search

vitabaks / postgresql_cluster

PostgreSQL High-Availability Cluster (based on "Patroni" and DCS "etcd" or "consul"). Automating with Ansible.
MIT License
1.27k stars 339 forks source link

TLS between the components #361

Open ppaslan opened 10 months ago

ppaslan commented 10 months ago

Hi, first of all, thanks for all your hard work with this Ansible playbook as it makes deployment much easier for a lot of reasons but there is something that i am very curious about.

Are the components communicating through TLS or plaintext? I cannot see any settings for TLS/Certification setup.

vitabaks commented 10 months ago

At the moment, TLS is not configured automatically. I think it's worth adding such an option.

Feel free to create a PR.

ppaslan commented 10 months ago

At the moment, TLS is not configured automatically. I think it's worth adding such an option.

Feel free to create a PR.

Thank you for the fast response.

Assuming using the Type B configuration, and ETCD and Postgresql resides on the same host, which components communicate with each other? Basically to achieve full TLS between every components that talk to each other outside of localhost, which components do we have to activate TLS for?

We are planning to initially adjust the playbook to work with TLS with the configuration above but are also planning to make it work for all the types and setups and provide a PR later on in order to contribute to the project.

vitabaks commented 10 months ago

Assuming using the Type B configuration, and ETCD and Postgresql resides on the same host, which components communicate with each other? Basically to achieve full TLS between every components that talk to each other outside of localhost, which components do we have to activate TLS for?

This is a good recommendation, but it is not a strict requirement, even for a production environment, if your cluster is located in your own data center with a secure network. In addition, sensitive information is not stored in DCS.

To begin with, TLS between the client and the database will be enough. Then it is already possible to implement TLS for the rest of the components (e.q. Patroni, etcd, consul).