X-Git-Url: https://git.cyclocoop.org/?p=lhc%2Fateliers.git;a=blobdiff_plain;f=etc%2Fsv%2Fpostgres%2Flocal.sh;h=8b784c1caf57a6d6674934defd2732d680416665;hp=1bcd0f616660cfd0f4688ec6bc483436a7f1ae87;hb=f5e12fec2c7ef8d743e2d3e32c3bbe37b40c7a73;hpb=6647e7fb851e2dbe5a5c7ec60358f7371bf17183

diff --git a/etc/sv/postgres/local.sh b/etc/sv/postgres/local.sh
index 1bcd0f6..8b784c1 100644
--- a/etc/sv/postgres/local.sh
+++ b/etc/sv/postgres/local.sh
@@ -1,6 +1,6 @@
 # DOC: http://wiki.postgresql.org/wiki/Shared_Database_Hosting
 
-#"$tool"/local/apt-get-install postgresql-9.1
+"$tool"/local/apt-get-install postgresql-9.1
 "$tool"/local/insserv-remove  postgresql
 "$tool"/local/adduser postgres \
  --disabled-login \
@@ -19,8 +19,6 @@
  --system
 sudo usermod --home /home/postgresql postgres
 sudo adduser postgres postgres-data
-sudo rm -rf \
- /etc/postgresql
 sudo install -d -m 1751 -o postgres -g postgres-data \
  /home/postgresql \
  /home/postgresql/etc \
@@ -59,10 +57,25 @@ sudo install -m 640 -o postgres -g postgres /dev/stdin \
  /etc/postgresql/9.1/main/pg_hba.conf <<-EOF
 	local all postgres peer map=admin
 	local all all      peer
+	hostssl all postgres samehost cert
 	EOF
 sudo install -m 640 -o postgres -g postgres-data \
  "$tool"/etc/postgresql/9.1/main/postgresql.conf \
         /etc/postgresql/9.1/main/postgresql.conf
+sudo install -m 640 -o postgres -g postgres \
+ "$tool"/var/pub/x509/postgresql."$local_domainname"/crt+ca.pem \
+ /etc/postgresql/9.1/main/server.crt
+sudo install -m 640 -o postgres -g postgres \
+ "$tool"/var/pub/x509/postgresql."$local_domainname"/crt.self-signed.pem \
+ /etc/postgresql/9.1/main/root.crt
+sudo install -m 640 -o postgres -g postgres \
+ "$tool"/var/pub/x509/postgresql."$local_domainname"/crl.self-signed.pem \
+ /etc/postgresql/9.1/main/root.crl
+for f in server.crt server.key root.crt root.crl
+ do sudo ln -fns \
+	 /etc/postgresql/9.1/main/$f \
+	 /home/postgresql/data/$f
+ done
 
 sudo ln -fns \
         ../sv/"$sv" \
@@ -104,18 +117,31 @@ sudo -u postgres psql template1 -a -f - <<-EOF
 	END AS plpgsql_created;
 	DROP FUNCTION create_language_plpgsql();
 	EOF
-# NOTE: supprime l'accès à la liste des bases données
-#       et utilisateurices depuis public.
 sudo -u postgres psql template1 -a -f - <<-EOF
 	\set ON_ERROR_STOP on
 	REVOKE ALL ON ALL TABLES IN SCHEMA pg_catalog FROM public;
 	REVOKE ALL ON               SCHEMA pg_catalog FROM public;
-	-- REVOKE ALL ON pg_auth_members FROM public;
-	-- REVOKE ALL ON pg_authid       FROM public;
-	-- REVOKE ALL ON pg_database     FROM public;
-	-- REVOKE ALL ON pg_group        FROM public;
-	-- REVOKE ALL ON pg_roles        FROM public;
-	-- REVOKE ALL ON pg_settings     FROM public;
-	-- REVOKE ALL ON pg_tablespace   FROM public;
-	-- REVOKE ALL ON pg_user         FROM public;
 	EOF
+"$tool"/local/postgresql-user-create backup
+sudo -u postgres psql template1 -a -f - <<-EOF
+	\set ON_ERROR_STOP on
+	ALTER USER backup WITH SUPERUSER;
+		-- NOTE: permet VACUUM
+	GRANT USAGE  ON                  SCHEMA pg_catalog TO backup;
+	GRANT USAGE  ON                  SCHEMA public     TO backup;
+	GRANT SELECT ON ALL TABLES    IN SCHEMA pg_catalog TO backup;
+	GRANT SELECT ON ALL TABLES    IN SCHEMA public     TO backup;
+	GRANT SELECT ON ALL SEQUENCES IN SCHEMA public     TO backup;
+	GRANT CONNECT ON DATABASE template1 TO backup;
+	GRANT CONNECT ON DATABASE postgres  TO backup;
+	EOF
+sudo adduser backup postgres-data
+
+sudo find "$tool"/local/backup \
+ -mindepth 1 -maxdepth 1 -type f -perm /+x \
+ -name 'postgresql-*' \
+ -exec install -m 750 -o backup -g backup \
+ -t ~backup/bin {} +
+sudo install -m 640 -o root -g root \
+ "$tool"/etc/cron.d/postgresql-backup \
+        /etc/cron.d/postgresql-backup