snapshot of https://github.com/zulip/zulip.git @ 48c69911c7dd4e03b20552eb3bd77ad8151c1357 (2026-09-15)

puppet/zulip/manifests/postgresql_common.pp

@@ -0,0 +1,79 @@
+class zulip::postgresql_common {
+  include zulip::snakeoil
+  $version = zulipconf('postgresql', 'version', undef)
+  case $facts['os']['family'] {
+    'Debian': {
+      $postgresql = "postgresql-${version}"
+      $postgresql_packages = [
+        # The database itself
+        $postgresql,
+        # tools for database monitoring; formerly ptop
+        'pgtop',
+        # our dictionary
+        'hunspell-en-us',
+        # PostgreSQL Nagios check plugin
+        'check-postgres',
+      ]
+      $postgresql_user_reqs = [
+        Package[$postgresql],
+        Package['ssl-cert'],
+      ]
+    }
+    'RedHat': {
+      $postgresql = "postgresql${version}"
+      $postgresql_packages = [
+        $postgresql,
+        "${postgresql}-server",
+        "${postgresql}-devel",
+        'pg_top',
+        'hunspell-en-US',
+        # exists on CentOS 6 and Fedora 29 but not CentOS 7
+        # see https://pkgs.org/download/check_postgres
+        # alternatively, download directly from:
+        # https://bucardo.org/check_postgres/
+        # 'check-postgres',  # TODO
+      ]
+      group { 'ssl-cert':
+        ensure => present,
+      }
+      # allows ssl-cert group to read /etc/pki/tls/private
+      file { '/etc/pki/tls/private':
+        ensure => directory,
+        mode   => '0750',
+        owner  => 'root',
+        group  => 'ssl-cert',
+      }
+      $postgresql_user_reqs = [
+        Package[$postgresql],
+        Group['ssl-cert'],
+      ]
+    }
+    default: {
+      fail('osfamily not supported')
+    }
+  }
+
+  zulip::safepackage { $postgresql_packages:
+    ensure  => installed,
+    require => Exec['generate-default-snakeoil'],
+    tag     => ['postgresql_upgrade'],
+  }
+
+  if $facts['os']['family'] == 'Debian' {
+    # The logrotate file only created in debian-based systems
+    exec { 'disable_logrotate':
+      # lint:ignore:140chars
+      command => '/usr/bin/dpkg-divert --rename --divert /etc/logrotate.d/postgresql-common.disabled --add /etc/logrotate.d/postgresql-common',
+      # lint:endignore
+      creates => '/etc/logrotate.d/postgresql-common.disabled',
+    }
+  }
+
+  # Use arcane puppet virtual resources to add postgres user to zulip group
+  @user { 'postgres':
+    groups     => ['ssl-cert'],
+    membership => minimum,
+    require    => $postgresql_user_reqs,
+  }
+  User <| title == postgres |> { groups +> 'zulip' }
+}