56 lines
1.9 KiB
Markdown
56 lines
1.9 KiB
Markdown
# PostgreSQL server of the S2I2S project
|
|
|
|
One VM, `m1.large` (RAM 8 - VCPUs 4), Ubuntu 24.04, 20 GB of root disk, with
|
|
**two interfaces**:
|
|
|
|
| Interface | Address | Use |
|
|
|---|---|---|
|
|
| main private network | `10.10.0.162` | administration: ansible, monitoring, backups |
|
|
| `postgresql-srv-net` (created here) | `192.168.0.5` | the only address the database listens on |
|
|
|
|
and **two SSD volumes of 100 GB** (`CephSSD`): `/dev/vdb` for the data
|
|
directory, `/dev/vdc` for the write ahead log.
|
|
|
|
The dedicated network is `192.168.0.0/22`, no gateway, DHCP pool
|
|
`192.168.0.100 - 192.168.3.254`. The addresses match what the ansible playbooks
|
|
already expect (`postgresql_production_host` and
|
|
`shared_postgresql_server_public` in `group_vars/openstack_s2i2s` of
|
|
`infrastructure-playbooks`).
|
|
|
|
Two security groups are created:
|
|
|
|
* `access_to_the_postgresql_service` — on the server port: ingress on 5432 and
|
|
ICMP from `192.168.0.0/22` only;
|
|
* `vm_access_to_the_postgresql_service` — to be put on the port that **every
|
|
client** has in the dedicated network: egress to `192.168.0.5/32:5432` plus
|
|
ICMP and DHCP. Its ID is an output of this workspace, used for instance by
|
|
`s2i2s/keycloak`.
|
|
|
|
The resources, the sizing and the dedicated network are in
|
|
[`../../modules/postgresql`](../../modules/postgresql), as defaults of
|
|
`postgresql_data`: override them in the module call to change them. The only
|
|
thing this workspace decides is the address on the main private network, which
|
|
comes from the address plan in [`../variables`](../variables)
|
|
(`basic_services_ip.postgresql`).
|
|
|
|
## Order of the applies
|
|
|
|
```
|
|
main_net_dns_router -> project-setup -> postgresql
|
|
```
|
|
|
|
This workspace reads the state of the first two.
|
|
|
|
```bash
|
|
tofu init
|
|
tofu plan -out=postgresql.plan
|
|
tofu apply postgresql.plan
|
|
```
|
|
|
|
After the apply, regenerate the ansible inventory in
|
|
`infrastructure-playbooks`, which reads this state:
|
|
|
|
```bash
|
|
ansible-playbook tofu-inventory.yml --diff
|
|
```
|