64898b2c79
Some checks failed
Code scanning / CodeQL (push) Failing after 15s
Zulip production suite / Ubuntu 22.04 production build (push) Failing after 26s
Zulip production suite / Debian 12 production install with custom db name and user (push) Has been skipped
Zulip production suite / Ubuntu 22.04 production install and PostgreSQL upgrade with pgroonga (push) Has been skipped
Zulip production suite / Ubuntu 24.04 production install (push) Has been skipped
Zulip production suite / Ubuntu 26.04 production install (push) Has been skipped
Zulip production suite / Debian 13 production install (push) Has been skipped
Zulip production suite / 7.0 Version Upgrade (push) Has been skipped
Zulip production suite / 8.0 Version Upgrade (push) Has been skipped
Zulip production suite / 6.0 Version Upgrade (push) Has been skipped
Zulip production suite / 10.0 Version Upgrade (push) Has been skipped
Zulip production suite / 9.0 Version Upgrade (push) Has been skipped
Zulip production suite / 12.0 Version Upgrade (push) Has been skipped
Zulip production suite / 11.0 Version Upgrade (push) Has been skipped
GitHub Actions Security Analysis with zizmor / zizmor (push) Failing after 3s
Zulip CI / Debian 12 (Python 3.11, backend + documentation) (push) Failing after 26s
Zulip CI / Ubuntu 22.04 (Python 3.10, backend + frontend) (push) Failing after 3s
Zulip CI / Ubuntu 24.04 (Python 3.12, backend) (push) Failing after 25s
Zulip CI / Ubuntu 26.04 (Python 3.14, backend) (push) Failing after 25s
Zulip CI / Debian 13 (Python 3.13, backend) (push) Failing after 28s
Zulip production suite / Required jobs (push) Has been cancelled
Zulip CI / Required jobs (push) Has been cancelled
API Documentation Update Check / check-feature-level-updated (push) Has been cancelled
API Documentation Update Check / notify-if-api-docs-changed (push) Has been cancelled
50 lines
1.4 KiB
Plaintext
50 lines
1.4 KiB
Plaintext
# See https://goteleport.com/docs/config-reference/ and
|
|
# https://goteleport.com/docs/database-access/guides/postgres-self-hosted/
|
|
#
|
|
# This establishes a reverse proxy back to the central auth server,
|
|
# allowing that to connect to the postgres server running on
|
|
# localhost:5432. Auth is checked using role-based access control,
|
|
# which determines which hosts, databases, and database users the
|
|
# remote user is allowed to connect to.
|
|
teleport:
|
|
ca_pin: "sha256:062db37249ea74c450579da8f02043b317cb8a174d653bb5090a89752d68efe7"
|
|
auth_servers:
|
|
# Use the proxy address, to support running the db_service, which requires
|
|
# a reverse tunnel.
|
|
- teleport.zulipchat.net:443
|
|
<% if @is_ec2 -%>
|
|
join_params:
|
|
method: iam
|
|
token_name: iam-token
|
|
<% else -%>
|
|
join_params:
|
|
method: token
|
|
token_name: <%= @join_token %>
|
|
<% end %>
|
|
|
|
ssh_service:
|
|
enabled: no
|
|
app_service:
|
|
enabled: no
|
|
proxy_service:
|
|
enabled: no
|
|
auth_service:
|
|
enabled: no
|
|
|
|
db_service:
|
|
enabled: yes
|
|
databases:
|
|
- name: "<%= @hostname %>"
|
|
protocol: "postgres"
|
|
uri: "<%= @fqdn %>:5432"
|
|
static_labels:
|
|
hostname: "<%= @hostname %>"
|
|
dynamic_labels:
|
|
# Every hour, refresh the label that describes if this
|
|
# instance is a replica; this allows access to be granted only
|
|
# to replicas.
|
|
- name: "is_replica"
|
|
command:
|
|
["sudo", "-u", "zulip", "psql", "-tc", "select pg_is_in_recovery()"]
|
|
period: 1h
|