aboutsummaryrefslogtreecommitdiff
path: root/cluster/prod/app
diff options
context:
space:
mode:
authorQuentin Dufour <quentin@deuxfleurs.fr>2022-08-24 19:54:15 +0200
committerQuentin Dufour <quentin@deuxfleurs.fr>2022-08-24 19:54:15 +0200
commit00b754727d9b16b13de7591b07d5bf0635029c4b (patch)
treef0e68c18b2578e6c20c66cbe736a5cafe2037423 /cluster/prod/app
parent1172e8e511c26e43bb23bcc265465b7284485e17 (diff)
downloadnixcfg-00b754727d9b16b13de7591b07d5bf0635029c4b.tar.gz
nixcfg-00b754727d9b16b13de7591b07d5bf0635029c4b.zip
Add postgres + WIP plume + fix diplonat
Diffstat (limited to 'cluster/prod/app')
-rw-r--r--cluster/prod/app/core/deploy/core.hcl3
-rw-r--r--cluster/prod/app/plume/build/docker-compose.yml8
-rw-r--r--cluster/prod/app/plume/build/plume/Dockerfile54
-rw-r--r--cluster/prod/app/plume/build/plume/README.md3
-rw-r--r--cluster/prod/app/plume/config/app.env32
-rw-r--r--cluster/prod/app/plume/deploy/plume.hcl82
-rw-r--r--cluster/prod/app/plume/integration/bottin.json31
-rw-r--r--cluster/prod/app/plume/integration/docker-compose.yml28
-rw-r--r--cluster/prod/app/plume/integration/plume.env31
-rw-r--r--cluster/prod/app/plume/secrets/plume/backup_aws_access_key_id1
-rw-r--r--cluster/prod/app/plume/secrets/plume/backup_aws_secret_access_key1
-rw-r--r--cluster/prod/app/plume/secrets/plume/backup_restic_password1
-rw-r--r--cluster/prod/app/plume/secrets/plume/backup_restic_repository1
-rw-r--r--cluster/prod/app/plume/secrets/plume/pgsql_pw1
-rw-r--r--cluster/prod/app/plume/secrets/plume/secret_key1
-rw-r--r--cluster/prod/app/postgres/build/docker-compose.yml9
-rw-r--r--cluster/prod/app/postgres/build/postgres/0001-Add-max-rate-to-pg_basebackup.patch25
-rw-r--r--cluster/prod/app/postgres/build/postgres/Dockerfile16
-rw-r--r--cluster/prod/app/postgres/build/postgres/postgresql.conf25
-rw-r--r--cluster/prod/app/postgres/config/keeper/env.tpl3
-rw-r--r--cluster/prod/app/postgres/deploy/postgres.hcl193
-rw-r--r--cluster/prod/app/postgres/secrets/postgres/keeper/pg_repl_pwd1
-rw-r--r--cluster/prod/app/postgres/secrets/postgres/keeper/pg_repl_username1
-rw-r--r--cluster/prod/app/postgres/secrets/postgres/keeper/pg_su_pwd1
24 files changed, 551 insertions, 1 deletions
diff --git a/cluster/prod/app/core/deploy/core.hcl b/cluster/prod/app/core/deploy/core.hcl
index b2acb43..274cb5b 100644
--- a/cluster/prod/app/core/deploy/core.hcl
+++ b/cluster/prod/app/core/deploy/core.hcl
@@ -1,5 +1,5 @@
job "core" {
- datacenters = ["dc1", "neptune"]
+ datacenters = ["orion", "neptune"]
type = "system"
priority = 90
@@ -21,6 +21,7 @@ job "core" {
image = "lxpz/amd64_diplonat:4"
network_mode = "host"
readonly_rootfs = true
+ privileged = true
volumes = [
"secrets:/etc/diplonat",
]
diff --git a/cluster/prod/app/plume/build/docker-compose.yml b/cluster/prod/app/plume/build/docker-compose.yml
new file mode 100644
index 0000000..560f539
--- /dev/null
+++ b/cluster/prod/app/plume/build/docker-compose.yml
@@ -0,0 +1,8 @@
+version: '3.4'
+services:
+ plume:
+ build:
+ context: ./plume
+ args:
+ VERSION: 8709f6cf9f8ff7e3c5ee7ea699ee7c778e92fefc
+ image: superboum/plume:v8
diff --git a/cluster/prod/app/plume/build/plume/Dockerfile b/cluster/prod/app/plume/build/plume/Dockerfile
new file mode 100644
index 0000000..1f57a52
--- /dev/null
+++ b/cluster/prod/app/plume/build/plume/Dockerfile
@@ -0,0 +1,54 @@
+FROM rust:1.58.1-slim-bullseye as builder
+
+RUN apt-get update && \
+ apt-get install -y \
+ pkg-config \
+ git \
+ curl \
+ postgresql \
+ postgresql-contrib \
+ libpq-dev \
+ gettext \
+ git \
+ python \
+ curl \
+ gcc \
+ make \
+ openssl \
+ libssl-dev \
+ libclang-dev
+
+ARG VERSION
+WORKDIR /opt
+RUN git clone -n https://git.joinplu.me/Plume/Plume.git plume
+
+WORKDIR /opt/plume
+RUN git checkout ${VERSION}
+
+WORKDIR /opt/plume/script
+RUN chmod a+x ./wasm-deps.sh && ./wasm-deps.sh
+
+WORKDIR /opt/plume
+RUN cargo install wasm-pack
+RUN chmod a+x ./script/plume-front.sh && ./script/plume-front.sh
+RUN cargo install --path ./ --force --no-default-features --features postgres
+RUN cargo install --path plume-cli --force --no-default-features --features postgres
+RUN cargo clean
+
+#-----------------------------
+FROM debian:bullseye-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+ ca-certificates \
+ libpq5 \
+ libssl1.1 \
+ rclone \
+ fuse
+
+WORKDIR /app
+
+COPY --from=builder /opt/plume /app
+COPY --from=builder /usr/local/cargo/bin/plm /usr/local/bin/
+COPY --from=builder /usr/local/cargo/bin/plume /usr/local/bin/
+
+CMD ["plume"]
diff --git a/cluster/prod/app/plume/build/plume/README.md b/cluster/prod/app/plume/build/plume/README.md
new file mode 100644
index 0000000..6d86d81
--- /dev/null
+++ b/cluster/prod/app/plume/build/plume/README.md
@@ -0,0 +1,3 @@
+Try build:
+
+sudo docker build -t superboum/plume:v1 --build-arg VERSION=003dcf861a9f55720b03d52f2f95f5f59e338809 .
diff --git a/cluster/prod/app/plume/config/app.env b/cluster/prod/app/plume/config/app.env
new file mode 100644
index 0000000..4b389b5
--- /dev/null
+++ b/cluster/prod/app/plume/config/app.env
@@ -0,0 +1,32 @@
+BASE_URL=plume.deuxfleurs.fr
+# generate one with openssl rand -base64 32
+ROCKET_SECRET_KEY={{ key "secrets/plume/secret_key" | trimSpace }}
+
+# Mail settings
+#MAIL_SERVER=smtp.example.org
+#MAIL_USER=example
+#MAIL_PASSWORD=123456
+#MAIL_HELO_NAME=example.org
+
+# DATABASE SETUP
+POSTGRES_PASSWORD={{ key "secrets/plume/pgsql_pw" | trimSpace }}
+POSTGRES_USER=plume
+POSTGRES_DB=plume
+DATABASE_URL=postgres://plume:{{ key "secrets/plume/pgsql_pw" | trimSpace }}@psql-proxy.service.prod.consul:5432/plume
+MIGRATION_DIRECTORY=migrations/postgres
+
+USE_HTTPS=0
+ROCKET_ADDRESS=::
+ROCKET_PORT={{ env "NOMAD_PORT_web_port" }}
+
+MEDIA_UPLOAD_DIRECTORY=/app/static/media
+SEARCH_INDEX=/app/search_index
+
+LDAP_ADDR=ldap://bottin.service.prod.consul:389
+LDAP_BASE_DN=ou=users,dc=deuxfleurs,dc=fr
+LDAP_USER_NAME_ATTR=cn
+LDAP_USER_MAIL_ATTR=mail
+LDAP_TLS=false
+
+RUST_BACKTRACE=1
+RUST_LOG=info
diff --git a/cluster/prod/app/plume/deploy/plume.hcl b/cluster/prod/app/plume/deploy/plume.hcl
new file mode 100644
index 0000000..266a665
--- /dev/null
+++ b/cluster/prod/app/plume/deploy/plume.hcl
@@ -0,0 +1,82 @@
+job "plume-blog" {
+ datacenters = ["dc1"]
+ type = "service"
+
+ constraint {
+ attribute = "${attr.cpu.arch}"
+ value = "amd64"
+ }
+
+ group "plume" {
+ count = 1
+
+ network {
+ port "web_port" { }
+ }
+
+ task "plume" {
+ constraint {
+ attribute = "${attr.unique.hostname}"
+ operator = "="
+ value = "digitale"
+ }
+
+ driver = "docker"
+ config {
+ image = "superboum/plume:v8"
+ network_mode = "host"
+ ports = [ "web_port" ]
+ #command = "cat"
+ #args = [ "/dev/stdout" ]
+ volumes = [
+ "/mnt/ssd/plume/search_index:/app/search_index",
+ "/mnt/ssd/plume/media:/app/static/media"
+ ]
+ }
+
+ template {
+ data = file("../config/app.env")
+ destination = "secrets/app.env"
+ env = true
+ }
+
+ resources {
+ memory = 500
+ cpu = 100
+ }
+
+ service {
+ name = "plume"
+ tags = [
+ "plume",
+ "traefik.enable=true",
+ "traefik.frontend.entryPoints=https,http",
+ "traefik.frontend.rule=Host:plume.deuxfleurs.fr",
+ "tricot plume.deuxfleurs.fr",
+ ]
+ port = "web_port"
+ address_mode = "host"
+ check {
+ type = "http"
+ protocol = "http"
+ port = "web_port"
+ path = "/"
+ interval = "60s"
+ timeout = "5s"
+ check_restart {
+ limit = 3
+ grace = "600s"
+ ignore_warnings = false
+ }
+ }
+ }
+ restart {
+ interval = "30m"
+ attempts = 20
+ delay = "15s"
+ mode = "delay"
+ }
+ }
+ }
+}
+
diff --git a/cluster/prod/app/plume/integration/bottin.json b/cluster/prod/app/plume/integration/bottin.json
new file mode 100644
index 0000000..a970762
--- /dev/null
+++ b/cluster/prod/app/plume/integration/bottin.json
@@ -0,0 +1,31 @@
+{
+ "suffix": "dc=deuxfleurs,dc=fr",
+ "bind": "0.0.0.0:389",
+ "consul_host": "http://consul:8500",
+ "log_level": "debug",
+ "acl": [
+ "*,dc=deuxfleurs,dc=fr::read:*:* !userpassword",
+ "*::read modify:SELF:*",
+ "ANONYMOUS::bind:*,ou=users,dc=deuxfleurs,dc=fr:",
+ "ANONYMOUS::bind:cn=admin,dc=deuxfleurs,dc=fr:",
+ "*,ou=services,ou=users,dc=deuxfleurs,dc=fr::bind:*,ou=users,dc=deuxfleurs,dc=fr:*",
+ "*,ou=services,ou=users,dc=deuxfleurs,dc=fr::read:*:*",
+
+ "*:cn=asso_deuxfleurs,ou=groups,dc=deuxfleurs,dc=fr:add:*,ou=invitations,dc=deuxfleurs,dc=fr:*",
+ "ANONYMOUS::bind:*,ou=invitations,dc=deuxfleurs,dc=fr:",
+ "*,ou=invitations,dc=deuxfleurs,dc=fr::delete:SELF:*",
+
+ "*:cn=asso_deuxfleurs,ou=groups,dc=deuxfleurs,dc=fr:add:*,ou=users,dc=deuxfleurs,dc=fr:*",
+ "*,ou=invitations,dc=deuxfleurs,dc=fr::add:*,ou=users,dc=deuxfleurs,dc=fr:*",
+
+ "*:cn=asso_deuxfleurs,ou=groups,dc=deuxfleurs,dc=fr:modifyAdd:cn=email,ou=groups,dc=deuxfleurs,dc=fr:*",
+ "*,ou=invitations,dc=deuxfleurs,dc=fr::modifyAdd:cn=email,ou=groups,dc=deuxfleurs,dc=fr:*",
+ "*:cn=asso_deuxfleurs,ou=groups,dc=deuxfleurs,dc=fr:modifyAdd:cn=seafile,ou=groups,dc=deuxfleurs,dc=fr:*",
+ "*,ou=invitations,dc=deuxfleurs,dc=fr::modifyAdd:cn=seafile,ou=groups,dc=deuxfleurs,dc=fr:*",
+ "*:cn=asso_deuxfleurs,ou=groups,dc=deuxfleurs,dc=fr:modifyAdd:cn=nextcloud,ou=groups,dc=deuxfleurs,dc=fr:*",
+ "*,ou=invitations,dc=deuxfleurs,dc=fr::modifyAdd:cn=seafile,ou=nextcloud,dc=deuxfleurs,dc=fr:*",
+
+ "cn=admin,dc=deuxfleurs,dc=fr::read add modify delete:*:*",
+ "*:cn=admin,ou=groups,dc=deuxfleurs,dc=fr:read add modify delete:*:*"
+ ]
+}
diff --git a/cluster/prod/app/plume/integration/docker-compose.yml b/cluster/prod/app/plume/integration/docker-compose.yml
new file mode 100644
index 0000000..b88de8a
--- /dev/null
+++ b/cluster/prod/app/plume/integration/docker-compose.yml
@@ -0,0 +1,28 @@
+version: '3.4'
+services:
+ plume:
+ image: superboum/plume:v1
+ env_file:
+ - plume.env
+ depends_on:
+ - consul
+ - postgres
+ ports:
+ - "7878:7878"
+
+ postgres:
+ image: postgres:9.6.19
+ environment:
+ - POSTGRES_DB=plume
+ - POSTGRES_USER=plume
+ - POSTGRES_PASSWORD=plume
+
+ bottin:
+ image: lxpz/bottin_amd64:14
+ depends_on:
+ - consul
+ volumes:
+ - ./bottin.json:/config.json
+
+ consul:
+ image: consul:1.8.4
diff --git a/cluster/prod/app/plume/integration/plume.env b/cluster/prod/app/plume/integration/plume.env
new file mode 100644
index 0000000..88c62dc
--- /dev/null
+++ b/cluster/prod/app/plume/integration/plume.env
@@ -0,0 +1,31 @@
+BASE_URL=integration.env
+# generate one with openssl rand -base64 32
+ROCKET_SECRET_KEY=cXZbKoxWIBo0wdaD8tbA1B3BlH2LBSUmgzdyZZr8QxI=
+
+# Mail settings
+#MAIL_SERVER=smtp.example.org
+#MAIL_USER=example
+#MAIL_PASSWORD=123456
+#MAIL_HELO_NAME=example.org
+
+# DATABASE SETUP
+POSTGRES_PASSWORD=plume
+POSTGRES_USER=plume
+POSTGRES_DB=plume
+DATABASE_URL=postgres://plume:plume@postgres:5432/plume
+MIGRATION_DIRECTORY=migrations/postgres
+
+USE_HTTPS=0
+ROCKET_ADDRESS=0.0.0.0
+ROCKET_PORT=7878
+
+MEDIA_UPLOAD_DIRECTORY=/app/static/media
+SEARCH_INDEX=/app/search_index
+DOMAIN_NAME="integration.env"
+INSTANCE_NAME="Integration Instance"
+
+LDAP_ADDR=ldap://bottin:389
+LDAP_BASE_DN=ou=users,dc=deuxfleurs,dc=fr
+LDAP_USER_NAME_ATTR=cn
+LDAP_USER_MAIL_ATTR=mail
+LDAP_TLS=false
diff --git a/cluster/prod/app/plume/secrets/plume/backup_aws_access_key_id b/cluster/prod/app/plume/secrets/plume/backup_aws_access_key_id
new file mode 100644
index 0000000..9235e53
--- /dev/null
+++ b/cluster/prod/app/plume/secrets/plume/backup_aws_access_key_id
@@ -0,0 +1 @@
+USER Backup AWS access key ID
diff --git a/cluster/prod/app/plume/secrets/plume/backup_aws_secret_access_key b/cluster/prod/app/plume/secrets/plume/backup_aws_secret_access_key
new file mode 100644
index 0000000..f34677e
--- /dev/null
+++ b/cluster/prod/app/plume/secrets/plume/backup_aws_secret_access_key
@@ -0,0 +1 @@
+USER Backup AWS secret access key
diff --git a/cluster/prod/app/plume/secrets/plume/backup_restic_password b/cluster/prod/app/plume/secrets/plume/backup_restic_password
new file mode 100644
index 0000000..fbaa5fa
--- /dev/null
+++ b/cluster/prod/app/plume/secrets/plume/backup_restic_password
@@ -0,0 +1 @@
+USER Restic password to encrypt backups
diff --git a/cluster/prod/app/plume/secrets/plume/backup_restic_repository b/cluster/prod/app/plume/secrets/plume/backup_restic_repository
new file mode 100644
index 0000000..3f6cb93
--- /dev/null
+++ b/cluster/prod/app/plume/secrets/plume/backup_restic_repository
@@ -0,0 +1 @@
+USER Restic repository, eg. s3:https://s3.garage.tld
diff --git a/cluster/prod/app/plume/secrets/plume/pgsql_pw b/cluster/prod/app/plume/secrets/plume/pgsql_pw
new file mode 100644
index 0000000..0f831bb
--- /dev/null
+++ b/cluster/prod/app/plume/secrets/plume/pgsql_pw
@@ -0,0 +1 @@
+SERVICE_PASSWORD plume
diff --git a/cluster/prod/app/plume/secrets/plume/secret_key b/cluster/prod/app/plume/secrets/plume/secret_key
new file mode 100644
index 0000000..978be54
--- /dev/null
+++ b/cluster/prod/app/plume/secrets/plume/secret_key
@@ -0,0 +1 @@
+CMD openssl rand -base64 32
diff --git a/cluster/prod/app/postgres/build/docker-compose.yml b/cluster/prod/app/postgres/build/docker-compose.yml
new file mode 100644
index 0000000..852dd7b
--- /dev/null
+++ b/cluster/prod/app/postgres/build/docker-compose.yml
@@ -0,0 +1,9 @@
+version: '3.4'
+services:
+ postgres:
+ build:
+ args:
+ # https://github.com/sorintlab/stolon/releases
+ STOLON_VERSION: 3bb7499f815f77140551eb762b200cf4557f57d3
+ context: ./postgres
+ image: superboum/amd64_postgres:v11
diff --git a/cluster/prod/app/postgres/build/postgres/0001-Add-max-rate-to-pg_basebackup.patch b/cluster/prod/app/postgres/build/postgres/0001-Add-max-rate-to-pg_basebackup.patch
new file mode 100644
index 0000000..9277ac4
--- /dev/null
+++ b/cluster/prod/app/postgres/build/postgres/0001-Add-max-rate-to-pg_basebackup.patch
@@ -0,0 +1,25 @@
+From c4e0e967752868626772a3317a17d25d181daeda Mon Sep 17 00:00:00 2001
+From: Quentin Dufour <quentin@deuxfleurs.fr>
+Date: Thu, 15 Apr 2021 12:35:12 +0200
+Subject: [PATCH] Add max-rate to pg_basebackup
+
+---
+ internal/postgresql/postgresql.go | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/internal/postgresql/postgresql.go b/internal/postgresql/postgresql.go
+index 00c14bc..a37a28c 100644
+--- a/internal/postgresql/postgresql.go
++++ b/internal/postgresql/postgresql.go
+@@ -963,7 +963,7 @@ func (p *Manager) SyncFromFollowed(followedConnParams ConnParams, replSlot strin
+
+ log.Infow("running pg_basebackup")
+ name := filepath.Join(p.pgBinPath, "pg_basebackup")
+- args := []string{"-R", "-v", "-P", "-Xs", "-D", p.dataDir, "-d", followedConnString}
++ args := []string{"-R", "-v", "-P", "--max-rate", "5M", "-Xs", "-D", p.dataDir, "-d", followedConnString}
+ if replSlot != "" {
+ args = append(args, "--slot", replSlot)
+ }
+--
+2.30.2
+
diff --git a/cluster/prod/app/postgres/build/postgres/Dockerfile b/cluster/prod/app/postgres/build/postgres/Dockerfile
new file mode 100644
index 0000000..d7b3473
--- /dev/null
+++ b/cluster/prod/app/postgres/build/postgres/Dockerfile
@@ -0,0 +1,16 @@
+FROM golang:1.19.0-bullseye AS builder
+
+ARG STOLON_VERSION
+WORKDIR /stolon
+RUN git clone https://github.com/sorintlab/stolon .
+RUN git pull && git checkout ${STOLON_VERSION}
+RUN go mod download
+COPY 0001-Add-max-rate-to-pg_basebackup.patch .
+RUN git apply 0001-Add-max-rate-to-pg_basebackup.patch
+RUN make && chmod +x /stolon/bin/*
+
+FROM postgres:14.5-bullseye
+COPY --from=builder /stolon/bin /usr/local/bin
+USER postgres
+ENTRYPOINT []
+CMD ["/bin/bash"]
diff --git a/cluster/prod/app/postgres/build/postgres/postgresql.conf b/cluster/prod/app/postgres/build/postgres/postgresql.conf
new file mode 100644
index 0000000..8e0af2b
--- /dev/null
+++ b/cluster/prod/app/postgres/build/postgres/postgresql.conf
@@ -0,0 +1,25 @@
+data_directory = '/var/lib/postgresql/9.6/main' # use data in another directory
+hba_file = '/etc/postgresql/9.6/main/pg_hba.conf' # host-based authentication file
+ident_file = '/etc/postgresql/9.6/main/pg_ident.conf' # ident configuration file
+external_pid_file = '/var/run/postgresql/9.6-main.pid' # write an extra PID file
+listen_addresses = '*' #listen on every ip / interfaces
+port = 5432 # (change requires restart)
+max_connections = 100 # (change requires restart)
+unix_socket_directories = '/var/run/postgresql' # comma-separated list of directories
+ssl = true # (change requires restart)
+ssl_cert_file = '/etc/ssl/certs/ssl-cert-snakeoil.pem' # (change requires restart)
+ssl_key_file = '/etc/ssl/private/ssl-cert-snakeoil.key' # (change requires restart)
+shared_buffers = 128MB # min 128kB
+dynamic_shared_memory_type = posix # the default is the first option
+log_line_prefix = '%m [%p] %q%u@%d ' # special values:
+log_timezone = 'UTC'
+cluster_name = '9.6/main' # added to process titles if nonempty
+stats_temp_directory = '/var/run/postgresql/9.6-main.pg_stat_tmp'
+datestyle = 'iso, mdy'
+timezone = 'UTC'
+lc_messages = 'C.UTF-8' # locale for system error message
+lc_monetary = 'C.UTF-8' # locale for monetary formatting
+lc_numeric = 'C.UTF-8' # locale for number formatting
+lc_time = 'C.UTF-8' # locale for time formatting
+default_text_search_config = 'pg_catalog.english'
+
diff --git a/cluster/prod/app/postgres/config/keeper/env.tpl b/cluster/prod/app/postgres/config/keeper/env.tpl
new file mode 100644
index 0000000..7831aad
--- /dev/null
+++ b/cluster/prod/app/postgres/config/keeper/env.tpl
@@ -0,0 +1,3 @@
+PG_SU_PWD={{ key "secrets/postgres/keeper/pg_su_pwd" | trimSpace }}
+PG_REPL_USER={{ key "secrets/postgres/keeper/pg_repl_username" | trimSpace }}
+PG_REPL_PWD={{ key "secrets/postgres/keeper/pg_repl_pwd" | trimSpace }}
diff --git a/cluster/prod/app/postgres/deploy/postgres.hcl b/cluster/prod/app/postgres/deploy/postgres.hcl
new file mode 100644
index 0000000..1b14b12
--- /dev/null
+++ b/cluster/prod/app/postgres/deploy/postgres.hcl
@@ -0,0 +1,193 @@
+job "postgres14" {
+ datacenters = ["orion"]
+ type = "system"
+ priority = 90
+
+ update {
+ max_parallel = 1
+ min_healthy_time = "2m"
+ healthy_deadline = "5m"
+ auto_revert = true
+ }
+
+ group "postgres" {
+ network {
+ port "psql_proxy_port" { static = 5432 }
+ port "psql_port" { static = 5433 }
+ }
+
+ task "sentinel" {
+ driver = "docker"
+
+ config {
+ image = "superboum/amd64_postgres:v11"
+ network_mode = "host"
+ readonly_rootfs = false
+ command = "/usr/local/bin/stolon-sentinel"
+ args = [
+ "--cluster-name", "chelidoine",
+ "--store-backend", "consul",
+ "--store-endpoints", "https://consul.service.prod.consul:8501",
+ "--store-ca-file", "/certs/consul-ca.crt",
+ "--store-cert-file", "/certs/consul-client.crt",
+ "--store-key", "/certs/consul-client.key",
+ ]
+ volumes = [
+ "secrets/certs:/certs",
+ ]
+ }
+ resources {
+ memory = 100
+ }
+
+ template {
+ data = "{{ key \"secrets/consul/consul-ca.crt\" }}"
+ destination = "secrets/certs/consul-ca.crt"
+ }
+ template {
+ data = "{{ key \"secrets/consul/consul-client.crt\" }}"
+ destination = "secrets/certs/consul-client.crt"
+ }
+ template {
+ data = "{{ key \"secrets/consul/consul-client.key\" }}"
+ destination = "secrets/certs/consul-client.key"
+ }
+ }
+
+ task "proxy" {
+ driver = "docker"
+
+ config {
+ image = "superboum/amd64_postgres:v11"
+ network_mode = "host"
+ readonly_rootfs = false
+ command = "/usr/local/bin/stolon-proxy"
+ args = [
+ "--cluster-name", "chelidoine",
+ "--store-backend", "consul",
+ "--store-endpoints", "https://consul.service.prod.consul:8501",
+ "--store-ca-file", "/certs/consul-ca.crt",
+ "--store-cert-file", "/certs/consul-client.crt",
+ "--store-key", "/certs/consul-client.key",
+ "--port", "${NOMAD_PORT_psql_proxy_port}",
+ "--listen-address", "0.0.0.0",
+ "--log-level", "info"
+ ]
+ volumes = [
+ "secrets/certs:/certs",
+ ]
+ ports = [ "psql_proxy_port" ]
+ }
+
+ resources {
+ memory = 100
+ }
+
+ template {
+ data = "{{ key \"secrets/consul/consul-ca.crt\" }}"
+ destination = "secrets/certs/consul-ca.crt"
+ }
+ template {
+ data = "{{ key \"secrets/consul/consul-client.crt\" }}"
+ destination = "secrets/certs/consul-client.crt"
+ }
+ template {
+ data = "{{ key \"secrets/consul/consul-client.key\" }}"
+ destination = "secrets/certs/consul-client.key"
+ }
+
+ service {
+ tags = ["sql"]
+ port = "psql_proxy_port"
+ address_mode = "host"
+ name = "psql-proxy"
+ check {
+ type = "tcp"
+ port = "psql_proxy_port"
+ interval = "60s"
+ timeout = "5s"
+ check_restart {
+ limit = 3
+ grace = "10m"
+ ignore_warnings = false
+ }
+ }
+ }
+ }
+
+ task "keeper" {
+ driver = "docker"
+
+ config {
+ image = "superboum/amd64_postgres:v11"
+ network_mode = "host"
+ readonly_rootfs = false
+ command = "/usr/local/bin/stolon-keeper"
+ args = [
+ "--cluster-name", "chelidoine",
+ "--store-backend", "consul",
+ "--store-endpoints", "https://consul.service.prod.consul:8501",
+ "--store-ca-file", "/certs/consul-ca.crt",
+ "--store-cert-file", "/certs/consul-client.crt",
+ "--store-key", "/certs/consul-client.key",
+ "--data-dir", "/mnt/persist",
+ "--pg-su-password", "${PG_SU_PWD}",
+ "--pg-repl-username", "${PG_REPL_USER}",
+ "--pg-repl-password", "${PG_REPL_PWD}",
+ /*
+ The postgres daemon accepts 0.0.0.0, ::, and * here but not Stolon.
+ Otherwise you will have the following error and your cluster will be broken (no replication)
+ WARN cmd/keeper.go:1979 provided --pg-listen-address "*": is not an ip address but a hostname. This will be advertized to the other components and may have undefined behaviors if resolved differently by other hosts
+ WARN cmd/keeper.go:1984 cannot resolve provided --pg-listen-address "*": lookup *: no such host
+ */
+ "--pg-listen-address", "${attr.unique.network.ip-address}",
+ "--pg-port", "${NOMAD_PORT_psql_port}",
+ "--pg-bin-path", "/usr/lib/postgresql/14/bin/"
+ ]
+ ports = [ "psql_port" ]
+ volumes = [
+ "/mnt/ssd/postgres:/mnt/persist",
+ "/mnt/storage/postgres_extended:/mnt/slow",
+ "secrets/certs:/certs"
+ ]
+ }
+
+ template {
+ data = file("../config/keeper/env.tpl")
+ destination = "secrets/env"
+ env = true
+ }
+
+ template {
+ data = "{{ key \"secrets/consul/consul-ca.crt\" }}"
+ destination = "secrets/certs/consul-ca.crt"
+ }
+ template {
+ data = "{{ key \"secrets/consul/consul-client.crt\" }}"
+ destination = "secrets/certs/consul-client.crt"
+ }
+ template {
+ data = "{{ key \"secrets/consul/consul-client.key\" }}"
+ destination = "secrets/certs/consul-client.key"
+ }
+
+ resources {
+ memory = 1000
+ }
+
+ service {
+ tags = ["sql"]
+ port = "psql_port"
+ address_mode = "host"
+ name = "psql-keeper"
+ check {
+ type = "tcp"
+ port = "psql_port"
+ interval = "60s"
+ timeout = "5s"
+ }
+ }
+ }
+ }
+}
+
diff --git a/cluster/prod/app/postgres/secrets/postgres/keeper/pg_repl_pwd b/cluster/prod/app/postgres/secrets/postgres/keeper/pg_repl_pwd
new file mode 100644
index 0000000..ae0c229
--- /dev/null
+++ b/cluster/prod/app/postgres/secrets/postgres/keeper/pg_repl_pwd
@@ -0,0 +1 @@
+SERVICE_PASSWORD replicator
diff --git a/cluster/prod/app/postgres/secrets/postgres/keeper/pg_repl_username b/cluster/prod/app/postgres/secrets/postgres/keeper/pg_repl_username
new file mode 100644
index 0000000..58e6e46
--- /dev/null
+++ b/cluster/prod/app/postgres/secrets/postgres/keeper/pg_repl_username
@@ -0,0 +1 @@
+CONST replicator
diff --git a/cluster/prod/app/postgres/secrets/postgres/keeper/pg_su_pwd b/cluster/prod/app/postgres/secrets/postgres/keeper/pg_su_pwd
new file mode 100644
index 0000000..907e2b8
--- /dev/null
+++ b/cluster/prod/app/postgres/secrets/postgres/keeper/pg_su_pwd
@@ -0,0 +1 @@
+USER postgres superuser password