Skip to content

Commit c0eb2bd

Browse files
alemaccialemacci
committed
feat(conf): refactor pgtde.yml and add HA template
1 parent e7b999d commit c0eb2bd

2 files changed

Lines changed: 149 additions & 5 deletions

File tree

‎conf/ha/pgtde.yml‎

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
---
2+
#==============================================================#
3+
# File : pgtde.yml
4+
# Desc : PG TDE with Percona PostgreSQL 3-node HA template
5+
# Ctime : 2025-07-04
6+
# Mtime : 2026-07-23
7+
# Docs : https://pigsty.io/docs/conf/pgtde
8+
# License : Apache-2.0 @ https://pigsty.io/docs/about/license/
9+
# Copyright : 2018-2026 Ruohang Feng / Vonng (rh@vonng.com)
10+
#==============================================================#
11+
12+
# HA variant of the single-node template with pg_tde
13+
# currently based on PostgreSQL 18
14+
# tutorial: https://pigsty.io/docs/pgsql/kernel/percona
15+
#
16+
# Usage:
17+
# curl https://repo.pigsty.io/get | bash
18+
# ./configure -c pgtde
19+
# ./deploy.yml
20+
21+
all:
22+
children:
23+
24+
infra:
25+
hosts:
26+
10.10.10.10: { infra_seq: 1 }
27+
vars:
28+
repo_enabled: false
29+
haproxy_services:
30+
- name: openbao # [REQUIRED] service name, unique
31+
port: 8200 # [REQUIRED] service port, unique
32+
options: # [OPTIONAL] openbao health check
33+
- option httpchk
34+
- http-check send meth GET uri /v1/sys/health
35+
- http-check expect status 200
36+
servers:
37+
- { name: openbao-1 ,ip: 10.10.10.11 ,port: 8200 ,options: 'check-ssl ca-file /etc/pki/ca.crt check' }
38+
- { name: openbao-2 ,ip: 10.10.10.12 ,port: 8200 ,options: 'check-ssl ca-file /etc/pki/ca.crt check' }
39+
- { name: openbao-3 ,ip: 10.10.10.13 ,port: 8200 ,options: 'check-ssl ca-file /etc/pki/ca.crt check' }
40+
41+
# etcd cluster for ha postgres
42+
etcd:
43+
hosts:
44+
10.10.10.11: { etcd_seq: 1 }
45+
10.10.10.12: { etcd_seq: 2 }
46+
10.10.10.13: { etcd_seq: 3 }
47+
vars:
48+
etcd_cluster: etcd
49+
50+
# openbao kms cluster for pg_tde
51+
openbao:
52+
hosts:
53+
10.10.10.11: { openbao_seq: 1 }
54+
10.10.10.12: { openbao_seq: 2 }
55+
10.10.10.13: { openbao_seq: 3 }
56+
vars:
57+
openbao_cluster: openbao
58+
59+
#minio: { hosts: { 10.10.10.10: { minio_seq: 1 }} ,vars: { minio_cluster: minio }}
60+
61+
#----------------------------------------------#
62+
# Percona Postgres Database Cluster
63+
#----------------------------------------------#
64+
pg-meta:
65+
hosts:
66+
10.10.10.21: { pg_seq: 1 , pg_role: primary }
67+
10.10.10.22: { pg_seq: 2 , pg_role: replica }
68+
10.10.10.23: { pg_seq: 3 , pg_role: replica }
69+
vars:
70+
pg_mode: pgtde
71+
pg_cluster: pg-meta
72+
pg_vip_enabled: true
73+
pg_vip_address: 10.10.10.20/24
74+
pg_users:
75+
- { name: dbuser_meta ,password: DBUser.Meta ,pgbouncer: true ,roles: [dbrole_admin ] ,comment: pigsty admin user }
76+
- { name: dbuser_view ,password: DBUser.Viewer ,pgbouncer: true ,roles: [dbrole_readonly] ,comment: read-only viewer }
77+
pg_databases:
78+
- name: meta
79+
baseline: cmdb.sql
80+
comment: pigsty tde database
81+
schemas: [pigsty]
82+
extensions: [ pg_tde, vector, postgis, pgaudit, { name: pg_stat_monitor, schema: monitor } ]
83+
pg_hba_rules: # https://pigsty.io/docs/pgsql/config/hba
84+
- { user: all ,db: all ,addr: intra ,auth: pwd ,title: 'everyone intranet access with password' ,order: 800 }
85+
pg_crontab: # https://pigsty.io/docs/pgsql/admin/crontab
86+
- '00 01 * * * /pg/bin/pg-backup full'
87+
88+
# Percona PostgreSQL TDE Kernel Settings
89+
pg_packages: [ pgtde, pgsql-common ] # install Pigsty private-prefix Percona packages
90+
pg_libs: 'pg_tde, pgaudit, pg_stat_statements, pg_stat_monitor, auto_explain'
91+
92+
vars:
93+
#----------------------------------------------#
94+
# INFRA : https://pigsty.io/docs/infra/param
95+
#----------------------------------------------#
96+
version: v4.5.0 # pigsty version string
97+
admin_ip: 10.10.10.10 # admin node ip address
98+
region: default # upstream mirror region: default,china,europe
99+
infra_portal: # infra services exposed via portal
100+
home : { domain: i.pigsty } # default domain name
101+
openbao : { domain: bao.pigsty ,endpoint: "10.10.10.10:8200" ,scheme: https }
102+
103+
#----------------------------------------------#
104+
# NODE : https://pigsty.io/docs/node/param
105+
#----------------------------------------------#
106+
nodename_overwrite: false # do not overwrite node hostname on single node mode
107+
node_repo_modules: node,infra,pgsql
108+
node_tune: oltp
109+
node_etc_hosts: ["10.10.10.10 bao.pigsty"] # domain name to access openbao from all nodes (required)
110+
111+
#----------------------------------------------#
112+
# PGSQL : https://pigsty.io/docs/pgsql/param
113+
#----------------------------------------------#
114+
pg_version: 18 # Default Percona TDE PG Major Version is 18
115+
pg_conf: oltp.yml # pgsql tuning specs: {oltp,olap,tiny,crit}.yml
116+
117+
#----------------------------------------------#
118+
# OPENBAO
119+
#----------------------------------------------#
120+
openbao_cluster: openbao # bao cluster & group name, openbao by default
121+
openbao_domain: bao.pigsty # bao domain name, `bao.pigsty` by default
122+
123+
#----------------------------------------------#
124+
# PASSWORD : https://pigsty.io/docs/setup/security/
125+
#----------------------------------------------#
126+
grafana_admin_password: pigsty
127+
grafana_view_password: DBUser.Viewer
128+
pg_admin_password: DBUser.DBA
129+
pg_monitor_password: DBUser.Monitor
130+
pg_replication_password: DBUser.Replicator
131+
patroni_password: Patroni.API
132+
haproxy_admin_password: pigsty
133+
minio_secret_key: S3User.MinIO
134+
etcd_root_password: Etcd.Root
135+
...

‎conf/pgtde.yml‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,10 @@
2020

2121
all:
2222
children:
23-
infra: { hosts: { 10.10.10.10: { infra_seq: 1 }} ,vars: { repo_enabled: false }}
24-
etcd: { hosts: { 10.10.10.10: { etcd_seq: 1 }} ,vars: { etcd_cluster: etcd }}
25-
#minio: { hosts: { 10.10.10.10: { minio_seq: 1 }} ,vars: { minio_cluster: minio }}
23+
infra: { hosts: { 10.10.10.10: { infra_seq: 1 }} ,vars: { repo_enabled: false }}
24+
etcd: { hosts: { 10.10.10.10: { etcd_seq: 1 }} ,vars: { etcd_cluster: etcd }}
25+
openbao: { hosts: { 10.10.10.10: { openbao_seq: 1 }} ,vars: { openbao_cluster: openbao }}
26+
#minio: { hosts: { 10.10.10.10: { minio_seq: 1 }} ,vars: { minio_cluster: minio }}
2627

2728
#----------------------------------------------#
2829
# Percona Postgres Database Cluster
@@ -41,7 +42,7 @@ all:
4142
baseline: cmdb.sql
4243
comment: pigsty tde database
4344
schemas: [pigsty]
44-
extensions: [ vector, postgis, pg_tde ,pgaudit, { name: pg_stat_monitor, schema: monitor } ]
45+
extensions: [ pg_tde, vector, postgis ,pgaudit, { name: pg_stat_monitor, schema: monitor } ]
4546
pg_hba_rules: # https://pigsty.io/docs/pgsql/config/hba
4647
- { user: all ,db: all ,addr: intra ,auth: pwd ,title: 'everyone intranet access with password' ,order: 800 }
4748
pg_crontab: # https://pigsty.io/docs/pgsql/admin/crontab
@@ -59,21 +60,29 @@ all:
5960
admin_ip: 10.10.10.10 # admin node ip address
6061
region: default # upstream mirror region: default,china,europe
6162
infra_portal: # infra services exposed via portal
62-
home : { domain: i.pigsty } # default domain name
63+
home : { domain: i.pigsty } # default domain name
64+
openbao : { domain: bao.pigsty ,endpoint: "10.10.10.10:8200" ,scheme: https }
6365

6466
#----------------------------------------------#
6567
# NODE : https://pigsty.io/docs/node/param
6668
#----------------------------------------------#
6769
nodename_overwrite: false # do not overwrite node hostname on single node mode
6870
node_repo_modules: node,infra,pgsql
6971
node_tune: oltp
72+
node_etc_hosts: ["10.10.10.10 bao.pigsty"] # domain name to access openbao from all nodes (required)
7073

7174
#----------------------------------------------#
7275
# PGSQL : https://pigsty.io/docs/pgsql/param
7376
#----------------------------------------------#
7477
pg_version: 18 # Default Percona TDE PG Major Version is 18
7578
pg_conf: oltp.yml # pgsql tuning specs: {oltp,olap,tiny,crit}.yml
7679

80+
#----------------------------------------------#
81+
# OPENBAO
82+
#----------------------------------------------#
83+
openbao_cluster: openbao # bao cluster & group name, openbao by default
84+
openbao_domain: bao.pigsty # bao domain name, `bao.pigsty` by default
85+
7786
#----------------------------------------------#
7887
# PASSWORD : https://pigsty.io/docs/setup/security/
7988
#----------------------------------------------#

0 commit comments

Comments
 (0)