security rule for the prometheus postgresql exporter.

s2i2s/project-setup/security-groups.tf

@@ -43,6 +43,26 @@ resource "openstack_networking_secgroup_rule_v2" "prometheus-node" {
   remote_ip_prefix  = local.basic_services_ip.prometheus_cidr
 }
 
+# postgres_exporter, installed by the postgresql role on the database server
+# (see infrastructure-playbooks, postgresql-cloud.yml).
+#
+# In the DEFAULT security group and not in modules/postgresql on purpose: the
+# address Prometheus scrapes is the one on the main private network, and that
+# port carries the default security group only - the groups of the module are
+# attached to the service port, on the dedicated database network. Same reason,
+# and same shape, as the node exporter rule above: the source is a single host,
+# and a VM that does not run the exporter has nothing listening on 9187.
+resource "openstack_networking_secgroup_rule_v2" "prometheus-postgres-exporter" {
+  security_group_id = openstack_networking_secgroup_v2.default.id
+  description       = "Prometheus access to the postgres exporter"
+  direction         = "ingress"
+  ethertype         = "IPv4"
+  protocol          = "tcp"
+  port_range_min    = 9187
+  port_range_max    = 9187
+  remote_ip_prefix  = local.basic_services_ip.prometheus_cidr
+}
+
 #
 # SSH access to the jump proxy. Used by the jump proxy VM only
 resource "openstack_networking_secgroup_v2" "access_to_the_jump_proxy" {