Page MenuHomeDevCentral
Files F12297738

No OneTemporary
Actions

View Options

diff --git a/pillar/dbserver/cluster-B.sls b/pillar/dbserver/cluster-B.sls
index 1b9ae2b..2e153ab 100644
--- a/pillar/dbserver/cluster-B.sls
+++ b/pillar/dbserver/cluster-B.sls
@@ -1,134 +1,151 @@
dbserver_mysql_aliases:
hosts:
- &viperserv 172.27.27.33
- &windriver 172.27.27.35
- &web-001 172.27.27.10
dbserver_mysql:
server:
salt:
# Account used by Salt to configure the server
credentials: dbserver/cluster-B/users/salt
users:
# Password paths are relative to ops/secrets
nasqueron:
password: dbserver/cluster-B/users/nasqueron
host: *viperserv
privileges:
- database: Nasqueron
scope: database
- database: datacubes
scope: database
- database: datasource_lyrics
scope: table
privileges: SELECT, INSERT
tables:
# Tabled managed as datacube by Dæghrefn
- lyrics_sneakers
saas-mediawiki:
password: dbserver/cluster-B/users/saas-mediawiki
host: "%"
privileges:
- database: wikis
scope: database
- database: utopia
scope: database
- database: arsmagica
scope: database
- database: wolfplexdb
scope: database
- database: inidal_wiki
scope: database
- database: nasqueron_wiki
scope: database
###
### Nasqueron members
###
dereckson_www:
password: dbserver/cluster-B/users/dereckson_www
host: *web-001
privileges:
- database: Dereckson
scope: database
dereckson_blog:
password: dbserver/cluster-B/users/dereckson_blog
host: *web-001
privileges:
- database: Dereckson_Blog
scope: database
###
### Wolfplex
###
wolfplex_zine:
password: dbserver/cluster-B/users/wolfplex_zine
host: *windriver
privileges:
- database: wolfplex_zine
scope: database
###
### Zed / HyperShip
###
zed:
password: dbserver/cluster-B/users/zed
host: *web-001
privileges:
- database: zed_prod
scope: database
+ ###
+ ### Maintenance accounts
+ ###
+
+ dereckson:
+ password: dbserver/cluster-B/users/dereckson
+ host: *windriver
+ privileges:
+ - database: Nasqueron
+ scope: database
+ - database: datacubes
+ scope: database
+ - database: datasource_%
+ scope: database
+ - database: wolfplex_%
+ scope: database
+
# Notes for databases encoding and collation:
#
# This is a MariaDB cluster. At version 10.6, MariaDB is still using utf8mb3
# by default, but we generally prefer utf8mb4 as encoding.
#
# For collation, MySQL 8 uses utf8mb4_0900_ai_ci / utf8mb4_0900_as_cs
# It's a accent (in)sensitive case (in)sensitive based on Unicode 9.0.
# For MariaDB 10.10+, we can use uca1400_as_ci, that's Unicode 14.0.
#
# We note it with the full name utf8mb4_uca1400_as_ci, something not needed
# for manual requests, but allowing mysql_database.present to check equality.
#
# TRANSITION NOTE. On MariaDB 10.6, utf8mb4_unicode_520_ci is the "newest".
# From 2023-04-15, we starting to use uca1400_as_ci as default collation.
databases:
# Database used by IRC eggdrops
Nasqueron: &unicode
encoding: utf8mb4
collation: utf8mb4_uca1400_as_ci
datacubes: *unicode
datasource_lyrics: *unicode
# Databases used by MediaWiki SaaS
wikis: &mediawiki
encoding: utf8mb4
collation: utf8mb4_bin
arsmagica: *mediawiki
inidal_wiki: *mediawiki
nasqueron_wiki: *mediawiki
# Databases used by MediaWiki SaaS - still to split from other content
utopia: *mediawiki
wolfplexdb: *mediawiki
# Nasqueron members
Dereckson: *unicode
Dereckson_Blog: *unicode
# Wolfplex
wolfplex_zine: *unicode
# Zed / Hypership
zed_prod: *unicode
diff --git a/roles/dbserver-mysql/content/init.sls b/roles/dbserver-mysql/content/init.sls
index cae26c4..0bf24c2 100644
--- a/roles/dbserver-mysql/content/init.sls
+++ b/roles/dbserver-mysql/content/init.sls
@@ -1,93 +1,95 @@
# -------------------------------------------------------------
# Salt — Database server — MySQL
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
# Project: Nasqueron
# Pillar: dbserver_mysql (in pillar/dbserver)
# License: Trivial work, not eligible to copyright
# If eligible, licensed under BSD-2-Clause
# -------------------------------------------------------------
{% set users = salt['pillar.get']("dbserver_mysql:users", {}) %}
{% set databases = salt['pillar.get']("dbserver_mysql:databases", {}) %}
# -------------------------------------------------------------
# Users
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
{% for username, args in users.items() %}
dbserver_mysql_user_{{ username }}:
mysql_user.present:
- name: {{ username }}
- host: {{ args["host"] | yaml_dquote }}
- password: {{ salt["credentials.get_password"](args["password"]) }}
{% endfor %}
# -------------------------------------------------------------
# Databases
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
{% for db_name, args in databases.items() %}
dbserver_mysql_db_{{ db_name }}:
mysql_database.present:
- name: {{ db_name }}
{% if "encoding" in args %}
- character_set: {{ args["encoding"] }}
{% endif %}
{% if "collation" in args %}
- collate: {{ args["collation"] }}
{% endif %}
{% endfor %}
# -------------------------------------------------------------
# Privileges
#
# Scopes supported:
# - database (alias for GRANT ALL PRIVILEGES on <db>.* TO ...)
# - table (GRANT ... on <db>.<table> TO ...)
#
# The state module mysql_grants uses the value database for the ON clause:
# `GRANT ... ON <database> TO ...`
#
# The "database" field should so be read as "priv_level"
# according https://mariadb.com/kb/en/grant/#syntax name.
#
# Please note using "database" instead or "privilege_level"
# isn't considered as a a best practice. We understand to use
# directly mysql_grants simplifies the module configuration
# and as such this may be necessary for compatibility, but
# we encourage a more precise terminology.
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
{% for username, user_args in users.items() %}
{% for privilege in user_args.get("privileges", []) %}
{% set idx = loop.index %}
{% if privilege["scope"] == "database" %}
dbserver_mysql_user_{{ username }}_privilege_{{ idx }}_{{ privilege["database"] }}:
mysql_grants.present:
- grant: all privileges
- database: {{ privilege["database"] }}.*
- user: {{ username }}
- host: {{ user_args["host"] | yaml_dquote }}
- require:
- dbserver_mysql_user_{{ username }}
+{% if "%" not in privilege["database"] %}
- dbserver_mysql_db_{{ privilege["database"] }}
{% endif %}
+{% endif %}
{% if privilege["scope"] == "table" %}
{% for table in privilege["tables"] %}
dbserver_mysql_user_{{ username }}_privilege_{{ idx }}_{{ table }}:
mysql_grants.present:
- grant: {{ privilege["privileges"] }}
- database: {{ privilege["database"] }}.{{ table }}
- user: {{ username }}
- host: {{ user_args["host"] | yaml_dquote }}
- require:
- dbserver_mysql_user_{{ username }}
- dbserver_mysql_db_{{ privilege["database"] }}
{% endfor %}
{% endif %}
{% endfor %}
{% endfor %}

File Metadata

Mime Type
text/x-diff
Expires
Wed, Oct 22, 12:59 (1 d, 16 h)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
3092198
Default Alt Text
(7 KB)

Event Timeline

Nasqueron DevCentral · If it had been much bigger the moon would have had a core of ice. · Powered by Phabricator