seon
bd74aead51
WP-09(Terraform 설계서 6.10, 실험·앱 설계서 3.3). - postgres-primary: PostgreSQL 16, conf.d 오버라이드(listen *, ssl on, scram, wal_level replica, slot 10, wal_keep_size 256MB), pg_hba는 hostssl+scram만(app: AWS·GCP 대역, harness: GCP 대역, replicator: 10.20.0.21). 역할 app/replicator/harness(비밀번호는 Secret Manager selfheal-db-password), DB app + 스키마 app.price·app.orders + 시드. harness에 pg_wal_replay_pause/resume·pg_promote EXECUTE와 pg_read_all_stats 부여 (카탈로그 db.replay_resume·db.promote). - postgres-replica: 첫 실행에 pg_basebackup -R -C -S replica1(TLS 필수)로 standby 구성, 이후 실행은 재시작만.
53 lines
2.6 KiB
Bash
Executable File
53 lines
2.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# db-replica (10.20.0.21): hot standby of db-primary via streaming replication (Terraform design 6.10;
|
|
# PostgreSQL docs 26.2.4/26.2.5). First run: pg_basebackup -R (creates standby.signal + primary_conninfo, slot replica1).
|
|
# Re-runs leave an existing standby alone. Password from Secret Manager via the VM SA.
|
|
set -euo pipefail
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
PGV=16
|
|
PRIMARY_IP=10.20.0.20
|
|
DATA=/var/lib/postgresql/${PGV}/main
|
|
CONF=/etc/postgresql/${PGV}/main
|
|
|
|
apt-get update -qq
|
|
apt-get install -y -qq postgresql-${PGV} jq >/dev/null
|
|
install -d -m 755 -o postgres -g postgres "$CONF/conf.d"
|
|
cat > "$CONF/conf.d/10-selfheal.conf" <<CONF
|
|
# managed by selfheal-lab-gitops vm/postgres-replica/apply.sh
|
|
listen_addresses = '*'
|
|
ssl = on
|
|
password_encryption = 'scram-sha-256'
|
|
hot_standby = on
|
|
log_line_prefix = '%m [%p] %u@%d '
|
|
CONF
|
|
cat > "$CONF/pg_hba.conf" <<HBA
|
|
# managed by selfheal-lab-gitops vm/postgres-replica/apply.sh
|
|
local all postgres peer
|
|
local all all peer
|
|
hostssl app app 10.10.0.0/16 scram-sha-256
|
|
hostssl app app 10.20.0.0/20 scram-sha-256
|
|
hostssl all harness 10.20.0.0/20 scram-sha-256
|
|
HBA
|
|
chown postgres:postgres "$CONF/conf.d/10-selfheal.conf" "$CONF/pg_hba.conf"; chmod 640 "$CONF/pg_hba.conf"
|
|
|
|
if [ -f "$DATA/standby.signal" ]; then
|
|
echo "already a standby; restarting to pick up config"
|
|
systemctl restart postgresql
|
|
else
|
|
PROJECT="$(curl -sf -H 'Metadata-Flavor: Google' http://metadata.google.internal/computeMetadata/v1/project/project-id)"
|
|
TOKEN="$(curl -sf -H 'Metadata-Flavor: Google' 'http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token' | jq -r .access_token)"
|
|
PGPASSWORD="$(curl -sf -H "Authorization: Bearer ${TOKEN}" "https://secretmanager.googleapis.com/v1/projects/${PROJECT}/secrets/selfheal-db-password/versions/latest:access" | jq -r .payload.data | base64 -d)"
|
|
unset TOKEN; export PGPASSWORD
|
|
[ -n "$PGPASSWORD" ] || { echo "empty DB password" >&2; exit 1; }
|
|
systemctl stop postgresql
|
|
rm -rf "$DATA"
|
|
install -d -m 700 -o postgres -g postgres "$DATA"
|
|
sudo -u postgres PGPASSWORD="$PGPASSWORD" PGSSLMODE=require pg_basebackup -h "$PRIMARY_IP" -U replicator -D "$DATA" -R -X stream -C -S replica1 -P
|
|
unset PGPASSWORD
|
|
systemctl start postgresql
|
|
fi
|
|
sleep 3
|
|
echo "--- replica status"
|
|
sudo -u postgres psql -Atc "select pg_is_in_recovery()"
|
|
sudo -u postgres psql -Atc "select status, sender_host, slot_name from pg_stat_wal_receiver" 2>/dev/null || true
|