Skip to content

Commit adbae71

Browse files
dragarciadragarcia
authored
Implement configurations for WAL-G (#145)
* chore: create wal-g Linux user - Let postgres Linux user execute wal-g as wal-g Linux user * Revert WAL-G backport * chore: give read access to PG data directory to groups - specifically to groups that the postgres Linux user are a part of * update configs in postgresql.conf - not enabled however * WAL-G specific scripts to be triggered via the admin API * Create config directory for wal-g * chore: add logging for wal-g processes * ensure bindir when installing pgsodium works for EC2 builds * triggere dockerbuild * Run backup in background * Inject WALG_SENTINEL_USER_DATA during backups - Also, use nohup * Add scripts for enabling and disabling walg * removed unused scripts * bump versioning * cleanup * Move logrotate to its own dir - to allow looping through * cleanup: loop through creation of log files * set up logrotate for all WAL-G log files * Ensure backup is pointing to the correct log file * create postgres linux group * ensure that it's config.json, not .env * allow admin API to edit /etc/wal-g/config.json * add whitespace * script to complete wal-g restoration * update adminapi * remove bindir in setup-system * create wal-g group and move up setting up of wal-g * create wal-g log files towards the end * Ensure /var/lib/postgresql/data is owned by postgres:postgres * fix transfer of file found in subdirectories * set primary groups for postgres and wal-g linux users * newline * modify wal-g related parameters in separate file * bump to 14.1.0.21 * more newlines
1 parent 4b3cd74 commit adbae71

19 files changed

+180
-24
lines changed

‎ansible/files/admin_api_scripts/commence_walg_backup.sh

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#! /usr/bin/env bash
2+
3+
set -euo pipefail
4+
5+
WALG_SENTINEL_USER_DATA="{ \"backup_id\": $1, \"project_id\": $2 }" nohup wal-g backup-push /var/lib/postgresql/data --config /etc/wal-g/config.json --verify >> /var/log/wal-g/backup-push.log 2>&1 &
6+
7+
echo "WAL-G backup job commenced"

‎ansible/files/admin_api_scripts/complete_walg_restore.sh

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
#! /usr/bin/env bash
2+
3+
set -euo pipefail
4+
5+
# disable 169.254.169.254 for postgres
6+
sed -i "/#\\sdon't\\sdelete\\sthe\\s'COMMIT'/ i -I OUTPUT 1 --proto tcp --destination 169.254.169.254 --match owner --uid-owner postgres --jump REJECT\\n" /etc/ufw/before.rules
7+
ufw reload
8+
9+
# move config file to its final location and change its ownership
10+
mv /etc/postgresql/wal-g-config.json /etc/wal-g/config.json
11+
chown wal-g:wal-g /etc/wal-g/config.json
12+
13+
14+
# disable recovery commands in the event of a restart
15+
sed -i "s/.*restore_command/#restore_command/" /etc/postgresql-custom/wal-g.conf
16+
sed -i "s/.*recovery_target_time/#recovery_target_time/" /etc/postgresql-custom/wal-g.conf
17+
sed -i "s/.*recovery_target_action/#recovery_target_action/" /etc/postgresql-custom/wal-g.conf
18+
19+
# enable archive_command
20+
sed -i "s/.*archive_mode/archive_mode/" /etc/postgresql-custom/wal-g.conf
21+
sed -i "s/.*archive_command/archive_command/" /etc/postgresql-custom/wal-g.conf
22+
sed -i "s/.*archive_timeout/archive_timeout/" /etc/postgresql-custom/wal-g.conf
23+
24+
systemctl restart postgresql
25+
26+
echo "Cleanup post WAL-G restoration complete"

‎ansible/files/admin_api_scripts/disable_walg.sh

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
#! /usr/bin/env bash
2+
3+
set -euo pipefail
4+
5+
sed -i "s/.*archive_mode/#archive_mode/" /etc/postgresql-custom/wal-g.conf
6+
sed -i "s/.*archive_command/#archive_command/" /etc/postgresql-custom/wal-g.conf
7+
sed -i "s/.*archive_timeout/#archive_timeout/" /etc/postgresql-custom/wal-g.conf
8+
9+
systemctl restart postgresql
10+
11+
echo "WAL-G successfully disabled"

‎ansible/files/admin_api_scripts/enable_walg.sh

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
#! /usr/bin/env bash
2+
3+
set -euo pipefail
4+
5+
sed -i "s/.*archive_mode/archive_mode/" /etc/postgresql-custom/wal-g.conf
6+
sed -i "s/.*archive_command/archive_command/" /etc/postgresql-custom/wal-g.conf
7+
sed -i "s/.*archive_timeout/archive_timeout/" /etc/postgresql-custom/wal-g.conf
8+
9+
systemctl restart postgresql
10+
11+
echo "WAL-G successfully enabled"

‎ansible/files/grow_fs.sh renamed to ‎ansible/files/admin_api_scripts/grow_fs.sh

File renamed without changes.

‎ansible/files/logrotate-postgres-csv renamed to ‎ansible/files/logrotate_config/logrotate-postgres-csv.conf

File renamed without changes.

‎ansible/files/logrotate-postgres renamed to ‎ansible/files/logrotate_config/logrotate-postgres.conf

File renamed without changes.

‎ansible/files/logrotate_config/logrotate-walg.conf

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
/var/log/wal-g/*.log {
2+
size 50M
3+
rotate 3
4+
copytruncate
5+
delaycompress
6+
compress
7+
notifempty
8+
missingok
9+
}

‎ansible/files/postgresql_config/custom_walg.conf.j2

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# - Archiving -
2+
3+
#archive_mode = on
4+
#archive_command = 'sudo -u wal-g wal-g wal-push %p --config /etc/wal-g/config.json >> /var/log/wal-g/wal-push.log 2>&1'
5+
#archive_timeout = 120
6+
7+
8+
# - Archive Recovery -
9+
10+
#restore_command = 'sudo -u wal-g wal-g wal-fetch "%f" "%p" --config /etc/wal-g/config.json >> /var/log/wal-g/wal-fetch.log 2>&1'
11+
12+
13+
# - Recovery Target -
14+
15+
#recovery_target_time = ''
16+
#recovery_target_action = 'promote'

‎ansible/files/postgresql_config/postgresql.conf.j2

+3
Original file line numberDiff line numberDiff line change
@@ -791,6 +791,9 @@ jit_provider = 'llvmjit' # JIT library to use
791791
# User-supplied custom parameters, override any automatically generated ones
792792
#include = '/etc/postgresql-custom/custom-overrides.conf'
793793

794+
# WAL-G specific configurations
795+
#include = '/etc/postgresql-custom/wal-g.conf'
796+
794797
#------------------------------------------------------------------------------
795798
# CUSTOMIZED OPTIONS
796799
#------------------------------------------------------------------------------

‎ansible/playbook.yml

+12-11
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,9 @@
3535
tags:
3636
- install-pgbouncer
3737

38+
- name: Install WAL-G
39+
import_tasks: tasks/setup-wal-g.yml
40+
3841
- name: Install Supabase specific content
3942
import_tasks: tasks/setup-supabase-internal.yml
4043
tags:
@@ -64,9 +67,6 @@
6467
state: absent
6568
loop: "{{ sql_files }}"
6669

67-
- name: Install WAL-G
68-
import_tasks: tasks/setup-wal-g.yml
69-
7070
- name: Install PostgREST
7171
import_tasks: tasks/setup-postgrest.yml
7272
tags:
@@ -103,15 +103,16 @@
103103
policy: deny
104104
direction: incoming
105105

106-
- name: Setup logrotate for postgres logs
107-
copy:
108-
src: files/logrotate-postgres
109-
dest: /etc/logrotate.d/postgres
110-
111-
- name: Setup logrotate for postgres CSV logs
106+
- name: Move logrotate files to /etc/logrotate.d/
112107
copy:
113-
src: files/logrotate-postgres-csv
114-
dest: /etc/logrotate.d/postgres-csv
108+
src: "files/logrotate_config/{{ item.file }}"
109+
dest: "/etc/logrotate.d/{{ item.file }}"
110+
mode: "0700"
111+
owner: root
112+
loop:
113+
- { file: "logrotate-postgres-csv.conf" }
114+
- { file: "logrotate-postgres.conf" }
115+
- { file: "logrotate-walg.conf" }
115116

116117
- name: Disable cron access
117118
copy:

‎ansible/tasks/internal/admin-api.yml

+15-5
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,30 @@
11
- name: adminapi - system user
22
user:
33
name: adminapi
4-
groups: root,admin,postgres,pgbouncer
4+
groups: root,admin,postgres,pgbouncer,wal-g
55
append: yes
66

7-
- name: disk script
7+
- name: Move shell scripts to /root dir
88
copy:
9-
src: files/grow_fs.sh
10-
dest: /root/grow_fs.sh
11-
mode: '0700'
9+
src: "files/admin_api_scripts/{{ item.file }}"
10+
dest: "/root/{{ item.file }}"
11+
mode: "0700"
1212
owner: root
13+
loop:
14+
- { file: "commence_walg_backup.sh" }
15+
- { file: "complete_walg_restore.sh" }
16+
- { file: "disable_walg.sh" }
17+
- { file: "enable_walg.sh" }
18+
- { file: "grow_fs.sh" }
1319

1420
- name: give adminapi user permissions
1521
copy:
1622
content: |
1723
%adminapi ALL= NOPASSWD: /root/grow_fs.sh
24+
%adminapi ALL= NOPASSWD: /root/commence_walg_backup.sh
25+
%adminapi ALL= NOPASSWD: /root/complete_walg_restore.sh
26+
%adminapi ALL= NOPASSWD: /root/disable_walg.sh
27+
%adminapi ALL= NOPASSWD: /root/enable_walg.sh
1828
%adminapi ALL= NOPASSWD: /usr/bin/systemctl daemon-reload
1929
%adminapi ALL= NOPASSWD: /usr/bin/systemctl restart postgresql.service
2030
%adminapi ALL= NOPASSWD: /usr/bin/systemctl restart adminapi.service

‎ansible/tasks/setup-postgres.yml

+8-2
Original file line numberDiff line numberDiff line change
@@ -71,13 +71,19 @@
7171
target: install-world-bin
7272
chdir: /tmp/postgresql-{{ postgresql_release }}
7373

74+
- name: Create postgres group
75+
group:
76+
name: postgres
77+
state: present
78+
7479
# Create postgres user
7580
- name: Create postgres user
7681
user:
7782
name: postgres
7883
shell: /bin/false
7984
comment: Postgres user
80-
groups: ssl-cert
85+
group: postgres
86+
groups: postgres,ssl-cert
8187

8288
- name: Create relevant directories
8389
file:
@@ -141,7 +147,7 @@
141147
become: yes
142148
become_user: postgres
143149
shell:
144-
cmd: /usr/lib/postgresql/bin/pg_ctl -D /var/lib/postgresql/data initdb
150+
cmd: /usr/lib/postgresql/bin/pg_ctl -D /var/lib/postgresql/data initdb -o "--allow-group-access"
145151
vars:
146152
ansible_command_timeout: 60
147153
# Circumvents the following error:

‎ansible/tasks/setup-wal-g.yml

+51-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
# Download WAL-G
2525
- name: wal-g - download latest version
2626
git:
27-
repo: https://github.com/darora/wal-g.git
27+
repo: https://github.com/wal-g/wal-g.git
2828
dest: /tmp/wal-g
2929
version: "{{ wal_g_release }}"
3030
become: yes
@@ -61,6 +61,56 @@
6161
USE_LIBSODIUM: true
6262
become: yes
6363

64+
- name: Create wal-g group
65+
group:
66+
name: wal-g
67+
state: present
68+
69+
- name: Create wal-g user
70+
user:
71+
name: wal-g
72+
shell: /bin/false
73+
comment: WAL-G user
74+
group: wal-g
75+
groups: wal-g, postgres
76+
77+
- name: Give postgres access to execute wal-g binary as wal-g user
78+
copy:
79+
content: |
80+
postgres ALL=(wal-g) NOPASSWD: /usr/local/bin/wal-g
81+
dest: /etc/sudoers.d/postgres
82+
83+
- name: Create a config directory owned by wal-g
84+
file:
85+
path: /etc/wal-g
86+
state: directory
87+
owner: wal-g
88+
group: wal-g
89+
mode: '0760'
90+
91+
- name: Create /etc/wal-g/config.json
92+
file:
93+
path: /etc/wal-g/config.json
94+
state: touch
95+
owner: wal-g
96+
group: wal-g
97+
mode: '0760'
98+
99+
- name: Move custom wal-g.conf file to /etc/postgresql-custom/wal-g.conf
100+
template:
101+
src: "files/postgresql_config/custom_walg.conf.j2"
102+
dest: /etc/postgresql-custom/wal-g.conf
103+
mode: 0664
104+
owner: postgres
105+
group: postgres
106+
107+
- name: Include /etc/postgresql-custom/wal-g.conf in postgresql.conf
108+
become: yes
109+
replace:
110+
path: /etc/postgresql/postgresql.conf
111+
regexp: "#include = '/etc/postgresql-custom/wal-g.conf'"
112+
replace: "include = '/etc/postgresql-custom/wal-g.conf'"
113+
64114
# Clean up Go
65115
- name: Uninstall Go
66116
become: yes

‎ansible/vars.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ golang_version_checksum:
1919
arm64: sha256:06f505c8d27203f78706ad04e47050b49092f1b06dc9ac4fbee4f0e4d015c8d4
2020
amd64: sha256:550f9845451c0c94be679faf116291e7807a8d78b43149f9506c1b15eb89008c
2121

22-
wal_g_release: "v1.1-backports"
22+
wal_g_release: "v1.1"
2323

2424
sfcgal_release: "1.3.10"
2525
sfcgal_release_checksum: sha1:f4add34a00afb0b5f594685fc646565a2bda259b

‎common.vars.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
{
2-
"postgres-version": "14.1.0.20"
2+
"postgres-version": "14.1.0.21"
33
}

‎scripts/02-credentials_cleanup.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
sudo rm /home/ubuntu/.ssh/authorized_keys
1+
sudo rm /home/ubuntu/.ssh/authorized_keys

‎scripts/90-cleanup.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -53,4 +53,4 @@ dd if=/dev/zero of=/zerofile &
5353
sleep 5
5454
done
5555
sync; rm /zerofile; sync
56-
cat /dev/null > /var/log/lastlog; cat /dev/null > /var/log/wtmp
56+
cat /dev/null > /var/log/lastlog; cat /dev/null > /var/log/wtmp

‎scripts/91-log_cleanup.sh

+7-1
Original file line numberDiff line numberDiff line change
@@ -11,4 +11,10 @@ touch /var/log/pgbouncer.log
1111
chown pgbouncer:postgres /var/log/pgbouncer.log
1212

1313
mkdir /var/log/postgresql
14-
chown postgres:postgres /var/log/postgresql
14+
chown postgres:postgres /var/log/postgresql
15+
16+
mkdir /var/log/wal-g
17+
cd /var/log/wal-g
18+
touch backup-push.log backup-fetch.log wal-push.log wal-fetch.log
19+
chown -R wal-g:wal-g /var/log/wal-g
20+
chmod -R 0700 /var/log/wal-g

0 commit comments

Comments
 (0)