snapshot of https://github.com/zulip/zulip.git @ 48c69911c7dd4e03b20552eb3bd77ad8151c1357 (2026-09-15)

puppet/kandra/templates/teleport_db.yaml.template.erb

@@ -0,0 +1,49 @@
+# See https://goteleport.com/docs/config-reference/ and
+# https://goteleport.com/docs/database-access/guides/postgres-self-hosted/
+#
+# This establishes a reverse proxy back to the central auth server,
+# allowing that to connect to the postgres server running on
+# localhost:5432.  Auth is checked using role-based access control,
+# which determines which hosts, databases, and database users the
+# remote user is allowed to connect to.
+teleport:
+  ca_pin: "sha256:062db37249ea74c450579da8f02043b317cb8a174d653bb5090a89752d68efe7"
+  auth_servers:
+    # Use the proxy address, to support running the db_service, which requires
+    # a reverse tunnel.
+    - teleport.zulipchat.net:443
+<% if @is_ec2 -%>
+  join_params:
+    method: iam
+    token_name: iam-token
+<% else -%>
+  join_params:
+    method: token
+    token_name: <%= @join_token %>
+<% end %>
+
+ssh_service:
+  enabled: no
+app_service:
+  enabled: no
+proxy_service:
+  enabled: no
+auth_service:
+  enabled: no
+
+db_service:
+  enabled: yes
+  databases:
+    - name: "<%= @hostname %>"
+      protocol: "postgres"
+      uri: "<%= @fqdn %>:5432"
+      static_labels:
+        hostname: "<%= @hostname %>"
+      dynamic_labels:
+        # Every hour, refresh the label that describes if this
+        # instance is a replica; this allows access to be granted only
+        # to replicas.
+        - name: "is_replica"
+          command:
+            ["sudo", "-u", "zulip", "psql", "-tc", "select pg_is_in_recovery()"]
+          period: 1h