Commit cc12b268 authored by Will Chandler's avatar Will Chandler Committed by Achilleas Pipinellis

Docs: Clarify secrets usage and PG settings for Praefect

parent b5ac9eb4
...@@ -72,9 +72,11 @@ We need to manage the following secrets and make them match across hosts: ...@@ -72,9 +72,11 @@ We need to manage the following secrets and make them match across hosts:
1. `PRAEFECT_SQL_PASSWORD`: this password is used by Praefect to connect to 1. `PRAEFECT_SQL_PASSWORD`: this password is used by Praefect to connect to
PostgreSQL. PostgreSQL.
We will note in the instructions below where these secrets are required.
#### Network addresses #### Network addresses
1. `POSTGRESQL_SERVER`: the host name or IP address of your PostgreSQL server 1. `POSTGRESQL_SERVER_ADDRESS`: the host name or IP address of your PostgreSQL server
#### PostgreSQL #### PostgreSQL
...@@ -91,7 +93,7 @@ Below we assume that you have administrative access as the `postgres` ...@@ -91,7 +93,7 @@ Below we assume that you have administrative access as the `postgres`
user. First open a `psql` session as the `postgres` user: user. First open a `psql` session as the `postgres` user:
```shell ```shell
/opt/gitlab/embedded/bin/psql -h POSTGRESQL_SERVER -U postgres -d template1 /opt/gitlab/embedded/bin/psql -h POSTGRESQL_SERVER_ADDRESS -U postgres -d template1
``` ```
Once you are connected, run the following command. Replace Once you are connected, run the following command. Replace
...@@ -107,7 +109,7 @@ Now connect as the `praefect` user to create the database. This has ...@@ -107,7 +109,7 @@ Now connect as the `praefect` user to create the database. This has
the side effect of verifying that you have access: the side effect of verifying that you have access:
```shell ```shell
/opt/gitlab/embedded/bin/psql -h POSTGRESQL_SERVER -U praefect -d template1 /opt/gitlab/embedded/bin/psql -h POSTGRESQL_SERVER_ADDRESS -U praefect -d template1
``` ```
Once you have connected as the `praefect` user, run: Once you have connected as the `praefect` user, run:
...@@ -125,6 +127,12 @@ Gitaly node that will be connected to Praefect as members of the `praefect` hash ...@@ -125,6 +127,12 @@ Gitaly node that will be connected to Praefect as members of the `praefect` hash
In the example below, the Gitaly nodes are named `gitaly-N`. Note that one In the example below, the Gitaly nodes are named `gitaly-N`. Note that one
node is designated as primary by setting the primary to `true`. node is designated as primary by setting the primary to `true`.
If you are using an uncrypted connection to Postgres, set `praefect['database_sslmode']` to false.
If you are using an encrypted connection with a client certificate,
`praefect['database_sslcert']` and `praefect['database_sslkey']` will need to be set.
If you are using a custom CA, also set `praefect['database_sslrootcert']`:
```ruby ```ruby
# /etc/gitlab/gitlab.rb on praefect server # /etc/gitlab/gitlab.rb on praefect server
...@@ -174,7 +182,7 @@ praefect['virtual_storages'] = { ...@@ -174,7 +182,7 @@ praefect['virtual_storages'] = {
} }
# Replace POSTGRESQL_SERVER below with a real IP/host address of the database. # Replace POSTGRESQL_SERVER below with a real IP/host address of the database.
praefect['database_host'] = 'POSTGRESQL_SERVER' praefect['database_host'] = 'POSTGRESQL_SERVER_ADDRESS'
praefect['database_port'] = 5432 praefect['database_port'] = 5432
praefect['database_user'] = 'praefect' praefect['database_user'] = 'praefect'
# Replace PRAEFECT_SQL_PASSWORD below with a real password of the database. # Replace PRAEFECT_SQL_PASSWORD below with a real password of the database.
...@@ -195,6 +203,9 @@ praefect['database_dbname'] = 'praefect_production' ...@@ -195,6 +203,9 @@ praefect['database_dbname'] = 'praefect_production'
# praefect['database_sslrootcert'] = '/path/to/rootcert' # praefect['database_sslrootcert'] = '/path/to/rootcert'
``` ```
Replace `POSTGRESQL_SERVER_ADDRESS`, `PRAEFECT_EXTERNAL_TOKEN`, `PRAEFECT_INTERNAL_TOKEN`,
and `PRAEFECT_SQL_PASSWORD` with their respective values.
Save the file and [reconfigure Praefect](../restart_gitlab.md#omnibus-gitlab-reconfigure). Save the file and [reconfigure Praefect](../restart_gitlab.md#omnibus-gitlab-reconfigure).
After you reconfigure, verify that Praefect can reach PostgreSQL: After you reconfigure, verify that Praefect can reach PostgreSQL:
...@@ -260,6 +271,9 @@ git_data_dirs({ ...@@ -260,6 +271,9 @@ git_data_dirs({
}) })
``` ```
Replace `GITLAB_SHELL_SECRET_TOKEN` and `PRAEFECT_INTERNAL_TOKEN`
with their respective values.
For more information on Gitaly server configuration, see our [Gitaly documentation](index.md#3-gitaly-server-configuration). For more information on Gitaly server configuration, see our [Gitaly documentation](index.md#3-gitaly-server-configuration).
When finished editing the configuration file for each Gitaly server, run the When finished editing the configuration file for each Gitaly server, run the
...@@ -302,6 +316,9 @@ git_data_dirs({ ...@@ -302,6 +316,9 @@ git_data_dirs({
gitlab_shell['secret_token'] = 'GITLAB_SHELL_SECRET_TOKEN' gitlab_shell['secret_token'] = 'GITLAB_SHELL_SECRET_TOKEN'
``` ```
Replace `GITLAB_SHELL_SECRET_TOKEN` and `PRAEFECT_EXTERNAL_TOKEN`
with their respective values.
Note that the storage name used is the same as the `praefect['virtual_storage_name']` set Note that the storage name used is the same as the `praefect['virtual_storage_name']` set
on the Praefect node. on the Praefect node.
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment