mahout 1.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 9a23149a2c8d4ea854eaeb79118864ed439ef1a3a76a67000c824547b80d5feb
+  data.tar.gz: 913d23fa0ea7103a707fc10ffda3494956a0e1f439588e24375c85493402b43a
+SHA512:
+  metadata.gz: 4ed8db2538f03d29b17f0b7bc1fbc28f98e7847a585ce8ca375e84263d7f0d80ed18e44eaa5a57e16492b7104931f7112fa196dd578a89127c73597b19dc29f5
+  data.tar.gz: f4126989a7b9761bb60d7fa81941208ecbb3a44fe0bd5b124140006ece9c816138b2f8d19cd0cb7c93cd3abab8f604d79f747b27570c9252964c289508ee66eb

data/config/mahout.example.yml

@@ -0,0 +1,55 @@
+server:
+  host: 10.0.1.5
+  user: root
+  key: ~/.ssh/id_rsa
+
+instance:
+  name: mahout-prod
+  environment: production
+
+postgres:
+  version: 17
+  port: 5432
+  database: mahout
+  username: mahout
+
+profile: aggressive
+
+storage:
+  data_device: /dev/sdb
+  data_mount: /mnt/pgdata
+  wal_device: /dev/nvme0n1
+  wal_mount: /mnt/pgwal
+
+pgbouncer:
+  port: 6432
+  pool_mode: transaction
+
+pgbackrest:
+  enabled: true              # set to false to disable pgbackrest entirely
+  stanza: mahout
+  repo_type: s3
+  s3_bucket: mahout-backups
+  s3_endpoint: s3.amazonaws.com
+  s3_region: us-east-1
+  s3_uri_style: host
+  retention_full: 4
+  process_max: 4
+
+datadog:
+  enabled: true
+  tags:
+    - service:mahout
+    - env:production
+
+hardening:
+  allowed_cidrs:
+    - 10.0.0.0/8
+    - 172.16.0.0/12
+  ssl_required: true
+
+extensions:
+  - pg_stat_statements
+  - pg_trgm
+  - btree_gist
+  - pgcrypto

data/config/templates/datadog-pgbackrest-check.py

@@ -0,0 +1,54 @@
+import json
+import subprocess
+import time
+
+from datadog_checks.base import AgentCheck
+
+
+class PgBackRestCheck(AgentCheck):
+    def check(self, instance):
+        stanza = instance.get("stanza", "main")
+
+        try:
+            result = subprocess.run(
+                ["sudo", "-u", "postgres", "pgbackrest", "--stanza", stanza, "info", "--output", "json"],
+                capture_output=True,
+                text=True,
+                timeout=30,
+            )
+
+            if result.returncode != 0:
+                self.service_check("pgbackrest.can_connect", self.CRITICAL, message=result.stderr)
+                return
+
+            info = json.loads(result.stdout)
+            if not info:
+                self.service_check("pgbackrest.can_connect", self.WARNING, message="no stanza info")
+                return
+
+            self.service_check("pgbackrest.can_connect", self.OK)
+
+            backups = info[0].get("backup", [])
+            if backups:
+                latest = backups[-1]
+                backup_time = latest["timestamp"]["stop"]
+                age_seconds = int(time.time()) - backup_time
+                backup_size = latest["info"]["size"]
+                backup_type = latest["type"]
+
+                tags = [f"stanza:{stanza}", f"backup_type:{backup_type}"]
+                self.gauge("pgbackrest.backup.age_seconds", age_seconds, tags=tags)
+                self.gauge("pgbackrest.backup.size_bytes", backup_size, tags=tags)
+
+            archive = info[0].get("archive", [])
+            if archive:
+                db = archive[-1].get("database", {})
+                wal_min = archive[-1].get("min", "")
+                wal_max = archive[-1].get("max", "")
+                tags = [f"stanza:{stanza}"]
+                self.gauge("pgbackrest.wal.archive_lag", 0, tags=tags)
+
+        except subprocess.TimeoutExpired:
+            self.service_check("pgbackrest.can_connect", self.CRITICAL, message="timeout")
+        except Exception as e:
+            self.service_check("pgbackrest.can_connect", self.CRITICAL, message=str(e))

data/config/templates/datadog-postgres.yaml.erb

@@ -0,0 +1,29 @@
+init_config:
+
+instances:
+  - host: 127.0.0.1
+    port: <%= config.pg_port %>
+    username: datadog
+    password: datadog
+    dbname: <%= config.pg_database %>
+    collect_activity_metrics: true
+    collect_database_size_metrics: true
+    collect_default_database: false
+    collect_wal_metrics: true
+    query_metrics:
+      enabled: true
+    query_activity:
+      enabled: true
+    query_samples:
+      enabled: true
+      explain_parameterized_queries: true
+      explain_function: datadog.explain_statement
+    collect_bloat_metrics: true
+    relations:
+      - relation_regex: .*
+        schemas:
+          - public
+    tags:
+<%- config.datadog_tags.each do |tag| -%>
+      - <%= tag %>
+<%- end -%>

data/config/templates/pg_hba.conf.erb

@@ -0,0 +1,8 @@
+local   all             all                                     peer
+host    all             all             127.0.0.1/32            scram-sha-256
+host    all             all             ::1/128                 scram-sha-256
+<%- config.allowed_cidrs.each do |cidr| -%>
+hostssl all             all             <%= cidr %>            scram-sha-256
+<%- end -%>
+host    all             all             0.0.0.0/0               reject
+host    all             all             ::/0                    reject

data/config/templates/pgbackrest.conf.erb

@@ -0,0 +1,24 @@
+[global]
+repo1-type=s3
+repo1-path=/pgbackrest/<%= config.pgbackrest_stanza %>
+repo1-s3-bucket=<%= config.pgbackrest_s3_bucket %>
+repo1-s3-endpoint=<%= config.pgbackrest_s3_endpoint %>
+repo1-s3-region=<%= config.pgbackrest_s3_region %>
+repo1-s3-key=<%= s3_key %>
+repo1-s3-key-secret=<%= s3_secret %>
+repo1-s3-uri-style=<%= config.pgbackrest_s3_uri_style %>
+repo1-retention-full=<%= config.pgbackrest_retention_full %>
+repo1-cipher-type=none
+
+process-max=<%= process_max %>
+compress-type=zst
+compress-level=3
+delta=y
+start-fast=y
+
+log-level-console=info
+log-level-file=detail
+
+[<%= config.pgbackrest_stanza %>]
+pg1-path=<%= config.pg_data_dir %>
+pg1-port=<%= config.pg_port %>

data/config/templates/pgbouncer.ini.erb

@@ -0,0 +1,13 @@
+[databases]
+<%= config.pg_database %> = host=127.0.0.1 port=<%= config.pg_port %> dbname=<%= config.pg_database %>
+
+[pgbouncer]
+listen_addr = *
+listen_port = <%= config.pgbouncer_port %>
+auth_type = scram-sha-256
+auth_file = /etc/pgbouncer/userlist.txt
+pool_mode = <%= config.pgbouncer_pool_mode %>
+default_pool_size = <%= tuned[:pgbouncer_default_pool_size] || 25 %>
+max_client_conn = <%= tuned[:pgbouncer_max_client_conn] || 400 %>
+admin_users = postgres
+stats_users = postgres

data/config/templates/postgresql.conf.erb

@@ -0,0 +1,80 @@
+listen_addresses = '*'
+port = <%= config.pg_port %>
+max_connections = <%= tuned[:max_connections] %>
+superuser_reserved_connections = <%= tuned[:superuser_reserved_connections] %>
+
+tcp_keepalives_idle = 60
+tcp_keepalives_interval = 10
+tcp_keepalives_count = 6
+
+shared_buffers = <%= tuned[:shared_buffers] %>
+effective_cache_size = <%= tuned[:effective_cache_size] %>
+work_mem = <%= tuned[:work_mem] %>
+maintenance_work_mem = <%= tuned[:maintenance_work_mem] %>
+wal_buffers = <%= tuned[:wal_buffers] %>
+hash_mem_multiplier = <%= tuned[:hash_mem_multiplier] %>
+
+huge_pages = <%= tuned[:huge_pages] %>
+
+max_wal_size = <%= tuned[:max_wal_size] %>
+min_wal_size = <%= tuned[:min_wal_size] %>
+checkpoint_completion_target = <%= tuned[:checkpoint_completion_target] %>
+checkpoint_timeout = <%= tuned[:checkpoint_timeout] %>
+checkpoint_warning = <%= tuned[:checkpoint_warning] %>
+
+wal_level = <%= tuned[:wal_level] %>
+archive_timeout = <%= tuned[:archive_timeout] %>
+
+random_page_cost = <%= tuned[:random_page_cost] %>
+effective_io_concurrency = <%= tuned[:effective_io_concurrency] %>
+
+max_parallel_workers_per_gather = <%= tuned[:max_parallel_workers_per_gather] %>
+max_parallel_workers = <%= tuned[:max_parallel_workers] %>
+max_worker_processes = <%= tuned[:max_worker_processes] %>
+parallel_leader_participation = <%= tuned[:parallel_leader_participation] %>
+
+autovacuum_max_workers = <%= tuned[:autovacuum_max_workers] %>
+autovacuum_naptime = <%= tuned[:autovacuum_naptime] %>
+autovacuum_vacuum_scale_factor = <%= tuned[:autovacuum_vacuum_scale_factor] %>
+autovacuum_analyze_scale_factor = <%= tuned[:autovacuum_analyze_scale_factor] %>
+autovacuum_vacuum_cost_limit = <%= tuned[:autovacuum_vacuum_cost_limit] %>
+autovacuum_vacuum_cost_delay = <%= tuned[:autovacuum_vacuum_cost_delay] %>
+autovacuum_work_mem = <%= tuned[:autovacuum_work_mem] %>
+vacuum_buffer_usage_limit = <%= tuned[:vacuum_buffer_usage_limit] %>
+
+bgwriter_lru_maxpages = <%= tuned[:bgwriter_lru_maxpages] %>
+
+<%- unless preload_libraries.empty? -%>
+shared_preload_libraries = '<%= preload_libraries.join(",") %>'
+<%- end -%>
+
+password_encryption = scram-sha-256
+
+log_line_prefix = '<%= tuned[:log_line_prefix] %>'
+log_min_duration_statement = 500
+log_checkpoints = on
+log_lock_waits = on
+log_temp_files = 0
+log_connections = on
+log_disconnections = on
+
+track_io_timing = on
+
+pg_stat_statements.max = <%= tuned[:pg_stat_statements_max] %>
+pg_stat_statements.track = <%= tuned[:pg_stat_statements_track] %>
+pg_stat_statements.track_utility = <%= tuned[:pg_stat_statements_track_utility] %>
+
+pg_prewarm.autoprewarm = on
+pg_prewarm.autoprewarm_interval = 300
+
+jit = off
+
+data_directory = '<%= config.pg_data_dir %>'
+
+restore_command = 'pgbackrest --stanza=<%= config.pgbackrest_stanza %> archive-get %f %p'
+
+<%- config.postgres_overrides.each do |key, value| -%>
+<%= key %> = <%= value %>
+<%- end -%>
+
+include_dir = 'conf.d'

data/exe/mahout

@@ -0,0 +1,6 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require "mahout"
+
+Mahout::CLI.start(ARGV)

data/lib/mahout/backup.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module Mahout
+  class Backup
+    def initialize(runner:, config:)
+      @runner = runner
+      @config = config
+    end
+
+    def call(type: "full")
+      raise Error, "pgbackrest is disabled in config" unless @config.pgbackrest_enabled?
+
+      stanza = @config.pgbackrest_stanza
+
+      $stdout.puts("starting #{type} backup for stanza #{stanza}")
+
+      @runner.run(
+        "sudo -u postgres pgbackrest --stanza=#{stanza} --type=#{type} backup",
+        sudo: false
+      )
+
+      @runner.run(
+        "sudo -u postgres pgbackrest --stanza=#{stanza} check",
+        sudo: false
+      )
+
+      result = @runner.run(
+        "sudo -u postgres pgbackrest --stanza=#{stanza} info --output json",
+        sudo: false
+      )
+
+      $stdout.puts("backup complete")
+      print_summary(result) unless @runner.dry_run?
+    end
+
+    private
+
+    def print_summary(result)
+      info = JSON.parse(result.stdout)
+      return if info.empty?
+
+      backups = info.first["backup"]
+      return if backups.nil? || backups.empty?
+
+      latest = backups.last
+      $stdout.puts("  type: #{latest["type"]}")
+      $stdout.puts("  timestamp: #{latest["timestamp"]["start"]}")
+      $stdout.puts("  size: #{latest["info"]["size"]}")
+    end
+  end
+end