Add postgres + WIP plume + fix diplonat

9 files changed, 274 insertions, 0 deletions

diff --git a/cluster/prod/app/postgres/build/docker-compose.yml b/cluster/prod/app/postgres/build/docker-compose.yml
new file mode 100644
index 0000000..852dd7b
--- /dev/null
+++ b/cluster/prod/app/postgres/build/docker-compose.yml
@@ -0,0 +1,9 @@
+version: '3.4'
+services:
+  postgres:
+    build:
+      args:
+        # https://github.com/sorintlab/stolon/releases
+        STOLON_VERSION: 3bb7499f815f77140551eb762b200cf4557f57d3
+      context: ./postgres
+    image: superboum/amd64_postgres:v11
diff --git a/cluster/prod/app/postgres/build/postgres/0001-Add-max-rate-to-pg_basebackup.patch b/cluster/prod/app/postgres/build/postgres/0001-Add-max-rate-to-pg_basebackup.patch
new file mode 100644
index 0000000..9277ac4
--- /dev/null
+++ b/cluster/prod/app/postgres/build/postgres/0001-Add-max-rate-to-pg_basebackup.patch
@@ -0,0 +1,25 @@
+From c4e0e967752868626772a3317a17d25d181daeda Mon Sep 17 00:00:00 2001
+From: Quentin Dufour <quentin@deuxfleurs.fr>
+Date: Thu, 15 Apr 2021 12:35:12 +0200
+Subject: [PATCH] Add max-rate to pg_basebackup
+
+---
+ internal/postgresql/postgresql.go | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/internal/postgresql/postgresql.go b/internal/postgresql/postgresql.go
+index 00c14bc..a37a28c 100644
+--- a/internal/postgresql/postgresql.go
++++ b/internal/postgresql/postgresql.go
+@@ -963,7 +963,7 @@ func (p *Manager) SyncFromFollowed(followedConnParams ConnParams, replSlot strin
+ 
+ 	log.Infow("running pg_basebackup")
+ 	name := filepath.Join(p.pgBinPath, "pg_basebackup")
+-	args := []string{"-R", "-v", "-P", "-Xs", "-D", p.dataDir, "-d", followedConnString}
++	args := []string{"-R", "-v", "-P", "--max-rate", "5M", "-Xs", "-D", p.dataDir, "-d", followedConnString}
+ 	if replSlot != "" {
+ 		args = append(args, "--slot", replSlot)
+ 	}
+-- 
+2.30.2
+
diff --git a/cluster/prod/app/postgres/build/postgres/Dockerfile b/cluster/prod/app/postgres/build/postgres/Dockerfile
new file mode 100644
index 0000000..d7b3473
--- /dev/null
+++ b/cluster/prod/app/postgres/build/postgres/Dockerfile
@@ -0,0 +1,16 @@
+FROM golang:1.19.0-bullseye AS builder
+
+ARG STOLON_VERSION
+WORKDIR /stolon
+RUN git clone https://github.com/sorintlab/stolon .
+RUN git pull && git checkout ${STOLON_VERSION}
+RUN go mod download
+COPY 0001-Add-max-rate-to-pg_basebackup.patch .
+RUN git apply 0001-Add-max-rate-to-pg_basebackup.patch
+RUN make && chmod +x /stolon/bin/*
+
+FROM postgres:14.5-bullseye
+COPY --from=builder /stolon/bin /usr/local/bin
+USER postgres
+ENTRYPOINT []
+CMD ["/bin/bash"]
diff --git a/cluster/prod/app/postgres/build/postgres/postgresql.conf b/cluster/prod/app/postgres/build/postgres/postgresql.conf
new file mode 100644
index 0000000..8e0af2b
--- /dev/null
+++ b/cluster/prod/app/postgres/build/postgres/postgresql.conf
@@ -0,0 +1,25 @@
+data_directory = '/var/lib/postgresql/9.6/main'		# use data in another directory
+hba_file = '/etc/postgresql/9.6/main/pg_hba.conf'	# host-based authentication file
+ident_file = '/etc/postgresql/9.6/main/pg_ident.conf'	# ident configuration file
+external_pid_file = '/var/run/postgresql/9.6-main.pid'			# write an extra PID file
+listen_addresses = '*' #listen on every ip / interfaces
+port = 5432				# (change requires restart)
+max_connections = 100			# (change requires restart)
+unix_socket_directories = '/var/run/postgresql'	# comma-separated list of directories
+ssl = true				# (change requires restart)
+ssl_cert_file = '/etc/ssl/certs/ssl-cert-snakeoil.pem'		# (change requires restart)
+ssl_key_file = '/etc/ssl/private/ssl-cert-snakeoil.key'		# (change requires restart)
+shared_buffers = 128MB			# min 128kB
+dynamic_shared_memory_type = posix	# the default is the first option
+log_line_prefix = '%m [%p] %q%u@%d '			# special values:
+log_timezone = 'UTC'
+cluster_name = '9.6/main'			# added to process titles if nonempty
+stats_temp_directory = '/var/run/postgresql/9.6-main.pg_stat_tmp'
+datestyle = 'iso, mdy'
+timezone = 'UTC'
+lc_messages = 'C.UTF-8'			# locale for system error message
+lc_monetary = 'C.UTF-8'			# locale for monetary formatting
+lc_numeric = 'C.UTF-8'			# locale for number formatting
+lc_time = 'C.UTF-8'				# locale for time formatting
+default_text_search_config = 'pg_catalog.english'
+
diff --git a/cluster/prod/app/postgres/config/keeper/env.tpl b/cluster/prod/app/postgres/config/keeper/env.tpl
new file mode 100644
index 0000000..7831aad
--- /dev/null
+++ b/cluster/prod/app/postgres/config/keeper/env.tpl
@@ -0,0 +1,3 @@
+PG_SU_PWD={{ key "secrets/postgres/keeper/pg_su_pwd" | trimSpace }}
+PG_REPL_USER={{ key "secrets/postgres/keeper/pg_repl_username" | trimSpace }}
+PG_REPL_PWD={{ key "secrets/postgres/keeper/pg_repl_pwd" | trimSpace }}
diff --git a/cluster/prod/app/postgres/deploy/postgres.hcl b/cluster/prod/app/postgres/deploy/postgres.hcl
new file mode 100644
index 0000000..1b14b12
--- /dev/null
+++ b/cluster/prod/app/postgres/deploy/postgres.hcl
@@ -0,0 +1,193 @@
+job "postgres14" {
+  datacenters = ["orion"]
+  type = "system"
+  priority = 90
+
+  update {
+    max_parallel = 1
+    min_healthy_time  = "2m"
+    healthy_deadline  = "5m"
+    auto_revert = true
+  }
+
+  group "postgres" {
+    network {
+      port "psql_proxy_port" { static = 5432 }
+      port "psql_port" { static = 5433 }
+    }
+
+    task "sentinel" {
+      driver = "docker"
+
+      config {
+        image = "superboum/amd64_postgres:v11"
+        network_mode = "host" 
+        readonly_rootfs = false
+        command = "/usr/local/bin/stolon-sentinel"
+        args = [
+          "--cluster-name", "chelidoine",
+          "--store-backend", "consul",
+          "--store-endpoints", "https://consul.service.prod.consul:8501",
+          "--store-ca-file", "/certs/consul-ca.crt",
+          "--store-cert-file", "/certs/consul-client.crt",
+          "--store-key", "/certs/consul-client.key",
+        ]
+        volumes = [
+          "secrets/certs:/certs",
+        ]
+      }
+      resources {
+        memory = 100
+      }
+
+      template {
+        data = "{{ key \"secrets/consul/consul-ca.crt\" }}"
+        destination = "secrets/certs/consul-ca.crt"
+      }
+      template {
+        data = "{{ key \"secrets/consul/consul-client.crt\" }}"
+        destination = "secrets/certs/consul-client.crt"
+      }
+      template {
+        data = "{{ key \"secrets/consul/consul-client.key\" }}"
+        destination = "secrets/certs/consul-client.key"
+      }
+    }
+
+    task "proxy" {
+      driver = "docker"
+
+      config {
+        image = "superboum/amd64_postgres:v11"
+        network_mode = "host" 
+        readonly_rootfs = false
+        command = "/usr/local/bin/stolon-proxy"
+        args = [
+          "--cluster-name", "chelidoine",
+          "--store-backend", "consul",
+          "--store-endpoints", "https://consul.service.prod.consul:8501",
+          "--store-ca-file", "/certs/consul-ca.crt",
+          "--store-cert-file", "/certs/consul-client.crt",
+          "--store-key", "/certs/consul-client.key",
+          "--port", "${NOMAD_PORT_psql_proxy_port}",
+          "--listen-address", "0.0.0.0",
+          "--log-level", "info"
+        ]
+        volumes = [
+          "secrets/certs:/certs",
+        ]
+        ports = [ "psql_proxy_port" ]
+      }
+
+      resources {
+        memory = 100
+      }
+
+      template {
+        data = "{{ key \"secrets/consul/consul-ca.crt\" }}"
+        destination = "secrets/certs/consul-ca.crt"
+      }
+      template {
+        data = "{{ key \"secrets/consul/consul-client.crt\" }}"
+        destination = "secrets/certs/consul-client.crt"
+      }
+      template {
+        data = "{{ key \"secrets/consul/consul-client.key\" }}"
+        destination = "secrets/certs/consul-client.key"
+      }
+
+      service {
+        tags = ["sql"]
+        port = "psql_proxy_port"
+        address_mode = "host"
+        name = "psql-proxy"
+        check {
+          type = "tcp"
+          port = "psql_proxy_port"
+          interval = "60s"
+          timeout = "5s"
+          check_restart {
+            limit = 3
+            grace = "10m"
+            ignore_warnings = false
+          }
+        }
+      }
+    }
+
+    task "keeper" {
+      driver = "docker"
+
+      config {
+        image = "superboum/amd64_postgres:v11"
+        network_mode = "host" 
+        readonly_rootfs = false
+        command = "/usr/local/bin/stolon-keeper"
+        args = [
+          "--cluster-name", "chelidoine",
+          "--store-backend", "consul",
+          "--store-endpoints", "https://consul.service.prod.consul:8501",
+          "--store-ca-file", "/certs/consul-ca.crt",
+          "--store-cert-file", "/certs/consul-client.crt",
+          "--store-key", "/certs/consul-client.key",
+          "--data-dir", "/mnt/persist",
+          "--pg-su-password", "${PG_SU_PWD}",
+          "--pg-repl-username", "${PG_REPL_USER}",
+          "--pg-repl-password", "${PG_REPL_PWD}",
+          /*
+	   The postgres daemon accepts 0.0.0.0, ::, and * here but not Stolon.
+           Otherwise you will have the following error and your cluster will be broken (no replication)
+           WARN	cmd/keeper.go:1979	provided --pg-listen-address "*": is not an ip address but a hostname. This will be advertized to the other components and may have undefined behaviors if resolved differently by other hosts
+           WARN	cmd/keeper.go:1984	cannot resolve provided --pg-listen-address "*": lookup *: no such host
+          */
+          "--pg-listen-address", "${attr.unique.network.ip-address}",
+          "--pg-port", "${NOMAD_PORT_psql_port}",
+          "--pg-bin-path", "/usr/lib/postgresql/14/bin/"
+        ]
+        ports = [ "psql_port" ]
+        volumes = [
+          "/mnt/ssd/postgres:/mnt/persist",
+          "/mnt/storage/postgres_extended:/mnt/slow",
+          "secrets/certs:/certs"
+        ]
+      }
+
+      template {
+        data = file("../config/keeper/env.tpl")
+        destination = "secrets/env"
+        env = true
+      }
+
+      template {
+        data = "{{ key \"secrets/consul/consul-ca.crt\" }}"
+        destination = "secrets/certs/consul-ca.crt"
+      }
+      template {
+        data = "{{ key \"secrets/consul/consul-client.crt\" }}"
+        destination = "secrets/certs/consul-client.crt"
+      }
+      template {
+        data = "{{ key \"secrets/consul/consul-client.key\" }}"
+        destination = "secrets/certs/consul-client.key"
+      }
+
+      resources {
+        memory = 1000
+      }
+
+      service {
+        tags = ["sql"]
+        port = "psql_port"
+        address_mode = "host"
+        name = "psql-keeper"
+        check {
+          type = "tcp"
+          port = "psql_port"
+          interval = "60s"
+          timeout = "5s"
+        }
+      }
+    }
+  }
+}
+
diff --git a/cluster/prod/app/postgres/secrets/postgres/keeper/pg_repl_pwd b/cluster/prod/app/postgres/secrets/postgres/keeper/pg_repl_pwd
new file mode 100644
index 0000000..ae0c229
--- /dev/null
+++ b/cluster/prod/app/postgres/secrets/postgres/keeper/pg_repl_pwd
@@ -0,0 +1 @@
+SERVICE_PASSWORD replicator
diff --git a/cluster/prod/app/postgres/secrets/postgres/keeper/pg_repl_username b/cluster/prod/app/postgres/secrets/postgres/keeper/pg_repl_username
new file mode 100644
index 0000000..58e6e46
--- /dev/null
+++ b/cluster/prod/app/postgres/secrets/postgres/keeper/pg_repl_username
@@ -0,0 +1 @@
+CONST replicator
diff --git a/cluster/prod/app/postgres/secrets/postgres/keeper/pg_su_pwd b/cluster/prod/app/postgres/secrets/postgres/keeper/pg_su_pwd
new file mode 100644
index 0000000..907e2b8
--- /dev/null
+++ b/cluster/prod/app/postgres/secrets/postgres/keeper/pg_su_pwd
@@ -0,0 +1 @@
+USER postgres superuser password