_host_for(standby_host)
+        pg_config = substitute_private_ip(pg_config, private_ip)
         _ = pg_config # Used in ERB template
 
         ssh_executor.execute_on_host(standby_host) do

data/lib/active_postgres/version.rb

@@ -1,3 +1,3 @@
 module ActivePostgres
-  VERSION = '0.6.0'.freeze
+  VERSION = '0.7.0'.freeze
 end

data/templates/pgbouncer.ini.erb

@@ -44,6 +44,14 @@ log_connections = <%= pgbouncer_config[:log_connections] || 1 %>
 log_disconnections = <%= pgbouncer_config[:log_disconnections] || 1 %>
 log_pooler_errors = <%= pgbouncer_config[:log_pooler_errors] || 1 %>
 
+<% if ssl_enabled %>
+# Client TLS (incoming connections from Rails)
+client_tls_sslmode = require
+client_tls_key_file = /etc/pgbouncer/server.key
+client_tls_cert_file = /etc/pgbouncer/server.crt
+client_tls_ca_file = /etc/pgbouncer/ca.crt
+<% end %>
+
 # Process management
 <% if pgbouncer_config[:pidfile] %>
 pidfile = <%= pgbouncer_config[:pidfile] %>

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: active_postgres
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.7.0
 platform: ruby
 authors:
 - BoringCache