Page MenuHomeDevCentral
Files F3777657

D2987.diff
No OneTemporary
Actions

D2987.diff
View Options

diff --git a/pillar/credentials/vault.sls b/pillar/credentials/vault.sls
--- a/pillar/credentials/vault.sls
+++ b/pillar/credentials/vault.sls
@@ -222,3 +222,7 @@
# Main PostgreSQL cluster
A:
- ops/secrets/dbserver/cluster-A/users/*
+
+ # Main MariaDB cluster - Alkane PaaS, ViperServ
+ B:
+ - ops/secrets/dbserver/cluster-B/users/*
diff --git a/pillar/dbserver/cluster-B.sls b/pillar/dbserver/cluster-B.sls
new file mode 100644
--- /dev/null
+++ b/pillar/dbserver/cluster-B.sls
@@ -0,0 +1,36 @@
+dbserver_mysql_aliases:
+ hosts:
+ - &viperserv 172.27.27.33
+
+dbserver_mysql:
+
+ server:
+ salt:
+ # Account used by Salt to configure the server
+ credentials: dbserver/cluster-B/users/salt
+
+ users:
+ # Password paths are relative to ops/secrets
+
+ nasqueron:
+ password: dbserver/cluster-B/users/nasqueron
+ host: *viperserv
+ privileges:
+ - database: Nasqueron
+ scope: database
+
+ # Tips for databases:
+ # This is a MariaDB cluster. At version 10.6, MariaDB is still using utf8mb3
+ # by default, but we generally prefer utf8mb4 as encoding.
+ #
+ # For collation, MySQL 8 uses utf8mb4_0900_ai_ci / utf8mb4_0900_as_cs
+ # It's a accent (in)sensitive case (in)sensitive based on Unicode 9.0.
+ # For MariaDB 10.10+, we can use uca1400_as_ci, that's Unicode 14.0.
+ #
+ # TRANSITION NOTE. On MariaDB 10.6, utf8mb4_unicode_520_ci is the "newest".
+
+ databases:
+ # Database used by IRC eggdrops
+ Nasqueron: &unicode
+ encoding: utf8mb4
+ collation: utf8mb4_unicode_520_ci
diff --git a/pillar/top.sls b/pillar/top.sls
--- a/pillar/top.sls
+++ b/pillar/top.sls
@@ -37,6 +37,9 @@
db-A-001:
- dbserver.cluster-A
+ db-B-001:
+ - dbserver.cluster-B
+
dwellers:
- paas.docker
- saas.jenkins
diff --git a/roles/dbserver-mysql/content/init.sls b/roles/dbserver-mysql/content/init.sls
new file mode 100644
--- /dev/null
+++ b/roles/dbserver-mysql/content/init.sls
@@ -0,0 +1,92 @@
+# -------------------------------------------------------------
+# Salt — Database server — MySQL
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+# Project: Nasqueron
+# Pillar: dbserver_mysql (in pillar/dbserver)
+# License: Trivial work, not eligible to copyright
+# If eligible, licensed under BSD-2-Clause
+# -------------------------------------------------------------
+
+{% set users = salt['pillar.get']("dbserver_mysql:users", {}) %}
+{% set databases = salt['pillar.get']("dbserver_mysql:databases", {}) %}
+
+# -------------------------------------------------------------
+# Users
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+{% for username, args in users.items() %}
+dbserver_mysql_user_{{ username }}:
+ mysql_user.present:
+ - name: {{ username }}
+ - host: {{ args["host"] }}
+ - password: {{ salt["credentials.get_password"](args["password"]) }}
+{% endfor %}
+
+# -------------------------------------------------------------
+# Databases
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+{% for db_name, args in databases.items() %}
+dbserver_mysql_db_{{ db_name }}:
+ mysql_database.present:
+ - name: {{ db_name }}
+ {% if "encoding" in args %}
+ - character_set: {{ args["encoding"] }}
+ {% endif %}
+ {% if "collation" in args %}
+ - collate: {{ args["collation"] }}
+ {% endif %}
+{% endfor %}
+
+# -------------------------------------------------------------
+# Privileges
+#
+# Scopes supported:
+# - database (alias for GRANT ALL PRIVILEGES on <db>.* TO ...)
+# - table (GRANT ... on <db>.<table> TO ...)
+#
+# The state module mysql_grants uses the value database for the ON clause:
+# `GRANT ... ON <database> TO ...`
+#
+# The "database" field should so be read as "priv_level"
+# according https://mariadb.com/kb/en/grant/#syntax name.
+#
+# Please note using "database" instead or "privilege_level"
+# isn't considered as a a best practice. We understand to use
+# directly mysql_grants simplifies the module configuration
+# and as such this may be necessary for compatibility, but
+# we encourage a more precise terminology.
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+{% for username, user_args in users.items() %}
+{% for privilege in user_args.get("privileges", []) %}
+
+{% set idx = loop.index %}
+
+{% if privilege["scope"] == "database" %}
+dbserver_mysql_user_{{ username }}_privilege_{{ idx }}_{{ privilege["database"] }}:
+ mysql_grants.present:
+ - grant: all privileges
+ - database: {{ privilege["database"] }}.*
+ - user: {{ username }}
+ - host: {{ user_args["host"] }}
+ - require:
+ - dbserver_mysql_user_{{ username }}
+ - dbserver_mysql_db_{{ privilege["database"] }}
+{% endif %}
+
+{% if privilege["scope"] == "table" %}
+{% for table in privilege["tables"] %}
+dbserver_mysql_user_{{ username }}_privilege_{{ idx }}_{{ table }}:
+ mysql_grants.present:
+ - grant: {{ privilege["privileges"] }}
+ - database: {{ privilege["database"] }}.{{ table }}
+ - user: {{ username }}
+ - require:
+ - dbserver_mysql_user_{{ username }}
+ - dbserver_mysql_db_{{ privilege["database"] }}
+{% endfor %}
+{% endif %}
+
+{% endfor %}
+{% endfor %}
diff --git a/roles/dbserver-mysql/init.sls b/roles/dbserver-mysql/init.sls
--- a/roles/dbserver-mysql/init.sls
+++ b/roles/dbserver-mysql/init.sls
@@ -10,3 +10,7 @@
- .mysql-server
- .grc
- .treasure-chest
+ - .salt
+
+ # Requires .mysql-server and .salt
+ - .content
diff --git a/roles/dbserver-mysql/salt/files/dbserver_mysql_salt_credentials.py b/roles/dbserver-mysql/salt/files/dbserver_mysql_salt_credentials.py
new file mode 100644
--- /dev/null
+++ b/roles/dbserver-mysql/salt/files/dbserver_mysql_salt_credentials.py
@@ -0,0 +1,68 @@
+#!/usr/bin/env python3
+
+# -------------------------------------------------------------
+# Salt - configuration
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+# Project: Nasqueron
+# License: Trivial work, not eligible to copyright
+# Source file: roles/dbserver-mysql/salt/files/dbserver_mysql_salt_credentials.py
+# -------------------------------------------------------------
+#
+# <auto-generated>
+# This file is managed by our rOPS SaltStack repository.
+#
+# Changes to this file may cause incorrect behavior
+# and will be lost if the state is redeployed.
+# </auto-generated>
+
+
+import os
+import subprocess
+import sys
+import yaml
+
+
+def read_config(config_path):
+ with open(config_path) as fd:
+ return yaml.safe_load(fd)
+
+
+def prepare_query(query, config):
+ query = query.replace("%%username%%", config["mysql.user"])
+ query = query.replace("%%password%%", config["mysql.pass"])
+ return query
+
+
+def run_query(query, config):
+ query = prepare_query(query, config)
+ with open(".query", "w") as fd:
+ fd.write(query)
+ subprocess.run("mysql < .query", shell=True)
+ os.remove(".query")
+
+
+def provision_account(config):
+ query = (
+ "CREATE OR REPLACE USER %%username%%@localhost IDENTIFIED BY '%%password%%';"
+ )
+ run_query(query, config)
+
+ query = (
+ "GRANT ALL PRIVILEGES ON *.* TO '%%username%%'@'localhost' WITH GRANT OPTION;"
+ )
+ run_query(query, config)
+
+
+def run(config_path):
+ config = read_config(config_path)
+ provision_account(config)
+
+
+if __name__ == "__main__":
+ argc = len(sys.argv)
+
+ if argc < 2:
+ print(f"Usage: {sys.argv[0]} <configuration path>", file=sys.stderr)
+ sys.exit(1)
+
+ run(sys.argv[1])
diff --git a/roles/dbserver-mysql/salt/files/mysql.conf b/roles/dbserver-mysql/salt/files/mysql.conf
new file mode 100644
--- /dev/null
+++ b/roles/dbserver-mysql/salt/files/mysql.conf
@@ -0,0 +1,22 @@
+# -------------------------------------------------------------
+# Salt - configuration
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+# Project: Nasqueron
+# License: Trivial work, not eligible to copyright
+# Source file: roles/dbserver-mysql/salt/files/mysql.conf
+# -------------------------------------------------------------
+#
+# <auto-generated>
+# This file is managed by our rOPS SaltStack repository.
+#
+# Changes to this file may cause incorrect behavior
+# and will be lost if the state is redeployed.
+# </auto-generated>
+
+mysql.host: 'localhost'
+mysql.port: 3306
+mysql.user: '{{ secret["username"] }}'
+mysql.pass: '{{ secret["password"] }}'
+mysql.db: 'mysql'
+mysql.unix_socket: '/var/run/mysql/mysqld.sock'
+mysql.charset: 'utf8mb4'
diff --git a/roles/dbserver-mysql/salt/init.sls b/roles/dbserver-mysql/salt/init.sls
new file mode 100644
--- /dev/null
+++ b/roles/dbserver-mysql/salt/init.sls
@@ -0,0 +1,42 @@
+# -------------------------------------------------------------
+# Salt — Database server — MySQL
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+# Project: Nasqueron
+# License: Trivial work, not eligible to copyright
+# -------------------------------------------------------------
+
+{% from "map.jinja" import dirs, packages_prefixes with context %}
+
+# -------------------------------------------------------------
+# Required software
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+{{ packages_prefixes.python3 }}pymysql:
+ pkg.installed:
+ - reload_modules: true
+
+# -------------------------------------------------------------
+# Salt node configuration file
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+{% set salt_credential = salt["pillar.get"]("dbserver_mysql:server:salt:credentials") %}
+
+{{ dirs.etc }}/salt/minion.d/mysql:
+ file.managed:
+ - source: salt://roles/dbserver-mysql/salt/files/mysql.conf
+ - user: root
+ - mode: 400
+ - template: jinja
+ - context:
+ secret: {{ salt["credentials.read_secret"](salt_credential) }}
+
+# -------------------------------------------------------------
+# Provision Salt credentials
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+dbserver_mysql_salt_credentials:
+ cmd.script:
+ - name: salt://roles/dbserver-mysql/salt/files/dbserver_mysql_salt_credentials.py
+ - args: {{ dirs.etc }}/salt/minion.d/mysql
+ - onchanges:
+ - file: {{ dirs.etc }}/salt/minion.d/mysql

File Metadata

Mime Type
text/plain
Expires
Tue, Nov 26, 02:07 (21 h, 16 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
2263749
Default Alt Text
D2987.diff (10 KB)

Event Timeline

Nasqueron DevCentral · If it had been much bigger the moon would have had a core of ice. · Powered by Phabricator