Default

Pigsty 4-node local sandbox demo config

  1. ---
  2. ######################################################################
  3. # File      :   pigsty.yml
  4. # Desc      :   Pigsty 4-node local sandbox demo config
  5. # Link      :   https://pigsty.cc/#/v-config
  6. # Ctime     :   2020-05-22
  7. # Mtime     :   2022-05-22
  8. # Copyright (C) 2018-2022 Ruohang Feng (rh@vonng.com)
  9. ######################################################################
  11. ######################################################################
  12. #                        Sandbox (4-node)                            #
  13. #====================================================================#
  14. # admin user : vagrant  (nopass ssh & sudo already set)              #
  15. # 1.  meta    :    10.10.10.10     (2 Core | 4GB)    pg-meta         #
  16. # 2.  node-1  :    10.10.10.11     (1 Core | 1GB)    pg-test-1       #
  17. # 3.  node-2  :    10.10.10.12     (1 Core | 1GB)    pg-test-2       #
  18. # 4.  node-3  :    10.10.10.13     (1 Core | 1GB)    pg-test-3       #
  19. # (replace these ip if your 4-node env have different ip addr)       #
  20. # VIP 2: (l2 vip is available inside same LAN )                      #
  21. #     pg-meta --->  10.10.10.2 ---> 10.10.10.10                      #
  22. #     pg-test --->  10.10.10.3 ---> 10.10.10.1{1,2,3}                #
  23. ######################################################################
  25. all:
  27.   ##################################################################
  28.   #                            CLUSTERS                            #
  29.   ##################################################################
  30.   # meta nodes, nodes, pgsql, redis, pgsql clusters are defined as
  31.   # k:v pair inside `all.children`. Where the key is cluster name
  32.   # and value is cluster definition consist of two parts:
  33.   # `hosts`: cluster members ip and instance level variables
  34.   # `vars` : cluster level variables
  35.   ##################################################################
  36.   children:                           # groups definition
  39.     #================================================================#
  40.     #                  Meta Nodes: Admin Controller                  #
  41.     #================================================================#
  42.     meta:   # meta nodes are defined in this special group "meta"
  43.       vars:
  44.         meta_node: true               # mark this group as meta nodes
  45.         ansible_group_priority: 99    # overwrite with the highest priority
  47.         nginx_enabled:       true     # setup repo & underlying nginx
  48.         nameserver_enabled:  false    # setup dnsmasq
  49.         prometheus_enabled:  true     # setup prometheus
  50.         grafana_enabled:     true     # setup grafana
  51.         loki_enabled:        true     # setup loki
  52.         docker_enabled:      true     # setup docker
  53.         dcs_safeguard:       false    # protect dcs server from fat fingers
  55.       hosts:                          # add nodes to group 'meta'
  56.         10.10.10.10: { }
  57.         # 10.10.10.11: { nginx_enabled: false }
  58.         # 10.10.10.12: { nginx_enabled: false  }
  59.     #================================================================#
  61.     #================================================================#
  62.     #                        PGSQL Clusters                          #
  63.     #================================================================#
  65.     #----------------------------------#
  66.     # pgsql cluster: pg-meta (CMDB)    #
  67.     #----------------------------------#
  68.     # EXAMPLE pg-meta is the default SINGLE-NODE pgsql cluster deployed on meta node (10.10.10.10)
  69.     pg-meta:                          # [REQUIRED], ansible group name , pgsql cluster name. should be unique among environment
  70.       hosts:                          # `<cluster>.hosts` holds instances definition of this cluster
  71.         10.10.10.10:                  # [REQUIRED]: ip address is the key. values are instance level config entries (dict)
  72.           pg_seq: 1                   # [REQUIRED], unique identity parameter (+integer) among pg_cluster
  73.           pg_role: primary            # [REQUIRED], pg_role is mandatory identity parameter, primary|replica|offline
  74.           pg_offline_query: true      # instance with `pg_offline_query: true` will take offline traffic (saga, etl,...)
  75.           # pg_upstream: x.x.x.x      # some other variables can be overwritten on instance level. e.g: pg_upstream, pg_weight, etc...
  76.           # pg_weight: 100            # load balance weight for this instance
  78.       vars:                           # `<cluster>.vars` holds CLUSTER LEVEL CONFIG of this pgsql cluster
  79.         pg_cluster: pg-meta           # [REQUIRED], pgsql cluster name, unique among cluster, used as namespace of cluster resources
  81.         # all vars below are [OPTIONAL] (overwrite global default)
  82.         pg_version: 14                # pgsql version to be installed (use global version if missing)
  83.         node_tune: tiny               # node optimization profile: {oltp|olap|crit|tiny}, use tiny for vm sandbox
  84.         pg_conf: tiny.yml             # pgsql template:  {oltp|olap|crit|tiny}, use tiny for sandbox
  85.         patroni_watchdog_mode: off    # disable patroni watchdog on meta node        {off|require|automatic}
  86.         pg_lc_ctype: en_US.UTF8       # use en_US.UTF8 locale for i18n char support  (required by `pg_trgm`)
  88.         # define business database meta , used as CMDB & default database for single-node setup
  89.         pg_databases:                       # define business databases on this cluster, array of database definition
  90.           - name: meta                      # required, `name` is the only mandatory field of a database definition
  91.             baseline: cmdb.sql              # optional, database sql baseline path, (relative path among ansible search path, e.g files/)
  92.             # owner: postgres               # optional, database owner, postgres by default
  93.             # template: template1           # optional, which template to use, template1 by default
  94.             # encoding: UTF8                # optional, database encoding, UTF8 by default. (MUST same as template database)
  95.             # locale: C                     # optional, database locale, C by default.  (MUST same as template database)
  96.             # lc_collate: C                 # optional, database collate, C by default. (MUST same as template database)
  97.             # lc_ctype: C                   # optional, database ctype, C by default.   (MUST same as template database)
  98.             # tablespace: pg_default        # optional, default tablespace, 'pg_default' by default.
  99.             # allowconn: true               # optional, allow connection, true by default. false will disable connect at all
  100.             # revokeconn: false             # optional, revoke public connection privilege. false by default. (leave connect with grant option to owner)
  101.             # pgbouncer: true               # optional, add this database to pgbouncer database list? true by default
  102.             comment: pigsty meta database   # optional, comment string for this database
  103.             connlimit: -1                   # optional, database connection limit, default -1 disable limit
  104.             schemas: [pigsty]               # optional, additional schemas to be created, array of schema names
  105.             extensions:                     # optional, additional extensions to be installed: array of schema definition `{name,schema}`
  106.               - { name: adminpack, schema: pg_catalog }    # install adminpack to pg_catalog
  107.               - { name: postgis, schema: public }          # if schema is omitted, extension will be installed according to search_path.
  108.               - { name: timescaledb }                      # some extensions are not relocatable, you can just omit the schema part
  109.           - { name: grafana,    owner: dbuser_grafana    , revokeconn: true , comment: grafana primary database }
  110.           - { name: bytebase,   owner: dbuser_bytebase   , revokeconn: true , comment: bytebase primary database }
  111.           - { name: kong,       owner: dbuser_kong       , revokeconn: true , comment: kong the api gateway database }
  113.         # define business users for this cluster
  114.         pg_users:                           # define business users/roles on this cluster, array of user definition
  115.           # define admin user for meta database (This user are used for pigsty app deployment by default)
  116.           - name: dbuser_meta               # required, `name` is the only mandatory field of a user definition
  117.             password: md5d3d10d8cad606308bdb180148bf663e1  # md5 salted password of 'DBUser.Meta'
  118.             # optional, plain text and md5 password are both acceptable (prefixed with `md5`)
  119.             login: true                     # optional, can login, true by default  (new biz ROLE should be false)
  120.             superuser: false                # optional, is superuser? false by default
  121.             createdb: false                 # optional, can create database? false by default
  122.             createrole: false               # optional, can create role? false by default
  123.             inherit: true                   # optional, can this role use inherited privileges? true by default
  124.             replication: false              # optional, can this role do replication? false by default
  125.             bypassrls: false                # optional, can this role bypass row level security? false by default
  126.             pgbouncer: true                 # optional, add this user to pgbouncer user-list? false by default (production user should be true explicitly)
  127.             connlimit: -1                   # optional, user connection limit, default -1 disable limit
  128.             expire_in: 3650                 # optional, now + n days when this role is expired (OVERWRITE expire_at)
  129.             expire_at: '2030-12-31'         # optional, YYYY-MM-DD 'timestamp' when this role is expired  (OVERWRITTEN by expire_in)
  130.             comment: pigsty admin user      # optional, comment string for this user/role
  131.             roles: [dbrole_admin]           # optional, belonged roles. default roles are: dbrole_{admin,readonly,readwrite,offline}
  132.             parameters: {}                  # optional, role level parameters with `ALTER ROLE SET`
  133.             # search_path: public         # key value config parameters according to postgresql documentation (e.g: use pigsty as default search_path)
  134.           - {name: dbuser_view     ,password: DBUser.Viewer   ,pgbouncer: true ,roles: [dbrole_readonly], comment: read-only viewer for meta database}
  135.           - {name: dbuser_grafana  ,password: DBUser.Grafana  ,pgbouncer: true ,roles: [dbrole_admin]    ,comment: admin user for grafana database    }
  136.           - {name: dbuser_bytebase ,password: DBUser.Bytebase ,pgbouncer: true ,roles: [dbrole_admin]    ,comment: admin user for bytebase database   }
  137.           - {name: dbuser_kong     ,password: DBUser.Kong     ,pgbouncer: true ,roles: [dbrole_admin]    ,comment: admin user for kong api gateway    }
  139.         pg_hba_rules_extra:
  140.           - title: allow grafana bytebase kong intranet access
  141.             role: common
  142.             rules:
  143.               - host    kong            dbuser_kong         10.0.0.0/8          md5
  144.               - host    bytebase        dbuser_bytebase     10.0.0.0/8          md5
  145.               - host    grafana         dbuser_grafana      10.0.0.0/8          md5
  147.         vip_mode: l2
  148.         vip_address: 10.10.10.2
  149.         vip_cidrmask: 8
  150.         vip_interface: eth1
  151.         node_crontab:
  152.           - '00 01 * * * postgres /pg/bin/pg-backup 2>>/pg/log/backup.log'
  154.     #----------------------------------#
  155.     # pgsql cluster: pg-test (3 nodes) #
  156.     #----------------------------------#
  157.     # pg-test --->  10.10.10.3 ---> 10.10.10.1{1,2,3}
  158.     pg-test:                                # define the new 3-node cluster pg-test
  159.       hosts:
  160.         10.10.10.11: { pg_seq: 1, pg_role: primary }   # primary instance, leader of cluster
  161.         10.10.10.12: { pg_seq: 2, pg_role: replica }   # replica instance, follower of leader
  162.         10.10.10.13: { pg_seq: 3, pg_role: replica, pg_offline_query: true } # replica with offline access
  163.       vars:
  164.         pg_cluster: pg-test           # define pgsql cluster name
  165.         pg_version: 14                # test postgresql 13 with pg-test cluster
  166.         pg_users:
  167.           - name: test
  168.             password: test
  169.             pgbouncer: true
  170.             roles: [ dbrole_admin ]
  171.         pg_databases:                 # create a database and user named 'test'
  172.           - name: test
  174.         vip_mode: l2                  # enable/disable vip (require members in same LAN)
  175.         vip_address: 10.10.10.3       # virtual ip address for this cluster
  176.         vip_cidrmask: 8               # cidr network mask length
  177.         vip_interface: eth1           # interface to add virtual ip
  179.         pg_services_extra:                  # extra services in addition to pg_services_default, array of service definition
  180.           # standby service will route {ip|name}:5435 to sync replica's pgbouncer (5435->6432 standby)
  181.           - name: standby             # required, service name, the actual svc name will be prefixed with `pg_cluster`, e.g: pg-meta-standby
  182.             src_ip: "*"               # required, service bind ip address, `*` for all ip, `vip` for cluster `vip_address`
  183.             src_port: 5435            # required, service exposed port (work as kubernetes service node port mode)
  184.             dst_port: pgbouncer       # optional, destination port, postgres|pgbouncer|<port_number>   , pgbouncer(6432) by default
  185.             check_method: http        # optional, health check method: http is the only available method for now
  186.             check_port: patroni       # optional, health check port: patroni|pg_exporter|<port_number> , patroni(8008) by default
  187.             check_url: /sync          # optional, health check url path, /read-only?lag=0 by default
  188.             check_code: 200           # optional, health check expected http code, 200 by default
  189.             selector: "[]"            # required, JMESPath to filter inventory ()
  190.             selector_backup: "[? pg_role == `primary`]"  # primary used as backup server for standby service (will not work because /sync for )
  191.             haproxy:                  # optional, adhoc parameters for haproxy service provider (vip_l4 is another service provider)
  192.               maxconn: 3000           # optional, max allowed front-end connection
  193.               balance: roundrobin     # optional, haproxy load balance algorithm (roundrobin by default, other: leastconn)
  194.               default_server_options: 'inter 3s fastinter 1s downinter 5s rise 3 fall 3 on-marked-down shutdown-sessions slowstart 30s maxconn 3000 maxqueue 128 weight 100'
  197.     #================================================================#
  198.     #                        REDIS Clusters                          #
  199.     #================================================================#
  201.     #----------------------------------#
  202.     # redis sentinel example           #
  203.     #----------------------------------#
  204.     redis-meta:
  205.       hosts:
  206.         10.10.10.10:
  207.           redis_node: 1
  208.           redis_instances:  { 6001 : {} ,6002 : {} , 6003 : {} }
  209.       vars:
  210.         redis_cluster: redis-meta
  211.         redis_mode: sentinel
  212.         redis_max_memory: 64MB
  214.     #----------------------------------#
  215.     # redis cluster example            #
  216.     #----------------------------------#
  217.     redis-test:
  218.       hosts:
  219.         10.10.10.11:
  220.           redis_node: 1
  221.           redis_instances: { 6501 : {} ,6502 : {} ,6503 : {} ,6504 : {} ,6505 : {} ,6506 : {} }
  222.         10.10.10.12:
  223.           redis_node: 2
  224.           redis_instances: { 6501 : {} ,6502 : {} ,6503 : {} ,6504 : {} ,6505 : {} ,6506 : {} }
  225.       vars:
  226.         redis_cluster: redis-test           # name of this redis 'cluster'
  227.         redis_mode: cluster                 # standalone,cluster,sentinel
  228.         redis_max_memory: 32MB              # max memory used by each redis instance
  229.         redis_mem_policy: allkeys-lru       # memory eviction policy
  231.     #----------------------------------#
  232.     # redis standalone example         #
  233.     #----------------------------------#
  234.     redis-common:
  235.       hosts:
  236.         10.10.10.13:
  237.           redis_node: 1
  238.           redis_instances:
  239.             6501: {}
  240.             6502: { replica_of: '10.10.10.13 6501' }
  241.             6503: { replica_of: '10.10.10.13 6501' }
  242.       vars:
  243.         redis_cluster: redis-common         # name of this redis 'cluster'
  244.         redis_mode: standalone              # standalone,cluster,sentinel
  245.         redis_max_memory: 64MB              # max memory used by each redis instance
  248.   ####################################################################
  249.   #                             VARS                                 #
  250.   ####################################################################
  251.   vars:                               # global variables
  252.     version: v1.5.1                # pigsty version string
  254.     #================================================================#
  255.     #                         VARS: INFRA                            #
  256.     #================================================================#
  258.     #-----------------------------------------------------------------
  259.     # CONNECT
  260.     #-----------------------------------------------------------------
  261.     # INSTANCE level ansible connect parameters
  262.     # ansible_user: vagrant           # which user to be used (when connecting to remote nodes)
  263.     # ansible_port: 22                # which port to be used (when connecting to remote nodes)
  264.     # ansible_host: meta              # ssh alias host name (when connecting to remote nodes)
  265.     # ansible_ssh_private_key_file: ~/.ssh/id_rsa            # ssh private key file
  266.     # ansible_ssh_common_args: '-o StrictHostKeyChecking=no' # ssh common args
  268.     proxy_env:                        # global proxy env when downloading packages
  269.       no_proxy: "localhost,127.0.0.1,10.0.0.0/8,192.168.0.0/16,*.pigsty,*.aliyun.com,mirrors.*,*.myqcloud.com,*.tsinghua.edu.cn"
  270.       # http_proxy:  # set your proxy here: e.g http://user:pass@proxy.xxx.com
  271.       # https_proxy: # set your proxy here: e.g http://user:pass@proxy.xxx.com
  272.       # all_proxy:   # set your proxy here: e.g http://user:pass@proxy.xxx.com
  274.     #-----------------------------------------------------------------
  275.     # CA
  276.     #-----------------------------------------------------------------
  277.     ca_method: create                 # create|copy|recreate
  278.     ca_subject: "/CN=root-ca"         # self-signed CA subject
  279.     ca_homedir: /ca                   # ca cert directory
  280.     ca_cert: ca.crt                   # ca public key/cert
  281.     ca_key: ca.key                    # ca private key
  283.     #-----------------------------------------------------------------
  284.     # NGINX
  285.     #-----------------------------------------------------------------
  286.     nginx_enabled: true               # build local repo on this node
  287.     nginx_port: 80                    # repo listen address, must same as repo_address
  288.     nginx_home: /www                  # default repo home dir
  290.     nginx_upstream:                   # domain names and upstream servers
  291.       - { name: home         , domain: pigsty     , endpoint: "10.10.10.10:80"   }
  292.       - { name: grafana      , domain: g.pigsty   , endpoint: "10.10.10.10:3000" }
  293.       - { name: loki         , domain: l.pigsty   , endpoint: "10.10.10.10:3100" }
  294.       - { name: prometheus   , domain: p.pigsty   , endpoint: "10.10.10.10:9090" }
  295.       - { name: alertmanager , domain: a.pigsty   , endpoint: "10.10.10.10:9093" }
  296.       - { name: consul       , domain: c.pigsty   , endpoint: "127.0.0.1:8500"   } #== ^ required ==#
  297.       - { name: postgrest    , domain: api.pigsty , endpoint: "127.0.0.1:8884"   } #== v optional ==#
  298.       - { name: pgadmin      , domain: adm.pigsty , endpoint: "127.0.0.1:8885"   }
  299.       - { name: pgweb        , domain: cli.pigsty , endpoint: "127.0.0.1:8886"   }
  300.       - { name: bytebase     , domain: ddl.pigsty , endpoint: "127.0.0.1:8887"   }
  301.       - { name: jupyter      , domain: lab.pigsty , endpoint: "127.0.0.1:8888"   }
  302.       - { name: gitea        , domain: git.pigsty , endpoint: "127.0.0.1:8889"   }
  303.       - { name: minio        , domain: sss.pigsty , endpoint: "127.0.0.1:9000"   }
  305.     nginx_indexes:                    # application nav links on home page
  306.       - { name: PgAdmin4   , url : 'http://adm.pigsty'              , comment: 'PgAdmin4 for PostgreSQL'     }
  307.       - { name: PGWeb      , url : 'http://cli.pigsty'              , comment: 'PGWEB Browser Client'        }
  308.       - { name: ByteBase   , url : 'http://ddl.pigsty'              , comment: 'ByteBase Schema Migrator'    }
  309.       - { name: PostgREST  , url : 'http://api.pigsty'              , comment: 'Kong API Gateway'            }
  310.       - { name: Gitea      , url : 'http://git.pigsty'              , comment: 'Minio Object Storage'        }
  311.       - { name: Minio      , url : 'http://sss.pigsty'              , comment: 'Minio Object Storage'        }
  312.       - { name: Explain    , url : '/pev2'                          , comment: 'postgres explain visualizer' }
  313.       - { name: Package    , url : '/pigsty'                        , comment: 'local yum repo packages'     }
  314.       - { name: PG Logs    , url : '/logs'                          , comment: 'postgres raw csv logs'       }
  315.       - { name: Schemas    , url : '/schema'                        , comment: 'schemaspy summary report'    }
  316.       - { name: Reports    , url : '/report'                        , comment: 'pgbadger summary report'     }
  317.       - { name: ISD        , url : '${grafana}/d/isd-overview'      , comment: 'noaa isd data visualization' }
  318.       - { name: Covid      , url : '${grafana}/d/covid-overview'    , comment: 'covid data visualization'    }
  319.       - { name: Worktime   , url : '${grafana}/d/worktime-overview' , comment: 'worktime query'              }
  320.       - { name: DBTrend    , url : '${grafana}/d/dbeng-trending'    , comment: 'DB Engine Trending Graph'    }
  322.     #-----------------------------------------------------------------
  323.     # REPO
  324.     #-----------------------------------------------------------------
  325.     repo_name: pigsty                 # repo name, pigsty by default
  326.     repo_address: pigsty              # external address to this repo (ip:port or url)
  327.     repo_rebuild: false               # force re-download packages
  328.     repo_remove: true                 # remove existing upstream repo
  329.     repo_upstreams:                   # where to download packages?
  330.       - name: base
  331.         description: CentOS-$releasever - Base
  332.         gpgcheck: no
  333.         baseurl:
  334.           - https://mirrors.tuna.tsinghua.edu.cn/centos/$releasever/os/$basearch/
  335.           - http://mirrors.aliyun.com/centos/$releasever/os/$basearch/
  336.           - http://mirror.centos.org/centos/$releasever/os/$basearch/
  337.       - name: updates
  338.         description: CentOS-$releasever - Updates
  339.         gpgcheck: no
  340.         baseurl:
  341.           - https://mirrors.tuna.tsinghua.edu.cn/centos/$releasever/updates/$basearch/
  342.           - http://mirrors.aliyun.com/centos/$releasever/updates/$basearch/
  343.           - http://mirror.centos.org/centos/$releasever/updates/$basearch/
  344.       - name: extras
  345.         description: CentOS-$releasever - Extras
  346.         baseurl:
  347.           - https://mirrors.tuna.tsinghua.edu.cn/centos/$releasever/extras/$basearch/
  348.           - http://mirrors.aliyun.com/centos/$releasever/extras/$basearch/
  349.           - http://mirror.centos.org/centos/$releasever/extras/$basearch/
  350.         gpgcheck: no
  351.       - name: epel
  352.         description: CentOS $releasever - epel
  353.         gpgcheck: no
  354.         baseurl:
  355.           - https://mirrors.tuna.tsinghua.edu.cn/epel/$releasever/$basearch
  356.           - http://mirrors.aliyun.com/epel/$releasever/$basearch
  357.           - http://download.fedoraproject.org/pub/epel/$releasever/$basearch
  358.       - name: grafana
  359.         description: Grafana Official Yum Repo
  360.         enabled: yes
  361.         gpgcheck: no
  362.         baseurl:
  363.           - https://mirrors.tuna.tsinghua.edu.cn/grafana/yum/rpm
  364.           - https://packages.grafana.com/oss/rpm
  365.       - name: prometheus
  366.         description: Prometheus and exporters
  367.         gpgcheck: no
  368.         baseurl: https://packagecloud.io/prometheus-rpm/release/el/$releasever/$basearch
  369.       - name: pgdg-common
  370.         description: PostgreSQL common RPMs for RHEL/CentOS $releasever - $basearch
  371.         gpgcheck: no
  372.         baseurl:
  373.           - http://mirrors.tuna.tsinghua.edu.cn/postgresql/repos/yum/common/redhat/rhel-$releasever-$basearch
  374.           - https://download.postgresql.org/pub/repos/yum/common/redhat/rhel-$releasever-$basearch
  375.       - name: pgdg14
  376.         description: PostgreSQL 14 for RHEL/CentOS $releasever - $basearch
  377.         gpgcheck: no
  378.         baseurl:
  379.           - https://mirrors.tuna.tsinghua.edu.cn/postgresql/repos/yum/14/redhat/rhel-$releasever-$basearch
  380.           - https://download.postgresql.org/pub/repos/yum/14/redhat/rhel-$releasever-$basearch
  381.       - name: timescaledb
  382.         description: TimescaleDB for RHEL/CentOS $releasever - $basearch
  383.         gpgcheck: no
  384.         baseurl:
  385.           - https://packagecloud.io/timescale/timescaledb/el/7/$basearch
  386.       - name: centos-sclo
  387.         description: CentOS-$releasever - SCLo
  388.         gpgcheck: no
  389.         #mirrorlist: http://mirrorlist.centos.org?arch=$basearch&release=$releasever&repo=sclo-sclo
  390.         baseurl: http://mirrors.aliyun.com/centos/$releasever/sclo/$basearch/sclo/
  391.       - name: centos-sclo-rh
  392.         description: CentOS-$releasever - SCLo rh
  393.         gpgcheck: no
  394.         #mirrorlist: http://mirrorlist.centos.org?arch=$basearch&release=7&repo=sclo-rh
  395.         baseurl: http://mirrors.aliyun.com/centos/$releasever/sclo/$basearch/rh/
  396.       - name: nginx
  397.         description: Nginx Official Yum Repo
  398.         skip_if_unavailable: true
  399.         gpgcheck: no
  400.         baseurl: http://nginx.org/packages/centos/$releasever/$basearch/
  401.       - name: harbottle               # for latest consul & kubernetes
  402.         description: Copr repo for main owned by harbottle
  403.         skip_if_unavailable: true
  404.         gpgcheck: no
  405.         baseurl: https://download.copr.fedorainfracloud.org/results/harbottle/main/epel-$releasever-$basearch/
  406.       - name: pg_probackup            # for pg_probackup
  407.         description: PG_PROBACKUP Centos packages for PostgresPro Standard and Enterprise - $basearch
  408.         skip_if_unavailable: true
  409.         gpgcheck: no
  410.         baseurl: https://repo.postgrespro.ru/pg_probackup-forks/rpm/latest/centos-$releasever-$basearch
  411.       - name: docker-ce               # for latest docker
  412.         description: Docker CE Stable - $basearch
  413.         skip_if_unavailable: true
  414.         gpgcheck: no
  415.         baseurl:
  416.           - https://mirrors.aliyun.com/docker-ce/linux/centos/$releasever/$basearch/stable
  417.           - https://download.docker.com/linux/centos/$releasever/$basearch/stable
  419.     repo_packages:                    # which packages to be included                                                    #  what to download #
  420.       - epel-release nginx wget yum-utils yum createrepo sshpass zip unzip                                              # ----  boot   ---- #
  421.       - ntp chrony uuid lz4 bzip2 nc pv jq vim-enhanced make patch bash lsof wget git tuned perf ftp lrzsz rsync        # ----  node   ---- #
  422.       - numactl grubby sysstat dstat iotop bind-utils net-tools tcpdump socat ipvsadm telnet ca-certificates keepalived # ----- utils ----- #
  423.       - readline zlib openssl openssh-clients libyaml libxml2 libxslt libevent perl perl-devel perl-ExtUtils*           # ---  deps:pg  --- #
  424.       - readline-devel zlib-devel uuid-devel libuuid-devel libxml2-devel libxslt-devel openssl-devel libicu-devel       # --- deps:devel -- #
  425.       - grafana prometheus2 pushgateway alertmanager mtail consul consul_exporter consul-template etcd dnsmasq          # -----  meta ----- #
  426.       - node_exporter nginx_exporter blackbox_exporter redis_exporter                                                   # ---- exporter --- #
  427.       - ansible python python-pip python-psycopg2                                                                       # - ansible & py3 - #
  428.       - python3 python3-psycopg2 python36-requests python3-etcd python3-consul python36-urllib3 python36-idna python36-pyOpenSSL python36-cryptography
  429.       - patroni patroni-consul patroni-etcd pgbouncer pg_cli pgbadger pg_activity tail_n_mail                           # -- pgsql common - #
  430.       - pgcenter boxinfo check_postgres emaj pgbconsole pg_bloat_check pgquarrel barman barman-cli pgloader pgFormatter pitrery pspg pgxnclient PyGreSQL
  431.       - postgresql14* postgis32_14* citus_14* pglogical_14* timescaledb-2-postgresql-14 pg_repack_14 wal2json_14        # -- pg14 packages -#
  432.       - pg_qualstats_14 pg_stat_kcache_14 pg_stat_monitor_14 pg_top_14 pg_track_settings_14 pg_wait_sampling_14 pg_probackup-std-14
  433.       - pg_statement_rollback_14 system_stats_14 plproxy_14 plsh_14 pldebugger_14 plpgsql_check_14 pgmemcache_14 # plr_14
  434.       - mysql_fdw_14 ogr_fdw_14 tds_fdw_14 sqlite_fdw_14 firebird_fdw_14 hdfs_fdw_14 mongo_fdw_14 osm_fdw_14 pgbouncer_fdw_14
  435.       - hypopg_14 geoip_14 rum_14 hll_14 ip4r_14 prefix_14 pguri_14 tdigest_14 topn_14 periods_14
  436.       - bgw_replstatus_14 count_distinct_14 credcheck_14 ddlx_14 extra_window_functions_14 logerrors_14 mysqlcompat_14 orafce_14
  437.       - repmgr_14 pg_auth_mon_14 pg_auto_failover_14 pg_background_14 pg_bulkload_14 pg_catcheck_14 pg_comparator_14
  438.       - pg_cron_14 pg_fkpart_14 pg_jobmon_14 pg_partman_14 pg_permissions_14 pg_prioritize_14 pgagent_14
  439.       - pgaudit16_14 pgauditlogtofile_14 pgcryptokey_14 pgexportdoc_14 pgfincore_14 pgimportdoc_14 powa_14 pgmp_14 pgq_14
  440.       - pgquarrel-0.7.0-1 pgsql_tweaks_14 pgtap_14 pgtt_14 postgresql-unit_14 postgresql_anonymizer_14 postgresql_faker_14
  441.       - safeupdate_14 semver_14 set_user_14 sslutils_14 table_version_14 # pgrouting_14 osm2pgrouting_14
  442.       - clang coreutils diffutils rpm-build rpm-devel rpmlint rpmdevtools bison flex # gcc gcc-c++                      # - build utils - #
  443.       - docker-ce docker-compose kubelet kubectl kubeadm kubernetes-cni helm                                            # - cloud native- #
  445.     repo_url_packages:                # extra packages from url
  446.       - https://github.com/Vonng/loki-rpm/releases/download/v2.5.0/loki-2.5.0.x86_64.rpm
  447.       - https://github.com/Vonng/loki-rpm/releases/download/v2.5.0/promtail-2.5.0.x86_64.rpm
  448.       - https://github.com/Vonng/pg_exporter/releases/download/v0.5.0/pg_exporter-0.5.0.x86_64.rpm
  449.       - https://github.com/cybertec-postgresql/vip-manager/releases/download/v1.0.2/vip-manager-1.0.2-1.x86_64.rpm
  450.       - https://github.com/Vonng/haproxy-rpm/releases/download/v2.5.7/haproxy-2.5.7-1.el7.x86_64.rpm
  451.       - https://github.com/Vonng/pigsty-pkg/releases/download/misc/redis-6.2.7-1.el7.remi.x86_64.rpm
  452.       - https://github.com/dalibo/pev2/releases/download/v0.24.0/pev2.tar.gz
  453.       - https://github.com/Vonng/pigsty-pkg/releases/download/misc/polysh-0.4-1.noarch.rpm
  455.     #-----------------------------------------------------------------
  456.     # NAMESERVER
  457.     #-----------------------------------------------------------------
  458.     nameserver_enabled: false         # setup dnsmasq
  459.     dns_records:                      # dynamic dns record resolved by dnsmasq
  460.       - 10.10.10.2  pg-meta           # sandbox vip for pg-meta
  461.       - 10.10.10.3  pg-test           # sandbox vip for pg-test
  462.       - 10.10.10.10 pg-meta-1         # sandbox instance pg-meta-1
  463.       - 10.10.10.11 pg-test-1         # sandbox instance node-1
  464.       - 10.10.10.12 pg-test-2         # sandbox instance node-2
  465.       - 10.10.10.13 pg-test-3         # sandbox instance node-3
  467.     #-----------------------------------------------------------------
  468.     # PROMETHEUS
  469.     #-----------------------------------------------------------------
  470.     prometheus_enabled: true          # setup prometheus
  471.     prometheus_data_dir: /data/prometheus/data
  472.     prometheus_options: '--storage.tsdb.retention=15d'
  473.     prometheus_reload: false          # reload prometheus instead of recreate it?
  474.     prometheus_sd_method: static      # service discovery method: static|consul
  475.     prometheus_sd_interval: 5s        # service discovery refresh interval
  476.     prometheus_scrape_interval: 10s   # global scrape & evaluation interval
  477.     prometheus_scrape_timeout: 8s     # scrape timeout
  479.     #-----------------------------------------------------------------
  480.     # EXPORTER
  481.     #-----------------------------------------------------------------
  482.     exporter_install: none            # none|yum|binary, none by default
  483.     exporter_repo_url: ''             # if set, repo will be added to /etc/yum.repos.d/
  484.     exporter_metrics_path: /metrics   # default metric path for pg related exporter
  486.     #-----------------------------------------------------------------
  487.     # GRAFANA
  488.     #-----------------------------------------------------------------
  489.     grafana_enabled: true             # enable grafana? only works on meta nodes
  490.     grafana_endpoint: http://10.10.10.10:3000     # grafana endpoint url
  491.     grafana_admin_username: admin     # default grafana admin username
  492.     grafana_admin_password: pigsty    # default grafana admin password
  493.     grafana_database: sqlite3         # default grafana database type: sqlite3|postgres
  494.     grafana_pgurl: postgres://dbuser_grafana:DBUser.Grafana@meta:5436/grafana
  496.     grafana_plugin_method: install    # none|install|always, none will skip plugin install
  497.     grafana_plugin_cache: /www/pigsty/plugins.tgz # path to grafana plugins cache tarball
  498.     grafana_plugin_list:              # plugins that will be downloaded via grafana-cli
  499.       - marcusolsson-csv-datasource
  500.       - marcusolsson-json-datasource
  501.       - marcusolsson-treemap-panel
  502.     grafana_plugin_git:               # plugins that will be downloaded via git
  503.       - https://github.com/Vonng/vonng-echarts-panel
  506.     #-----------------------------------------------------------------
  507.     # LOKI
  508.     #-----------------------------------------------------------------
  509.     loki_enabled: true                # enable loki? only works on meta nodes
  510.     loki_clean: false                 # whether remove existing loki data
  511.     loki_endpoint: http://10.10.10.10:3100/loki/api/v1/push # where to push data
  512.     loki_options: '-config.file=/etc/loki.yml -config.expand-env=true'
  513.     loki_data_dir: /data/loki         # default loki data dir
  514.     loki_retention: 15d               # log retention period
  516.     #-----------------------------------------------------------------
  517.     # DCS
  518.     #-----------------------------------------------------------------
  519.     dcs_name: pigsty                  # consul dc name
  520.     dcs_servers:                      # dcs server dict in name:ip format
  521.       meta-1: 10.10.10.10             # using existing external dcs cluster is recommended for HA
  522.       # meta-2: 10.10.10.11           # node with ip in dcs_servers will be initialized as dcs servers
  523.       # meta-3: 10.10.10.12           # it's recommend to reuse meta nodes as dcs servers if no ad hoc cluster available
  524.     dcs_registry: consul              # where to register services: none | consul | etcd | both
  525.     dcs_safeguard: false              # if true, running dcs will NOT be removed
  526.     dcs_clean: true                   # if true, running dcs will be purged during node init, DANGEROUS
  528.     #-----------------------------------------------------------------
  529.     # CONSUL
  530.     #-----------------------------------------------------------------
  531.     consul_enabled: true              # enable consul server/agent by default?
  532.     consul_data_dir: /data/consul     # consul data dir (/data/consul by default)
  534.     #-----------------------------------------------------------------
  535.     # ETCD
  536.     #-----------------------------------------------------------------
  537.     etcd_enabled: true                # enable etcd server by default?
  538.     etcd_data_dir: /data/etcd         # etcd data dir (/data/etcd by default)
  541.     #================================================================#
  542.     #                         VARS: NODES                            #
  543.     #================================================================#
  544.     # global variables for nodes (including meta)
  546.     #-----------------------------------------------------------------
  547.     # NODE_IDENTITY
  548.     #-----------------------------------------------------------------
  549.     meta_node: false                  # node with meta_node flag will be marked as admin node
  550.     # nodename:          # [OPTIONAL] # node instance identity, used as `ins`, hostname by default
  551.     node_cluster: nodes  # [OPTIONAL] # node cluster identity, used as `cls`, 'nodes' by default
  552.     nodename_overwrite: true          # overwrite node's hostname with nodename?
  553.     nodename_exchange: false          # exchange nodename among play hosts?
  555.     #-----------------------------------------------------------------
  556.     # NODE_DNS
  557.     #-----------------------------------------------------------------
  558.     node_etc_hosts_default:           # static dns records in /etc/hosts
  559.       - 10.10.10.10 meta pigsty p.pigsty g.pigsty a.pigsty c.pigsty l.pigsty
  560.       - 10.10.10.10 api.pigsty adm.pigsty cli.pigsty ddl.pigsty lab.pigsty git.pigsty sss.pigsty
  561.     node_etc_hosts: []                # extra static dns records in /etc/hosts
  563.     node_dns_method: add              # add (default) | none (skip) | overwrite (remove old settings)
  564.     node_dns_servers:                 # dynamic nameserver in /etc/resolv.conf
  565.       - 10.10.10.10
  566.     node_dns_options:                 # dns resolv options
  567.       - options single-request-reopen timeout:1 rotate
  568.       - domain service.consul
  570.     #-----------------------------------------------------------------
  571.     # NODE_REPO
  572.     #-----------------------------------------------------------------
  573.     node_repo_method: local           # none|local: ad local repo|public: add upstream directly
  574.     node_repo_remove: true            # remove existing repo on nodes?
  575.     node_repo_local_urls:             # list local repo url, if node_repo_method = local
  576.       - http://pigsty/pigsty.repo
  578.     node_packages: [ ]                # extra packages for all nodes
  579.     node_packages_default:            # common packages for all nodes
  580.       - wget,sshpass,ntp,chrony,tuned,uuid,lz4,make,patch,bash,lsof,wget,unzip,git,ftp,vim-minimal,ca-certificates
  581.       - numactl,grubby,sysstat,dstat,iotop,bind-utils,net-tools,tcpdump,socat,ipvsadm,telnet,tuned,nc,pv,jq,perf
  582.       - readline,zlib,openssl,openssl-libs,openssh-clients,python3,python36-requests,node_exporter,consul,etcd,promtail
  583.     node_packages_meta:               # extra packages for meta nodes
  584.       - grafana,prometheus2,alertmanager,loki,nginx_exporter,blackbox_exporter,pushgateway,redis,postgresql14
  585.       - nginx,ansible,pgbadger,python-psycopg2,dnsmasq,coreutils,diffutils,polysh,docker-ce,docker-compose
  586.     node_packages_meta_pip: jupyterlab
  588.     #-----------------------------------------------------------------
  589.     # NODE_TUNE
  590.     #-----------------------------------------------------------------
  591.     node_disable_firewall: true       # disable firewall
  592.     node_disable_selinux: true        # disable selinux
  593.     node_disable_numa: false          # disable numa (node reboot required)
  594.     node_disable_swap: false          # disable swap, use with caution
  595.     node_static_network: true         # keep dns resolver settings after reboot
  596.     node_disk_prefetch: false         # setup disk prefetch on HDD to increase performance
  597.     node_kernel_modules: [ softdog, br_netfilter, ip_vs, ip_vs_rr, ip_vs_rr, ip_vs_wrr, ip_vs_sh ]
  598.     node_tune: tiny                   # install and activate tuned profile: none|oltp|olap|crit|tiny
  599.     node_sysctl_params: { }           # set additional sysctl parameters, k:v format
  601.     #-----------------------------------------------------------------
  602.     # NODE_ADMIN
  603.     #-----------------------------------------------------------------
  604.     node_data_dir: /data              # main data directory
  605.     node_admin_enabled: true          # create a default admin user defined by `node_admin_*` ?
  606.     node_admin_uid: 88                # uid and gid for this admin user
  607.     node_admin_username: dba          # name of this admin user, dba by default
  608.     node_admin_ssh_exchange: true     # exchange admin ssh key among each pgsql cluster ?
  609.     node_admin_pk_current: true       # add current user's ~/.ssh/id_rsa.pub to admin authorized_keys ?
  610.     node_admin_pk_list:               # ssh public keys to be added to admin user (REPLACE WITH YOURS!)
  611.       - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQC7IMAMNavYtWwzAJajKqwdn3ar5BhvcwCnBTxxEkXhGlCO2vfgosSAQMEflfgvkiI5nM1HIFQ8KINlx1XLO7SdL5KdInG5LIJjAFh0pujS4kNCT9a5IGvSq1BrzGqhbEcwWYdju1ZPYBcJm/MG+JD0dYCh8vfrYB/cYMD0SOmNkQ== vagrant@pigsty.com'
  613.     #-----------------------------------------------------------------
  614.     # NODE_TIME
  615.     #-----------------------------------------------------------------
  616.     node_timezone: Asia/Hong_Kong     # default node timezone, empty will not change
  617.     node_ntp_enabled: true            # enable ntp service? false will leave ntp service untouched
  618.     node_ntp_service: ntp             # ntp service provider: ntp|chrony
  619.     node_ntp_servers:                 # default NTP servers
  620.       - pool cn.pool.ntp.org iburst
  621.       - pool pool.ntp.org iburst
  622.       - pool time.pool.aliyun.com iburst
  623.       - server 10.10.10.10 iburst
  624.       - server ntp.tuna.tsinghua.edu.cn iburst
  625.     node_crontab_overwrite: true      # true will overwrite /etc/crontab, false will append crontab
  626.     node_crontab: [ ]                 # crontab entries in /etc/crontab
  628.     #-----------------------------------------------------------------
  629.     # DOCKER
  630.     #-----------------------------------------------------------------
  631.     docker_enabled: false             # enable docker on all nodes? (you can enable them on meta nodes only)
  632.     docker_cgroups_driver: systemd    # docker cgroup fs driver
  633.     docker_registry_mirrors: []       # docker registry mirror
  634.     docker_image_cache: /tmp/docker.tgz # docker images tarball to be loaded if exists
  636.     #-----------------------------------------------------------------
  637.     # NODE_EXPORTER
  638.     #-----------------------------------------------------------------
  639.     node_exporter_enabled: true       # setup node_exporter on instance
  640.     node_exporter_port: 9100          # default port for node exporter
  641.     node_exporter_options: '--no-collector.softnet --no-collector.nvme --collector.ntp --collector.tcpstat --collector.processes'
  643.     #-----------------------------------------------------------------
  644.     # PROMTAIL
  645.     #-----------------------------------------------------------------
  646.     promtail_enabled: true            # enable promtail logging collector?
  647.     promtail_clean: false             # remove promtail status file? false by default
  648.     promtail_port: 9080               # default listen address for promtail
  649.     promtail_options: '-config.file=/etc/promtail.yml -config.expand-env=true'
  650.     promtail_positions: /var/log/positions.yaml   # position status for promtail
  653.     #================================================================#
  654.     #                         VARS: PGSQL                            #
  655.     #================================================================#
  657.     #-----------------------------------------------------------------
  658.     # PG_IDENTITY
  659.     #-----------------------------------------------------------------
  660.     # pg_cluster:                     # <CLUSTER>  <REQUIRED>  : pgsql cluster name
  661.     # pg_role: replica                # <INSTANCE> <REQUIRED>  : pg role : primary, replica, offline
  662.     # pg_seq: 0                       # <INSTANCE> <REQUIRED>  : instance seq number
  663.     # pg_instances: {}                # <INSTANCE>             : define multiple pg instances on node, used by monly & gpsql
  664.     # pg_upstream:                    # <INSTANCE>             : replication upstream ip addr
  666.     # pg_shard:                       # <CLUSTER>              : pgsql shard name
  667.     # pg_sindex: 0                    # <CLUSTER>              : pgsql shard index
  668.     # gp_role: master                 # <CLUSTER>              : gpsql role, master or segment
  670.     pg_offline_query: false           # <INSTANCE> [FLAG] set to true to enable offline query on this instance (instance level)
  671.     pg_backup: false                  # <INSTANCE> [FLAG] store base backup on this node (instance level, reserved)
  672.     pg_weight: 100                    # <INSTANCE> [FLAG] default load balance weight (instance level)
  673.     pg_hostname: true                 # [FLAG] reuse postgres identity name as node identity?
  674.     pg_preflight_skip: false          # [FLAG] skip preflight identity check
  676.     #-----------------------------------------------------------------
  677.     # PG_BUSINESS
  678.     #-----------------------------------------------------------------
  679.     # overwrite these variables on <CLUSTER> level
  680.     pg_users: []                      # business users
  681.     pg_databases: []                  # business databases
  682.     pg_services_extra: []             # extra services
  683.     pg_hba_rules_extra: []            # extra hba rules
  684.     pgbouncer_hba_rules_extra: []     # extra pgbouncer hba rules
  686.     # WARNING: change these in production environment!
  687.     pg_admin_username: dbuser_dba
  688.     pg_admin_password: DBUser.DBA
  689.     pg_monitor_username: dbuser_monitor
  690.     pg_monitor_password: DBUser.Monitor
  691.     pg_replication_username: replicator
  692.     pg_replication_password: DBUser.Replicator
  694.     #-----------------------------------------------------------------
  695.     # PG_INSTALL
  696.     #-----------------------------------------------------------------
  697.     pg_dbsu: postgres                 # os user for database, postgres by default (unwise to change it)
  698.     pg_dbsu_uid: 26                   # os dbsu uid and gid, 26 for default postgres users and groups
  699.     pg_dbsu_sudo: limit               # dbsu sudo privilege: none|limit|all|nopass, limit by default
  700.     pg_dbsu_home: /var/lib/pgsql      # postgresql home directory
  701.     pg_dbsu_ssh_exchange: true        # exchange postgres dbsu ssh key among same cluster ?
  702.     pg_version: 14                    # default postgresql version to be installed
  703.     pgdg_repo: false                  # add pgdg official repo before install (in case of no local repo available)
  704.     pg_add_repo: false                # add postgres relate repo before install ?
  705.     pg_bin_dir: /usr/pgsql/bin        # postgres binary dir, default is /usr/pgsql/bin, which use /usr/pgsql -> /usr/pgsql-{ver}
  706.     pg_packages:                      # postgresql related packages. `${pg_version} will be replaced by `pg_version`
  707.       - postgresql${pg_version}*      # postgresql kernel packages
  708.       - postgis32_${pg_version}*      # postgis
  709.       - citus_${pg_version}*          # citus
  710.       - timescaledb-2-postgresql-${pg_version}    # timescaledb
  711.       - pgbouncer pg_exporter pgbadger pg_activity node_exporter consul haproxy vip-manager
  712.       - patroni patroni-consul patroni-etcd python3 python3-psycopg2 python36-requests python3-etcd
  713.       - python3-consul python36-urllib3 python36-idna python36-pyOpenSSL python36-cryptography
  714.     pg_extensions:                   # postgresql extensions, `${pg_version} will be replaced by actual `pg_version`
  715.       - pg_repack_${pg_version} pg_qualstats_${pg_version} pg_stat_kcache_${pg_version} pg_stat_monitor_${pg_version} wal2json_${pg_version}
  716.     # - ogr_fdw${pg_version} mysql_fdw_${pg_version} redis_fdw_${pg_version} mongo_fdw${pg_version} hdfs_fdw_${pg_version}
  717.     # - count_distinct${version}  ddlx_${version}  geoip${version}  orafce${version}
  718.     # - hypopg_${version}  ip4r${version}  jsquery_${version}  logerrors_${version}  periods_${version}  pg_auto_failover_${version}  pg_catcheck${version}
  719.     # - pg_fkpart${version}  pg_jobmon${version}  pg_partman${version}  pg_prioritize_${version}  pg_track_settings${version}  pgaudit15_${version}
  720.     # - pgcryptokey${version}  pgexportdoc${version}  pgimportdoc${version}  pgmemcache-${version}  pgmp${version}  pgq-${version}  pgquarrel pgrouting_${version}
  721.     # - pguint${version}  pguri${version}  prefix${version}   safeupdate_${version}  semver${version}   table_version${version}  tdigest${version}
  723.     #-----------------------------------------------------------------
  724.     # PG_BOOTSTRAP
  725.     #-----------------------------------------------------------------
  726.     pg_safeguard: false               # true will disable pg_clean at all, even for pgsql-remove.yml
  727.     pg_clean: true                    # true will clean running postgres during pgsql init (DANGEROUS)
  728.     pg_data: /pg/data                 # postgres data directory (soft link)
  729.     pg_fs_main: /data                 # primary data disk mount point   /pg   -> {{ pg_fs_main }}/postgres/{{ pg_instance }}
  730.     pg_fs_bkup: /data/backups         # backup disk mount point         /pg/* -> {{ pg_fs_bkup }}/postgres/{{ pg_instance }}/*
  731.     pg_dummy_filesize: 64MiB          # /pg/dummy hold some disk space for emergency use
  732.     pg_listen: '0.0.0.0'              # postgres listen address, '0.0.0.0' (all ipv4 addr) by default
  733.     pg_port: 5432                     # postgres port, 5432 by default
  734.     pg_localhost: /var/run/postgresql # localhost unix socket dir for connection
  735.     patroni_enabled: true             # if not enabled, no postgres cluster will be created
  736.     patroni_mode: default             # pause|default|remove
  737.     pg_dcs_type: consul               # which dcs to use: consul or etcd or raft
  738.     pg_namespace: /pg                 # top level key namespace in dcs
  739.     patroni_port: 8008                # default patroni port
  740.     patroni_watchdog_mode: automatic  # watchdog mode: off|automatic|required
  741.     pg_conf: tiny.yml                 # pgsql template:  {oltp|olap|crit|tiny}.yml
  742.     pg_libs: 'timescaledb, pg_stat_statements, auto_explain'  # extensions to be loaded
  743.     pg_delay: 0                       # apply delay for standby cluster leader
  744.     pg_checksum: false                # enable data checksum by default
  745.     pg_encoding: UTF8                 # database cluster encoding, UTF8 by default
  746.     pg_locale: C                      # database cluster local, C by default
  747.     pg_lc_collate: C                  # database cluster collate, C by default
  748.     pg_lc_ctype: en_US.UTF8           # database character type, en_US.UTF8 by default (for i18n full-text search)
  749.     pgbouncer_enabled: true           # if not enabled, pgbouncer will not be created
  750.     pgbouncer_port: 6432              # pgbouncer port, 6432 by default
  751.     pgbouncer_poolmode: transaction   # pooling mode: session|transaction|statement, transaction pooling by default
  752.     pgbouncer_max_db_conn: 100        # max connection to single database, DO NOT set this larger than postgres max conn or db connlimit
  754.     #-----------------------------------------------------------------
  755.     # PG_PROVISION
  756.     #-----------------------------------------------------------------
  757.     pg_provision: true                # whether provisioning postgres cluster
  758.     pg_init: pg-init                  # init script for cluster template
  760.     pg_default_roles:
  761.       - { name: dbrole_readonly  , login: false , comment: role for global read-only access  }                            # production read-only role
  762.       - { name: dbrole_readwrite , login: false , roles: [dbrole_readonly], comment: role for global read-write access }  # production read-write role
  763.       - { name: dbrole_offline , login: false , comment: role for restricted read-only access (offline instance) }        # restricted-read-only role
  764.       - { name: dbrole_admin , login: false , roles: [pg_monitor, dbrole_readwrite] , comment: role for object creation }  # production DDL change role
  765.       - { name: postgres , superuser: true , comment: system superuser }                             # system dbsu, name is designated by `pg_dbsu`
  766.       - { name: dbuser_dba , superuser: true , roles: [dbrole_admin] , comment: system admin user }  # admin dbsu, name is designated by `pg_admin_username`
  767.       - { name: replicator , replication: true , bypassrls: true , roles: [pg_monitor, dbrole_readonly] , comment: system replicator }                   # replicator
  768.       - { name: dbuser_monitor , roles: [pg_monitor, dbrole_readonly] , comment: system monitor user , parameters: {log_min_duration_statement: 1000 } } # monitor user
  769.       - { name: dbuser_stats , password: DBUser.Stats , roles: [dbrole_offline] , comment: business offline user for offline queries and ETL }           # ETL user
  770.     pg_default_privileges:            # - privileges - #
  771.       - GRANT USAGE                         ON SCHEMAS   TO dbrole_readonly
  772.       - GRANT SELECT                        ON TABLES    TO dbrole_readonly
  773.       - GRANT SELECT                        ON SEQUENCES TO dbrole_readonly
  774.       - GRANT EXECUTE                       ON FUNCTIONS TO dbrole_readonly
  775.       - GRANT USAGE                         ON SCHEMAS   TO dbrole_offline
  776.       - GRANT SELECT                        ON TABLES    TO dbrole_offline
  777.       - GRANT SELECT                        ON SEQUENCES TO dbrole_offline
  778.       - GRANT EXECUTE                       ON FUNCTIONS TO dbrole_offline
  779.       - GRANT INSERT, UPDATE, DELETE        ON TABLES    TO dbrole_readwrite
  780.       - GRANT USAGE, UPDATE                 ON SEQUENCES TO dbrole_readwrite
  781.       - GRANT TRUNCATE, REFERENCES, TRIGGER ON TABLES    TO dbrole_admin
  782.       - GRANT CREATE                        ON SCHEMAS   TO dbrole_admin
  783.     pg_default_schemas: [ monitor ]   # default schemas to be created
  784.     pg_default_extensions:            # default extensions to be created
  785.       - { name: 'pg_stat_statements', schema: 'monitor' }
  786.       - { name: 'pgstattuple',        schema: 'monitor' }
  787.       - { name: 'pg_qualstats',       schema: 'monitor' }
  788.       - { name: 'pg_buffercache',     schema: 'monitor' }
  789.       - { name: 'pageinspect',        schema: 'monitor' }
  790.       - { name: 'pg_prewarm',         schema: 'monitor' }
  791.       - { name: 'pg_visibility',      schema: 'monitor' }
  792.       - { name: 'pg_freespacemap',    schema: 'monitor' }
  793.       - { name: 'pg_repack',          schema: 'monitor' }
  794.       - name: postgres_fdw
  795.       - name: file_fdw
  796.       - name: btree_gist
  797.       - name: btree_gin
  798.       - name: pg_trgm
  799.       - name: intagg
  800.       - name: intarray
  802.     pg_reload: true                   # reload postgres after hba changes
  803.     pg_hba_rules:                     # postgres host-based authentication rules
  804.       - title: allow meta node password access
  805.         role: common
  806.         rules:
  807.           - host    all     all                         10.10.10.10/32      md5
  808.       - title: allow intranet admin password access
  809.         role: common
  810.         rules:
  811.           - host    all     +dbrole_admin               10.0.0.0/8          md5
  812.           - host    all     +dbrole_admin               172.16.0.0/12       md5
  813.           - host    all     +dbrole_admin               192.168.0.0/16      md5
  814.       - title: allow intranet password access
  815.         role: common
  816.         rules:
  817.           - host    all             all                 10.0.0.0/8          md5
  818.           - host    all             all                 172.16.0.0/12       md5
  819.           - host    all             all                 192.168.0.0/16      md5
  820.       - title: allow local read/write (local production user via pgbouncer)
  821.         role: common
  822.         rules:
  823.           - local   all     +dbrole_readonly                                md5
  824.           - host    all     +dbrole_readonly           127.0.0.1/32         md5
  825.       - title: allow offline query (ETL,SAGA,Interactive) on offline instance
  826.         role: offline
  827.         rules:
  828.           - host    all     +dbrole_offline               10.0.0.0/8        md5
  829.           - host    all     +dbrole_offline               172.16.0.0/12     md5
  830.           - host    all     +dbrole_offline               192.168.0.0/16    md5
  832.     pgbouncer_hba_rules:              # pgbouncer host-based authentication rules
  833.       - title: local password access
  834.         role: common
  835.         rules:
  836.           - local  all          all                                     md5
  837.           - host   all          all                     127.0.0.1/32    md5
  838.       - title: intranet password access
  839.         role: common
  840.         rules:
  841.           - host   all          all                     10.0.0.0/8      md5
  842.           - host   all          all                     172.16.0.0/12   md5
  843.           - host   all          all                     192.168.0.0/16  md5
  845.     #-----------------------------------------------------------------
  846.     # PG_EXPORTER
  847.     #-----------------------------------------------------------------
  848.     pg_exporter_enabled: true              # setup pg_exporter on instance
  849.     pg_exporter_config: pg_exporter.yml    # use fast cache exporter for demo
  850.     pg_exporter_port: 9630                 # pg_exporter listen port
  851.     pg_exporter_params: 'sslmode=disable'  # url query parameters for pg_exporter
  852.     pg_exporter_url: ''                    # optional, overwrite auto-generate postgres connstr
  853.     pg_exporter_auto_discovery: true       # optional, discovery available database on target instance ?
  854.     pg_exporter_exclude_database: 'template0,template1,postgres' # optional, comma separated list of database that WILL NOT be monitored when auto-discovery enabled
  855.     pg_exporter_include_database: ''       # optional, comma separated list of database that WILL BE monitored when auto-discovery enabled, empty string will disable include mode
  856.     pg_exporter_options: '--log.level=info --log.format="logger:syslog?appname=pg_exporter&local=7"'
  857.     pgbouncer_exporter_enabled: true       # setup pgbouncer_exporter on instance (if you don't have pgbouncer, disable it)
  858.     pgbouncer_exporter_port: 9631          # pgbouncer_exporter listen port
  859.     pgbouncer_exporter_url: ''             # optional, overwrite auto-generate pgbouncer connstr
  860.     pgbouncer_exporter_options: '--log.level=info --log.format="logger:syslog?appname=pgbouncer_exporter&local=7"'
  862.     #-----------------------------------------------------------------
  863.     # PG_SERVICE
  864.     #-----------------------------------------------------------------
  865.     pg_services:                      # how to expose postgres service in cluster?
  866.       - name: primary                 # service name {{ pg_cluster }}-primary
  867.         src_ip: "*"
  868.         src_port: 5433
  869.         dst_port: pgbouncer           # 5433 route to pgbouncer
  870.         check_url: /primary           # primary health check, success when instance is primary
  871.         selector: "[]"                # select all instance as primary service candidate
  873.       - name: replica                 # service name {{ pg_cluster }}-replica
  874.         src_ip: "*"
  875.         src_port: 5434
  876.         dst_port: pgbouncer
  877.         check_url: /read-only         # read-only health check. (including primary)
  878.         selector: "[]"                # select all instance as replica service candidate
  879.         selector_backup: "[? pg_role == `primary` || pg_role == `offline` ]"
  881.       - name: default                 # service's actual name is {{ pg_cluster }}-default
  882.         src_ip: "*"                   # service bind ip address, * for all, vip for cluster virtual ip address
  883.         src_port: 5436                # bind port, mandatory
  884.         dst_port: postgres            # target port: postgres|pgbouncer|port_number , pgbouncer(6432) by default
  885.         check_method: http            # health check method: only http is available for now
  886.         check_port: patroni           # health check port:  patroni|pg_exporter|port_number , patroni by default
  887.         check_url: /primary           # health check url path, / as default
  888.         check_code: 200               # health check http code, 200 as default
  889.         selector: "[]"                # instance selector
  890.         haproxy:                      # haproxy specific fields
  891.           maxconn: 3000               # default front-end connection
  892.           balance: roundrobin         # load balance algorithm (roundrobin by default)
  893.           default_server_options: 'inter 3s fastinter 1s downinter 5s rise 3 fall 3 on-marked-down shutdown-sessions slowstart 30s maxconn 3000 maxqueue 128 weight 100'
  895.       - name: offline                 # service name {{ pg_cluster }}-offline
  896.         src_ip: "*"
  897.         src_port: 5438
  898.         dst_port: postgres
  899.         check_url: /replica           # offline MUST be a replica
  900.         selector: "[? pg_role == `offline` || pg_offline_query ]"         # instances with pg_role == 'offline' or instance marked with 'pg_offline_query == true'
  901.         selector_backup: "[? pg_role == `replica` && !pg_offline_query]"  # replica are used as backup server in offline service
  903.     haproxy_enabled: true             # enable haproxy on this node?
  904.     haproxy_reload: true              # reload haproxy after config?
  905.     haproxy_auth_enabled: false       # enable authentication for haproxy admin?
  906.     haproxy_admin_username: admin     # default haproxy admin username
  907.     haproxy_admin_password: pigsty    # default haproxy admin password
  908.     haproxy_exporter_port: 9101       # default admin/exporter port
  909.     haproxy_client_timeout: 24h       # client side connection timeout
  910.     haproxy_server_timeout: 24h       # server side connection timeout
  911.     vip_mode: none                    # none | l2 | l4 , l4 not implemented yet
  912.     vip_reload: true                  # reload vip after config?
  913.     # vip_address: 127.0.0.1          # virtual ip address ip (l2 or l4)
  914.     # vip_cidrmask: 24                # virtual ip address cidr mask (l2 only)
  915.     # vip_interface: eth0             # virtual ip network interface (l2 only)
  916.     # dns_mode: vip                   # vip|all|selector: how to resolve cluster DNS?
  917.     # dns_selector: '[]'              # if dns_mode == vip, filter instances been resolved
  920.     #================================================================#
  921.     #                         VARS: REDIS                            #
  922.     #================================================================#
  923.     # REDIS are not enabled by default
  925.     #-----------------------------------------------------------------
  926.     # REDIS_IDENTITY
  927.     #-----------------------------------------------------------------
  928.     #redis_cluster: redis-test        # name of this redis cluster @ cluster level
  929.     #redis_node: 1                    # redis node identifier, integer sequence @ node level
  930.     #redis_instances: {}              # redis instances definition of this redis node @ node level
  932.     #-----------------------------------------------------------------
  933.     # REDIS_NODE
  934.     #-----------------------------------------------------------------
  935.     redis_fs_main: /data              # main fs mountpoint for redis data
  936.     redis_exporter_enabled: true      # install redis exporter on redis nodes?
  937.     redis_exporter_port: 9121         # default port for redis exporter
  938.     redis_exporter_options: ''        # default cli args for redis exporter
  940.     #-----------------------------------------------------------------
  941.     # REDIS_PROVISION
  942.     #-----------------------------------------------------------------
  943.     redis_safeguard: false            # force redis_clean = abort if true
  944.     redis_clean: true                 # abort|skip|clean if redis server already exists
  945.     redis_rmdata: true                # remove redis data when purging redis server?
  946.     redis_mode: standalone            # standalone,cluster,sentinel
  947.     redis_conf: redis.conf            # config template path (except sentinel)
  948.     redis_bind_address: '0.0.0.0'     # bind address, empty string turns to inventory_hostname
  949.     redis_max_memory: 1GB             # max memory used by each redis instance
  950.     redis_mem_policy: allkeys-lru     # memory eviction policy
  951.     redis_password: ''                # masterauth & requirepass password, disable by empty string
  952.     redis_rdb_save: ['1200 1']        # redis rdb save directives, disable with empty list
  953.     redis_aof_enabled: false          # redis aof enabled
  954.     redis_rename_commands: {}         # rename dangerous commands
  955.     redis_cluster_replicas: 1         # how many replicas for a master in redis cluster ?
  957. ...

Last modified 2022-06-20: add timescaledb (3c335f4)