90 lines
2.4 KiB
Bash
90 lines
2.4 KiB
Bash
# Sourced by managed-container; uses the shared OCF and parameter environment.
|
|
|
|
pg_replication_exec()
|
|
{
|
|
as_service_user \
|
|
podman exec \
|
|
--user "${PG_OS_USER}" \
|
|
"${CONTAINER_NAME}" \
|
|
sh -c '
|
|
if [ -z "${POSTGRES_REPLICATION_PASSWORD:-}" ]; then
|
|
printf "%s\n" \
|
|
"POSTGRES_REPLICATION_PASSWORD is missing from container environment" \
|
|
>&2
|
|
exit 1
|
|
fi
|
|
|
|
export PGPASSWORD="${POSTGRES_REPLICATION_PASSWORD}"
|
|
|
|
exec "$@"
|
|
' sh "$@"
|
|
}
|
|
|
|
ensure_rewind_privileges()
|
|
{
|
|
local repl_user
|
|
|
|
repl_user="$(
|
|
pg_command '
|
|
printf "%s" "${POSTGRES_REPLICATION_USER:-}"
|
|
' 2>/dev/null
|
|
)" || {
|
|
ocf_exit_reason \
|
|
"Unable to read POSTGRES_REPLICATION_USER from container"
|
|
return "${OCF_ERR_GENERIC}"
|
|
}
|
|
|
|
if [ -z "${repl_user}" ]; then
|
|
ocf_exit_reason \
|
|
"POSTGRES_REPLICATION_USER is empty"
|
|
return "${OCF_ERR_CONFIGURED}"
|
|
fi
|
|
|
|
case "${repl_user}" in
|
|
*[!A-Za-z0-9_]*)
|
|
ocf_exit_reason \
|
|
"Invalid replication role name: ${repl_user}"
|
|
return "${OCF_ERR_CONFIGURED}"
|
|
;;
|
|
esac
|
|
|
|
ocf_log info \
|
|
"Ensuring pg_rewind source privileges for role ${repl_user}"
|
|
|
|
if ! pg_command "
|
|
psql \
|
|
-U '${DB_USER}' \
|
|
-d postgres \
|
|
-v ON_ERROR_STOP=1 \
|
|
-c \"
|
|
GRANT EXECUTE
|
|
ON FUNCTION pg_catalog.pg_ls_dir(text, boolean, boolean)
|
|
TO ${repl_user};
|
|
|
|
GRANT EXECUTE
|
|
ON FUNCTION pg_catalog.pg_stat_file(text, boolean)
|
|
TO ${repl_user};
|
|
|
|
GRANT EXECUTE
|
|
ON FUNCTION pg_catalog.pg_read_binary_file(text)
|
|
TO ${repl_user};
|
|
|
|
GRANT EXECUTE
|
|
ON FUNCTION pg_catalog.pg_read_binary_file(
|
|
text,
|
|
bigint,
|
|
bigint,
|
|
boolean
|
|
)
|
|
TO ${repl_user};
|
|
\"
|
|
" >/dev/null
|
|
then
|
|
ocf_exit_reason \
|
|
"Failed ensuring pg_rewind privileges for ${repl_user}"
|
|
return "${OCF_ERR_GENERIC}"
|
|
fi
|
|
|
|
return "${OCF_SUCCESS}"
|
|
}
|