608 lines
24 KiB
Bash
608 lines
24 KiB
Bash
#!/bin/bash
|
||
# Ver: 1.5 by Endial Fang (endial@126.com)
|
||
#
|
||
# 应用通用业务处理函数
|
||
|
||
. /colovu/lib/libcommon.sh # 通用函数库
|
||
. /colovu/lib/libfile.sh
|
||
. /colovu/lib/libfs.sh
|
||
. /colovu/lib/liblog.sh
|
||
. /colovu/lib/libos.sh
|
||
. /colovu/lib/libservice.sh
|
||
. /colovu/lib/libvalidations.sh
|
||
|
||
# 检测应用相应的配置文件是否存在，如果不存在，则从默认配置文件目录拷贝一份
|
||
# 默认配置文件路径：/etc/${APP_NAME}
|
||
# 目标配置文件路径：/srv/conf/${APP_NAME}
|
||
# 参数：
|
||
# $1 - 目标路径
|
||
# $2 - 源路径
|
||
# $* - 基础路径下的文件及目录列表，以" "分割
|
||
# 例子:
|
||
# ensure_config_file_exist /etc/${APP_NAME} conf.d server.conf
|
||
app_ensure_config_file_exist() {
|
||
local -r dist_path="${1:?dist paths is missing}"
|
||
local -r base_path="${2:?source paths is missing}"
|
||
local f=""
|
||
|
||
shift 2
|
||
LOG_D "List to check in ${base_path}: $@"
|
||
while [ "$#" -gt 0 ]; do
|
||
f="${1}"
|
||
LOG_D " Process \"${f}\""
|
||
if [ -d "${base_path}/${f}" ]; then
|
||
[[ ! -d "${dist_path}/${f}" ]] && LOG_D " Create directory: ${dist_path}/${f}" && mkdir -p "${dist_path}/${f}"
|
||
[[ ! -z $(ls -A "${base_path}/${f}") ]] && app_ensure_config_file_exist "${dist_path}/${f}" "${base_path}/${f}" $(ls -A "${base_path}/${f}")
|
||
else
|
||
[[ ! -e "${dist_path}/${f}" ]] && LOG_D " Copy: ${base_path}/${f} to ${dist_path}" && cp "${base_path}/${f}" "${dist_path}"
|
||
fi
|
||
shift
|
||
done
|
||
}
|
||
|
||
# 检测以 "<PREFIX>" 开头的环境变量，并更新指定配置文件中对应配置项的值
|
||
# 如果需要全部转换为小写，可使用命令： tr '[:upper:]' '[:lower:]'
|
||
# 环境变量与配置项替换规则 : 环境变量中下划线 ==> 配置参数中特殊字符
|
||
# - "_" ==> "_"（下划线）
|
||
# - "__" ==> "."（半角点）
|
||
# - "___" ==> "-"（中划线）
|
||
#
|
||
# 变量：
|
||
# $1 - 配置文件
|
||
# $2 - <PREFIX>前缀(不含结束的"_")
|
||
app_configure_from_environment() {
|
||
local confFile="${1:?missing file}"
|
||
local envPrefix="${2:-APP_CFG}"
|
||
|
||
LOG_D "Configuration File: ${confFile}"
|
||
|
||
for var in $(eval echo \${!${envPrefix}_@}); do
|
||
key="$(echo "$var" | sed -e 's/^'${envPrefix}'_//g' -e 's/___/-/g' -e 's/__/./g' | tr '[:upper:]' '[:lower:]')"
|
||
value="${!var}"
|
||
LOG_D " ${key}: ${value}"
|
||
app_common_conf_set "${PG_CONF_FILE}" "$key" "$value"
|
||
done
|
||
}
|
||
|
||
# 将变量配置更新至配置文件
|
||
# 参数:
|
||
# $1 - 文件
|
||
# $2 - 变量
|
||
# $3 - 值（列表）
|
||
app_common_conf_set() {
|
||
local file="${1:?missing file}"
|
||
local key="${2:?missing key}"
|
||
local value="${3:?missing value}"
|
||
|
||
if grep -q "^#*${key}" "$file" >/dev/null; then
|
||
replace_in_file "$file" "^#*${key}\s*=.*$" "${key} = '${value}'" false
|
||
else
|
||
echo "\n${key} = '${value}'" >>"$file"
|
||
fi
|
||
}
|
||
|
||
# 使用环境变量中配置，更新配置文件
|
||
app_update_conf() {
|
||
LOG_I "Update configure files from PG_CFG_*..."
|
||
|
||
if (( PG_SYNCHRONOUS_REPLICAS_NUM > 0 )); then
|
||
app_common_conf_set "${PG_CONF_FILE}" "synchronous_standby_names" "${PG_SYNCHRONOUS_REPLICAS_METHOD} ${PG_SYNCHRONOUS_REPLICAS_NUM} (\"${PG_SYNCHRONOUS_REPLICAS_NAMES}\")"
|
||
fi
|
||
|
||
[[ "${PG_REPLICATION_MODE}" == "standby" ]] && pg_configure_recovery
|
||
|
||
app_configure_from_environment "${PG_CONF_FILE}" "PG_CFG"
|
||
|
||
pg_update_hba_conf
|
||
}
|
||
|
||
# 检测用户参数信息是否满足条件; 针对部分权限过于开放情况，打印提示信息
|
||
app_verify_minimum_env() {
|
||
local error_code=0
|
||
|
||
LOG_D "Validating settings in ENV vars..."
|
||
|
||
print_validation_error() {
|
||
LOG_E "$1"
|
||
error_code=1
|
||
}
|
||
|
||
empty_password_error() {
|
||
print_validation_error "The $1 environment variable is empty or not set. Set the environment variable ALLOW_ANONYMOUS=yes to allow the container to be started with blank passwords. This is recommended only for development."
|
||
}
|
||
|
||
# 检测认证设置。如果不允许匿名登录，检测登录用户名及密码是否设置
|
||
if is_boolean_yes "${ALLOW_ANONYMOUS}"; then
|
||
LOG_W "You have set the environment variable ALLOW_ANONYMOUS=${ALLOW_ANONYMOUS}. For safety reasons, do not use this flag in a production environment."
|
||
else
|
||
if [[ -z "${PG_PASSWORD}" ]]; then
|
||
empty_password_error "{PG_PASSWORD}"
|
||
fi
|
||
if (( ${#PG_PASSWORD} > 100 )); then
|
||
print_validation_error "The password cannot be longer than 100 characters. Set the environment variable PG_PASSWORD with a shorter value"
|
||
fi
|
||
if [[ -n "${PG_USERNAME}" ]] && [[ -z "${PG_PASSWORD}" ]]; then
|
||
empty_password_error "{PG_PASSWORD}"
|
||
fi
|
||
if [[ -n "${PG_USERNAME}" ]] && [[ "${PG_USERNAME}" != "postgres" ]] && [[ -n "${PG_PASSWORD}" ]] && [[ -z "${PG_DATABASE}" ]]; then
|
||
print_validation_error "In order to use a custom PostgreSQL user you need to set the environment variable PG_DATABASE as well"
|
||
fi
|
||
fi
|
||
|
||
if [[ "${PG_REPLICATION_MODE}" = "primary" ]]; then
|
||
if (( PG_SYNCHRONOUS_REPLICAS_NUM < 0 )); then
|
||
print_validation_error "The number of synchronous replicas cannot be less than 0. Set the environment variable PG_SYNCHRONOUS_REPLICAS_NUM"
|
||
fi
|
||
elif [[ "${PG_REPLICATION_MODE}" = "standby" ]]; then
|
||
if [[ -z "${PG_REPLICATION_HOST}" ]]; then
|
||
print_validation_error "Slave replication mode chosen without setting the environment variable PG_REPLICATION_HOST. Use it to indicate where the Master node is running"
|
||
fi
|
||
if [[ -z "${PG_REPLICATION_USER}" ]]; then
|
||
print_validation_error "Slave replication mode chosen without setting the environment variable PG_REPLICATION_USER. Make sure that the primary also has this parameter set"
|
||
fi
|
||
if [[ -n "${PG_REPLICATION_USER}" ]] && [[ -z "${PG_REPLICATION_PASSWORD}" ]]; then
|
||
empty_password_error "{PG_REPLICATION_PASSWORD}"
|
||
fi
|
||
else
|
||
print_validation_error "Invalid replication mode. Available options are 'primary/standby'"
|
||
fi
|
||
|
||
if is_boolean_yes "${PG_ENABLE_LDAP}" && [[ -n "${PG_LDAP_URL}" ]] && [[ -n "${PG_LDAP_SERVER}" ]]; then
|
||
empty_password_error "You can not set PG_LDAP_URL and PG_LDAP_SERVER at the same time. Check your LDAP configuration."
|
||
fi
|
||
|
||
if [[ "${PG_CFG_SSL:-off}" == "on" ]]; then
|
||
if [[ -z "${PG_CFG_ssl_cert_file:-}" ]]; then
|
||
print_validation_error "You must provide a X.509 certificate in order to use TLS"
|
||
elif [[ ! -f "${PG_CFG_ssl_cert_file}" ]]; then
|
||
print_validation_error "The X.509 certificate file in the specified path ${PG_CFG_ssl_cert_file} does not exist"
|
||
fi
|
||
if [[ -z "${PG_CFG_ssl_key_file:-}" ]]; then
|
||
print_validation_error "You must provide a private key in order to use TLS"
|
||
elif [[ ! -f "${PG_CFG_ssl_key_file}" ]]; then
|
||
print_validation_error "The private key file in the specified path ${PG_CFG_ssl_key_file} does not exist"
|
||
fi
|
||
if [[ -z "${PG_CFG_ssl_ca_file:-}" ]]; then
|
||
LOG_W "A CA X.509 certificate was not provided. Client verification will not be performed in TLS connections"
|
||
elif [[ ! -f "${PG_CFG_ssl_ca_file}" ]]; then
|
||
print_validation_error "The CA X.509 certificate file in the specified path ${PG_CFG_ssl_ca_file} does not exist"
|
||
fi
|
||
if [[ -n "${PG_CFG_ssl_crl_file:-}" ]] && [[ ! -f "${PG_CFG_ssl_crl_file}" ]]; then
|
||
print_validation_error "The CRL file in the specified path ${PG_CFG_ssl_crl_file} does not exist"
|
||
fi
|
||
if ! is_yes_no_value "${PG_CFG_ssl_prefer_server_ciphers:-}"; then
|
||
print_validation_error "The values allowed for prefer_server_ciphers are: on or off"
|
||
fi
|
||
fi
|
||
|
||
[[ "$error_code" -eq 0 ]] || exit "$error_code"
|
||
}
|
||
|
||
# 更改默认监听地址为 "*" 或 "0.0.0.0"，以对容器外提供服务
|
||
app_enable_remote_connections() {
|
||
LOG_I "Modify default config to ENABLE external IP access"
|
||
|
||
app_common_conf_set "${PG_CONF_FILE}" "listen_addresses" "0.0.0.0"
|
||
}
|
||
|
||
# 更改默认监听地址为 "localhost" 或 "127.0.0.1"，以禁止对容器外提供服务
|
||
app_disable_remote_connections() {
|
||
LOG_I "Modify default config to DISABLE external IP access"
|
||
|
||
app_common_conf_set "${PG_CONF_FILE}" "listen_addresses" "127.0.0.1"
|
||
}
|
||
|
||
# 以后台方式启动应用服务，并等待启动就绪
|
||
app_start_server_bg() {
|
||
LOG_I "Starting ${APP_NAME} in background..."
|
||
|
||
# 使用 pg_ctl 命令，以服务方式启动 PostgreSQL
|
||
local pg_ctl_cmd=$(command -v pg_ctl)
|
||
local pg_ctl_flags=("-D" "${PGDATA}")
|
||
pg_ctl_flags+=("-l" "${PG_CFG_LOG_DIRECTORY}/postgres_init.log")
|
||
#pg_ctl_flags+=("-o" "'-c listen_addresses=127.0.0.1 -p 5432'")
|
||
pg_ctl_flags+=("-w" "-t" "30")
|
||
|
||
LOG_D " extra arguments: ${pg_ctl_flags[@]}"
|
||
debug_execute "${pg_ctl_cmd}" "start" "${pg_ctl_flags[@]}"
|
||
}
|
||
|
||
# 停止应用服务
|
||
app_stop_server() {
|
||
LOG_I "Stopping ${APP_NAME} background service..."
|
||
|
||
# 使用 pg_ctl 命令关闭服务
|
||
local pg_ctl_cmd=$(command -v pg_ctl)
|
||
local pg_ctl_flags=("-D" "${PGDATA}")
|
||
pg_ctl_flags+=("-m" "fast")
|
||
pg_ctl_flags+=("-w" "-t" "30")
|
||
|
||
LOG_D " extra arguments: ${pg_ctl_flags[@]}"
|
||
debug_execute "${pg_ctl_cmd}" "stop" "${pg_ctl_flags[@]}"
|
||
}
|
||
|
||
# 检测应用服务是否在后台运行中
|
||
app_is_server_running() {
|
||
local pid
|
||
pid="$(get_pid_from_file ${PG_CFG_EXTERNAL_PID_FILE})"
|
||
LOG_D "Checking ${APP_NAME} running status with PID: ${pid}"
|
||
|
||
if [[ -n "${pid}" ]]; then
|
||
is_service_running "${pid}"
|
||
else
|
||
false
|
||
fi
|
||
}
|
||
|
||
app_is_server_not_running() {
|
||
if [[ app_is_server_running == false ]]; then
|
||
true
|
||
else
|
||
false
|
||
fi
|
||
}
|
||
|
||
# 清理初始化应用时生成的临时文件
|
||
app_clean_tmp_file() {
|
||
LOG_D "Clean ${APP_NAME} tmp files ..."
|
||
|
||
local -r -a files=(
|
||
"${PGDATA}/postmaster.pid"
|
||
"${PG_CFG_EXTERNAL_PID_FILE}"
|
||
)
|
||
|
||
for file in ${files[@]}; do
|
||
if [[ -f "$file" ]]; then
|
||
LOG_D " Remove $file"
|
||
rm -rf "$file"
|
||
fi
|
||
done
|
||
}
|
||
|
||
# 用户自定义的前置初始化操作，依次执行目录 preinit.d 中的初始化脚本
|
||
# 执行完毕后，生成以当前时间命名的'.tar'的文件，包含执行记录、已执行的脚本，同时删除已执行的脚本
|
||
app_custom_preinit() {
|
||
LOG_I "Process pre-init for ${APP_NAME}..."
|
||
|
||
# 检测用户配置文件目录是否存在 preinit.d 文件夹，如果存在，尝试执行目录中的初始化脚本
|
||
if [[ -d "${APP_CONF_DIR}/preinit.d" ]] && [[ -n $(find "${APP_CONF_DIR}/preinit.d/" -type f -regex ".*\.\(sh\)") ]]; then
|
||
echo "$(date '+%Y-%m-%d %H:%M:%S') : Init success." > "${APP_CONF_DIR}/preinit.d/preinit_info"
|
||
local tarFile="preinit-$(date '+%Y-%m-%d-%H%M%S').tar"
|
||
tar --remove-files -cf "${tarFile}" "${APP_CONF_DIR}/preinit.d/preinit_info"
|
||
|
||
for f in $(find "${APP_CONF_DIR}/preinit.d/" -type f -regex ".*\.\(sh\)" | sort); do
|
||
LOG_D " Process: ${f}"
|
||
process_init_files "${f}"
|
||
tar --remove-files -f "${tarFile}" -r "${f}"
|
||
done
|
||
fi
|
||
}
|
||
|
||
# 应用默认初始化操作
|
||
app_default_init() {
|
||
LOG_I "Process default init for ${APP_NAME}..."
|
||
app_clean_tmp_file
|
||
|
||
if is_dir_empty "${PGDATA}"; then
|
||
LOG_I "Deploying ${APP_NAME} from scratch..."
|
||
|
||
if [[ "${PG_REPLICATION_MODE}" == "primary" ]]; then
|
||
# 使用 initdb 工具初始化集群仓库（包含配置文件的初始化）
|
||
pg_primary_init_db
|
||
|
||
app_disable_remote_connections
|
||
app_start_server_bg
|
||
|
||
[[ "${PG_DATABASE}" != "postgres" ]] && pg_create_custom_database
|
||
|
||
# 为数据库授权；默认用户不为 postgres 时，需要创建管理员账户
|
||
LOG_D "Set password for postgres user"
|
||
if [[ "${PG_USERNAME}" == "postgres" ]]; then
|
||
[[ -n "${PG_PASSWORD}" ]] && pg_alter_postgres_user "${PG_PASSWORD}"
|
||
else
|
||
[[ -n "${PG_POSTGRES_PASSWORD}" ]] && pg_alter_postgres_user "${PG_POSTGRES_PASSWORD}"
|
||
pg_create_admin_user
|
||
fi
|
||
[[ -n "${PG_REPLICATION_USER:-}" ]] && pg_create_replication_user
|
||
|
||
app_stop_server
|
||
app_enable_remote_connections
|
||
else
|
||
pg_standby_init_db
|
||
fi
|
||
elif [[ -f "${PGDATA}/PG_VERSION" ]]; then
|
||
local -r db_version="$(< "${PGDATA}/PG_VERSION")"
|
||
local -r curr_version="$(pg_get_major_version)"
|
||
|
||
if [[ "$db_version" -ne "$curr_version" ]]; then
|
||
LOG_E "PGDATA directory is not empty with INCORRECT version, application version is $curr_version, while DB version is $db_version"
|
||
exit 1
|
||
fi
|
||
|
||
LOG_I "Deploying ${APP_NAME} with persisted data..."
|
||
else
|
||
LOG_E "${PGDATA} not empty"
|
||
exit 1
|
||
fi
|
||
|
||
# 根据环境变量配置，更新 postgresql.conf / pg_hba.conf / pg_ident.conf 等
|
||
# 注意：如果在数据库客户端内使用 ALTER 更新配置，则存储在 postgresql.auto.conf 文件中，优先级高于 postgresql.conf
|
||
app_update_conf
|
||
}
|
||
|
||
# 用户自定义的应用初始化操作，依次执行目录 initdb.d 中的初始化脚本
|
||
# 执行完毕后，生成以当前时间命名的'.tar'的文件，包含执行记录、已执行的脚本，同时删除已执行的脚本
|
||
app_custom_init() {
|
||
LOG_I "Process DB-init for ${APP_NAME}..."
|
||
|
||
# 检测用户配置文件目录是否存在 preinit.d 文件夹，如果存在，尝试执行目录中的初始化脚本
|
||
if [[ -d "${APP_CONF_DIR}/initdb.d" ]] && [[ -n $(find "${APP_CONF_DIR}/initdb.d/" -type f -regex ".*\.\(sh\|sql\|sql.gz\)") ]]; then
|
||
echo "$(date '+%Y-%m-%d %H:%M:%S') : Init success." > "${APP_CONF_DIR}/initdb.d/dbinit_info"
|
||
local tarFile="initdb-$(date '+%Y-%m-%d-%H%M%S').tar"
|
||
tar --remove-files -cf "${tarFile}" "${APP_CONF_DIR}/initdb.d/initdb_info"
|
||
|
||
# 禁用远程访问，并启动后台服务
|
||
app_disable_remote_connections
|
||
app_start_server_bg
|
||
|
||
for f in $(find "${APP_CONF_DIR}/initdb.d/" -type f -regex ".*\.\(sh\|sql\|sql.gz\)" | sort); do
|
||
case "$f" in
|
||
*.sh)
|
||
LOG_D " Process Shell: ${f}"
|
||
process_init_files "$f"
|
||
;;
|
||
*.sql)
|
||
LOG_D " Process SQL: ${f}";
|
||
pg_execute "${PG_DATABASE}" "${PG_INITSCRIPTS_USERNAME}" "${PG_INITSCRIPTS_PASSWORD}" < "$f"
|
||
;;
|
||
*.sql.gz)
|
||
LOG_D " Process SQLs in ${f}";
|
||
gunzip -c "$f" | pg_execute "${PG_DATABASE}" "${PG_INITSCRIPTS_USERNAME}" "${PG_INITSCRIPTS_PASSWORD}"
|
||
;;
|
||
*)
|
||
LOG_D " Ignoring $f"
|
||
;;
|
||
esac
|
||
|
||
tar --remove-files -f "${tarFile}" -r "${f}"
|
||
done
|
||
|
||
# 停止后台服务，并启用远程访问
|
||
app_stop_server
|
||
app_clean_tmp_file
|
||
app_enable_remote_connections
|
||
fi
|
||
}
|
||
|
||
# 获取软件主版本号
|
||
pg_get_major_version() {
|
||
psql --version | grep -oE "[0-9]+\.[0-9]+" | grep -oE "^[0-9]+"
|
||
}
|
||
|
||
# 根据环境变量，更新 HBA 配置文件
|
||
pg_update_hba_conf() {
|
||
LOG_I "Update pg_hba.conf with environment values..."
|
||
|
||
# 默认生成的配置中：
|
||
# - 默认数据库，local / host 访问策略为 trust，host IP range 为 127.0.0.1/32 及 ::1/128
|
||
# - replication 数据库，，local / host 访问策略为 trust，host IP range 为 127.0.0.1/32 及 ::1/128
|
||
|
||
pg_hba_update_host_auth
|
||
pg_hba_update_replication_auth
|
||
|
||
if is_boolean_yes "${PG_ENABLE_LDAP}"; then
|
||
pg_hba_allow_ldap_auth
|
||
fi
|
||
|
||
if [[ "${PG_CFG_SSL:-off}" == "on" ]]; then
|
||
pg_hba_allow_tls_connection
|
||
fi
|
||
}
|
||
|
||
# 更新 pg_hba.conf 文件，所有数据库仅允许基于密码认证的访问
|
||
pg_hba_update_host_auth() {
|
||
LOG_D " Update default host auth configs..."
|
||
|
||
local host_auth="trust"
|
||
if [[ -n "${PG_PASSWORD}" ]]; then
|
||
host_auth="md5"
|
||
fi
|
||
sed -i -E "s@(host)\s+(all)\s+(all)\s+([0-9\.\/]+)\s+.*@\1\t\2\t\3\t${PG_USER_IP4_RANGE}\t${host_auth}@g" "${PG_CFG_HBA_FILE}"
|
||
sed -i -E "s@(host)\s+(all)\s+(all)\s+([a-z0-9\/\:]+)\s+.*@\1\t\2\t\3\t${PG_USER_IP6_RANGE}\t${host_auth}@g" "${PG_CFG_HBA_FILE}"
|
||
}
|
||
|
||
# 更新 pg_hba.conf 文件，replication 仅允许基于密码认证的访问
|
||
pg_hba_update_replication_auth() {
|
||
LOG_D " Update replication host auth configs..."
|
||
|
||
local replication_auth="trust"
|
||
if [[ -n "${PG_REPLICATION_PASSWORD:-}" ]]; then
|
||
replication_auth="md5"
|
||
fi
|
||
sed -i -E "s@(host)\s+(replication)\s+(all)\s+([0-9\.\/]+)\s+.*@\1\t\2\t\3\t${PG_REPLICATION_IP4_RANGE}\t${replication_auth}@g" "${PG_CFG_HBA_FILE}"
|
||
sed -i -E "s@(host)\s+(replication)\s+(all)\s+([a-z0-9\/\:]+)\s+.*@\1\t\2\t\3\t${PG_REPLICATION_IP6_RANGE}\t${replication_auth}@g" "${PG_CFG_HBA_FILE}"
|
||
}
|
||
|
||
# 更新 pg_hba.conf 文件，增加 LDAP 配置；同时增加 postgres 用户的本地认证
|
||
pg_hba_allow_ldap_auth() {
|
||
LOG_I "Enabling LDAP authentication"
|
||
local ldap_configuration=""
|
||
|
||
if [[ -n "${PG_LDAP_URL}" ]]; then
|
||
ldap_configuration="ldapurl=\"${PG_LDAP_URL}\""
|
||
else
|
||
ldap_configuration="ldapserver=${PG_LDAP_SERVER}"
|
||
|
||
[[ -n "${PG_LDAP_PREFIX}" ]] && ldap_configuration+=" ldapprefix=\"${PG_LDAP_PREFIX}\""
|
||
[[ -n "${PG_LDAP_SUFFIX}" ]] && ldap_configuration+=" ldapsuffix=\"${PG_LDAP_SUFFIX}\""
|
||
[[ -n "${PG_LDAP_PORT}" ]] && ldap_configuration+=" ldapport=${PG_LDAP_PORT}"
|
||
[[ -n "${PG_LDAP_BASE_DN}" ]] && ldap_configuration+=" ldapbasedn=\"${PG_LDAP_BASE_DN}\""
|
||
[[ -n "${PG_LDAP_BIND_DN}" ]] && ldap_configuration+=" ldapbinddn=\"${PG_LDAP_BIND_DN}\""
|
||
[[ -n "${PG_LDAP_BIND_PASSWORD}" ]] && ldap_configuration+=" ldapbindpasswd=${PG_LDAP_BIND_PASSWORD}"
|
||
[[ -n "${PG_LDAP_SEARCH_ATTR}" ]] && ldap_configuration+=" ldapsearchattribute=${PG_LDAP_SEARCH_ATTR}"
|
||
[[ -n "${PG_LDAP_SEARCH_FILTER}" ]] && ldap_configuration+=" ldapsearchfilter=\"${PG_LDAP_SEARCH_FILTER}\""
|
||
[[ -n "${PG_LDAP_TLS}" ]] && ldap_configuration+=" ldaptls=${PG_LDAP_TLS}"
|
||
[[ -n "${PG_LDAP_SCHEME}" ]] && ldap_configuration+=" ldapscheme=${PG_LDAP_SCHEME}"
|
||
fi
|
||
|
||
sed -i -E "s@(host)\s+(all)\s+(all)\s+([0-9\.\/]+)\s+.*@\1\t\2\t\3\t${PG_REPLICATION_IP4_RANGE}\tldap ${ldap_configuration}@g" "${PG_CFG_HBA_FILE}"
|
||
sed -i -E "s@(host)\s+(all)\s+(all)\s+([a-z0-9\/\:]+)\s+.*@\1\t\2\t\3\t${PG_REPLICATION_IP6_RANGE}\tldap ${ldap_configuration}@g" "${PG_CFG_HBA_FILE}"
|
||
|
||
LOG_D " Add new postgres authentication when auth with LDAP"
|
||
local postgres_auth="trust"
|
||
if [[ -n "${PG_POSTGRES_PASSWORD}" ]]; then
|
||
postgres_auth="md5"
|
||
fi
|
||
if ! $(grep -iE "(host)\s+(all)\s+(postgres).*" "${PG_CFG_HBA_FILE}"); then
|
||
cat <<EOF >"${PG_CFG_HBA_FILE}"
|
||
|
||
host all postgres ${PG_REPLICATION_IP4_RANGE} ${postgres_auth}
|
||
host all postgres ${PG_REPLICATION_IP6_RANGE} ${postgres_auth}
|
||
EOF
|
||
fi
|
||
}
|
||
|
||
# 设置 pg_hba.conf 文件，增加 TLS 配置
|
||
pg_hba_allow_tls_connection() {
|
||
LOG_I "Enabling TLS client authentication"
|
||
|
||
cat <<"EOF" >>"${PG_CFG_HBA_FILE}"
|
||
|
||
hostssl all all ${PG_USER_IP4_RANGE} cert
|
||
hostssl all all ${PG_USER_IP6_RANGE} cert
|
||
EOF
|
||
}
|
||
|
||
# 为 Slava 模式工作的节点创建 recovery.conf 文件
|
||
pg_configure_recovery() {
|
||
LOG_I "Setting up streaming replication standby..."
|
||
|
||
# Recover 配置信息在不同版本保存位置不一样：
|
||
# 版本为12及以上时， Slave 节点配置保存在 postgresql.conf 文件中
|
||
# 版本低于12时， Slave 节点配置保存在 recover.conf 文件中
|
||
app_common_conf_set "${PG_CONF_FILE}" "primary_conninfo" "host=${PG_REPLICATION_HOST} port=${PG_REPLICATION_PORT} user=${PG_REPLICATION_USER} password=${PG_REPLICATION_PASSWORD} application_name=${PG_REPLICATION_APP_NAME} connect_timeout=${PG_REPLICATION_CONNECT_TIMEOUT}"
|
||
app_common_conf_set "${PG_CONF_FILE}" "promote_trigger_file" "/tmp/postgresql.trigger.${PG_REPLICATION_PORT}"
|
||
touch "${PGDATA}/standby.signal"
|
||
}
|
||
|
||
# 为默认的数据库用户 postgres 设置密码
|
||
# 参数:
|
||
# $1 - 用户密码
|
||
pg_alter_postgres_user() {
|
||
local -r escaped_password="${1//\'/\'\'}"
|
||
LOG_I "Changing password of postgres"
|
||
|
||
echo "ALTER ROLE postgres WITH PASSWORD '$escaped_password';" | pg_execute
|
||
if [[ -n "${PG_DB_CONNECTION_LIMIT}" ]]; then
|
||
echo "ALTER ROLE postgres WITH CONNECTION LIMIT ${PG_DB_CONNECTION_LIMIT};" | pg_execute
|
||
fi
|
||
}
|
||
|
||
# 为数据库 $PG_DATABASE 创建管理员账户
|
||
pg_create_admin_user() {
|
||
local -r escaped_password="${PG_PASSWORD//\'/\'\'}"
|
||
|
||
local connlimit_string=""
|
||
if [[ -n "${PG_USER_CONNECTION_LIMIT}" ]]; then
|
||
connlimit_string="CONNECTION LIMIT ${PG_USER_CONNECTION_LIMIT}"
|
||
fi
|
||
|
||
LOG_I "Creating user ${PG_USERNAME}"
|
||
echo "CREATE ROLE \"${PG_USERNAME}\" WITH LOGIN ${connlimit_string} CREATEDB PASSWORD '${escaped_password}';" | pg_execute
|
||
|
||
LOG_I "Granting access to \"${PG_USERNAME}\" to the database \"${PG_DATABASE}\""
|
||
echo "GRANT ALL PRIVILEGES ON DATABASE \"${PG_DATABASE}\" TO \"${PG_USERNAME}\"\;" | pg_execute "" "postgres" "${PG_POSTGRES_PASSWORD}"
|
||
}
|
||
|
||
# 为 primary-standby 复制模式创建用户
|
||
pg_create_replication_user() {
|
||
local -r escaped_password="${PG_REPLICATION_PASSWORD//\'/\'\'}"
|
||
LOG_I "Creating replication user ${PG_REPLICATION_USER}"
|
||
|
||
echo "CREATE ROLE \"${PG_REPLICATION_USER}\" WITH REPLICATION LOGIN ENCRYPTED PASSWORD '$escaped_password'" | pg_execute
|
||
}
|
||
|
||
# 创建用户自定义数据库 $PG_DATABASE
|
||
pg_create_custom_database() {
|
||
LOG_I "Creating custom database ${PG_DATABASE}"
|
||
|
||
echo "CREATE DATABASE \"${PG_DATABASE}\"" | pg_execute "" "postgres" "" "localhost"
|
||
}
|
||
|
||
# 使用运行中的 PostgreSQL 服务执行 SQL 操作
|
||
# 参数:
|
||
# $1 - 需要操作的数据库名
|
||
# $2 - 操作使用的用户名
|
||
# $3 - 操作用户密码
|
||
# $4 - 主机
|
||
# $5 - 端口
|
||
# $6 - 扩展参数 (如: -tA)
|
||
pg_execute() {
|
||
local -r db="${1:-}"
|
||
local -r user="${2:-postgres}"
|
||
local -r pass="${3:-}"
|
||
local -r host="${4:-localhost}"
|
||
local -r port="${5:-${PG_PORT_NUMBER}}"
|
||
local -r opts="${6:-}"
|
||
|
||
local cmd="$(command -v psql)"
|
||
local args=("-h" "$host" "-p" "$port" "-U" "$user")
|
||
[[ -n "$db" ]] && args+=("-d" "$db")
|
||
[[ -n "$opts" ]] && args+=("$opts")
|
||
|
||
LOG_D "Execute args: ${args[@]}"
|
||
debug_execute PGPASSWORD=$pass "${cmd}" "${args[@]}"
|
||
}
|
||
|
||
# 初始化 Master 节点数据库
|
||
pg_primary_init_db() {
|
||
LOG_I "Initializing PostgreSQL database"
|
||
|
||
local initdb_cmd="$(command -v initdb)"
|
||
local envExtraFlags=()
|
||
local initdb_args=()
|
||
if [[ -n "${PG_INITDB_ARGS}" ]]; then
|
||
read -r -a envExtraFlags <<< "${PG_INITDB_ARGS}"
|
||
initdb_args+=("${envExtraFlags[@]}")
|
||
fi
|
||
[[ "${PG_INITDB_WAL_DIR}" != "${PGDATA}/pg_wal" ]] && initdb_args+=("--waldir=${PG_INITDB_WAL_DIR}")
|
||
# 配置 local / host 访问策略都为 trust
|
||
initdb_args+=("--auth=trust")
|
||
|
||
LOG_D " extra initdb arguments: ${initdb_args[*]}"
|
||
debug_execute "${initdb_cmd}" -E UTF8 -D "${PGDATA}" -U "postgres" "${initdb_args[@]}"
|
||
}
|
||
|
||
# 初始化 Slave 节点数据库
|
||
pg_standby_init_db() {
|
||
LOG_I "Waiting for replication primary to accept connections..."
|
||
local check_cmd="$(command -v pg_isready)"
|
||
local check_args=("-h" "${PG_REPLICATION_HOST}" "-p" "${PG_REPLICATION_PORT}" "-U" "${PG_REPLICATION_USER}" "-d" "${PG_DATABASE}" "-t" "1")
|
||
|
||
local ready_counter=${PG_INIT_MAX_TIMEOUT}
|
||
while ! PGPASSWORD=${PG_REPLICATION_PASSWORD} "${check_cmd}" "${check_args[@]}" >/dev/null 2>&1;do
|
||
sleep 1
|
||
ready_counter=$(( ready_counter - 1 ))
|
||
if (( ready_counter <= 0 )); then
|
||
LOG_E "PostgreSQL primary is not ready after ${PG_INIT_MAX_TIMEOUT} seconds"
|
||
exit 1
|
||
fi
|
||
done
|
||
|
||
LOG_I "Replicating the database from node primary..."
|
||
local backup_cmd="$(command -v pg_basebackup)"
|
||
local backup_args=("-D" "${PGDATA}")
|
||
backup_args+=("-h" "${PG_REPLICATION_HOST}" "-p" "${PG_REPLICATION_PORT}" "-U" "${PG_REPLICATION_USER}" "-W")
|
||
backup_args+=("-C" "-S" "${PG_REPLICATION_APP_NAME}")
|
||
[[ "${PG_INITDB_WAL_DIR}" != "${PGDATA}/pg_wal" ]] && backup_args+=("--waldir=${PG_INITDB_WAL_DIR}")
|
||
backup_args+=("-X" "stream" "-v" "-R" "-F" "plain")
|
||
|
||
local replication_counter=0
|
||
while ! PGPASSWORD=${PG_REPLICATION_PASSWORD} "${backup_cmd}" "${backup_args[@]}";do
|
||
replication_counter=$(( replication_counter + 1 ))
|
||
LOG_D "Backup command failed ${replication_counter} times. Sleeping and trying again later[]"
|
||
sleep 5
|
||
done
|
||
}
|
||
|