Skip to content

Commit 379d136

Browse files
Vonngclaude
Vonng
and
claude
committed
docs: add param config, firewall mgmt, update weights
- Add pgsql/config/param.md: PostgreSQL parameter configuration - Add node/admin.md: HAProxy password & firewall management - Add vibe/param.md: npm_packages parameter - Update pgsql/config weights and pg_version 17->18 - Update release.md checksum Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
1 parent 4e807ce commit 379d136

File tree

11 files changed

+609
-11
lines changed

11 files changed

+609
-11
lines changed

‎content/docs/about/release.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -228,7 +228,7 @@ Major extensions add PG 18 support: age, citus, documentdb, pg_search, timescale
228228
**Checksums**
229229

230230
```bash
231-
bca8a819ed83e5fc228af9e991de1f17 pigsty-v4.0.0.tgz
231+
bc48405075b3ec6a85fc2c99a1f77650 pigsty-v4.0.0.tgz
232232
db9797c3c8ae21320b76a442c1135c7b pigsty-pkg-v4.0.0.d12.aarch64.tgz
233233
1eed26eee42066ca71b9aecbf2ca1237 pigsty-pkg-v4.0.0.d12.x86_64.tgz
234234
03540e41f575d6c3a7c63d1d30276d49 pigsty-pkg-v4.0.0.d13.aarch64.tgz

‎content/docs/node/admin.md‎

Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,3 +142,150 @@ If you want to add or reconfigure monitoring on existing nodes, use the followin
142142
./node.yml -t node_crontab # add/overwrite crontab entries
143143
./node.yml -t node_vip # setup optional L2 VIP for node cluster
144144
```
145+
146+
147+
----------------
148+
149+
## HAProxy Password
150+
151+
[`haproxy_admin_password`](param/#haproxy_admin_password) (default `pigsty`) is used for HAProxy admin UI authentication, rendered to `/etc/haproxy/haproxy.cfg`.
152+
153+
After changing the password, use the following to reload config (hot reload, no connection interruption):
154+
155+
```bash
156+
./node.yml -l <target> -t haproxy_config,haproxy_reload
157+
```
158+
159+
160+
----------------
161+
162+
## Firewall Management
163+
164+
Pigsty uses [`node_firewall_mode`](param/#node_firewall_mode) to control firewall behavior.
165+
Uses **firewalld** on RHEL/Rocky and **ufw** on Debian/Ubuntu.
166+
167+
By default, this is `none` - existing firewall config is untouched and left to the user.
168+
Set to `zone` to enable the system firewall.
169+
In zone mode, intranet traffic is unrestricted, but external access is limited to specific ports.
170+
This is especially important when deploying on cloud servers exposed to the internet.
171+
172+
We recommend opening only necessary ports: 22 (SSH), 80/443 (HTTP/HTTPS) are essential. Be cautious about exposing port 5432 (PostgreSQL).
173+
174+
175+
### Enable Firewall
176+
177+
Set `node_firewall_mode` to `zone` to enable firewall with trusted zone config:
178+
179+
```yaml
180+
node_firewall_mode: zone # enable firewall with zone rules
181+
node_firewall_intranet: # trust these CIDRs (full access)
182+
- 10.0.0.0/8
183+
- 192.168.0.0/16
184+
- 172.16.0.0/12
185+
node_firewall_public_port: # open these ports to public
186+
- 22 # SSH
187+
- 80 # HTTP
188+
- 443 # HTTPS
189+
```
190+
191+
Then execute: `./node.yml -l <target> -t node_firewall`
192+
193+
194+
### Open More Ports
195+
196+
To open additional ports, add them to `node_firewall_public_port` and re-run:
197+
198+
```yaml
199+
node_firewall_public_port: [22, 80, 443, 5432, 6379] # add PostgreSQL and Redis ports
200+
```
201+
202+
```bash
203+
./node.yml -l <target> -t node_firewall
204+
```
205+
206+
207+
### Configure Intranet CIDRs
208+
209+
CIDRs in `node_firewall_intranet` are added to the **trusted zone** with full access:
210+
211+
```yaml
212+
node_firewall_intranet:
213+
- 10.0.0.0/8 # Class A private
214+
- 192.168.0.0/16 # Class C private
215+
- 172.16.0.0/12 # Class B private
216+
- 100.64.0.0/10 # Carrier-grade NAT (if needed)
217+
```
218+
219+
220+
### Remove Rules (Manual)
221+
222+
> **Important**: Pigsty's firewall management is **add-only**. Removing entries from config and re-running
223+
> **will NOT** delete existing rules. You must remove them manually.
224+
225+
{{< tabpane text=true persist=header >}}
226+
{{% tab header="EL (firewalld)" %}}
227+
```bash
228+
# Remove port from public zone
229+
sudo firewall-cmd --zone=public --remove-port=5432/tcp
230+
sudo firewall-cmd --runtime-to-permanent
231+
232+
# Remove CIDR from trusted zone
233+
sudo firewall-cmd --zone=trusted --remove-source=10.0.0.0/8
234+
sudo firewall-cmd --runtime-to-permanent
235+
236+
# View current rules
237+
sudo firewall-cmd --zone=public --list-ports
238+
sudo firewall-cmd --zone=trusted --list-sources
239+
240+
# Reset to initial state (remove all custom rules)
241+
sudo firewall-cmd --complete-reload
242+
```
243+
{{% /tab %}}
244+
{{% tab header="Debian (ufw)" %}}
245+
```bash
246+
# Delete port rule
247+
sudo ufw delete allow 5432/tcp
248+
249+
# Delete CIDR rule
250+
sudo ufw delete allow from 10.0.0.0/8
251+
252+
# View current rules (numbered)
253+
sudo ufw status numbered
254+
255+
# Delete by rule number
256+
sudo ufw delete <rule_number>
257+
258+
# Reset to initial state (remove all rules, keep ufw enabled)
259+
sudo ufw reset
260+
```
261+
{{% /tab %}}
262+
{{< /tabpane >}}
263+
264+
265+
### Disable Firewall
266+
267+
To completely disable the firewall, set `node_firewall_mode` to `off`:
268+
269+
```yaml
270+
node_firewall_mode: off # completely disable firewall
271+
```
272+
273+
```bash
274+
./node.yml -l <target> -t node_firewall
275+
```
276+
277+
Or disable manually:
278+
279+
{{< tabpane text=true persist=header >}}
280+
{{% tab header="EL (firewalld)" %}}
281+
```bash
282+
sudo systemctl disable --now firewalld
283+
```
284+
{{% /tab %}}
285+
{{% tab header="Debian (ufw)" %}}
286+
```bash
287+
sudo ufw disable
288+
```
289+
{{% /tab %}}
290+
{{< /tabpane >}}
291+

‎content/docs/pgsql/config/acl.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
title: Access Control
3-
weight: 1207
3+
weight: 70
44
description: Default role system and privilege model provided by Pigsty
55
icon: fa-solid fa-lock
66
module: [PGSQL]

‎content/docs/pgsql/config/alias.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
title: Package Alias
3-
weight: 1203
3+
weight: 30
44
description: Pigsty provides a package alias translation mechanism that shields the
55
differences in binary package details across operating systems, making installation
66
easier.

‎content/docs/pgsql/config/cluster.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
title: Cluster / Instance
3-
weight: 1201
3+
weight: 10
44
description: Choose the appropriate instance and cluster types based on your requirements
55
to configure PostgreSQL database clusters that meet your needs.
66
icon: fa-solid fa-code

‎content/docs/pgsql/config/db.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
title: Database
3-
weight: 1205
3+
weight: 50
44
description: How to define and customize PostgreSQL databases through configuration?
55
icon: fa-solid fa-coins
66
module: [PGSQL]

‎content/docs/pgsql/config/hba.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
title: HBA Rules
3-
weight: 1206
3+
weight: 60
44
description: Detailed explanation of PostgreSQL and Pgbouncer Host-Based Authentication (HBA) rules configuration in Pigsty.
55
icon: fa-solid fa-key
66
module: [PGSQL]

‎content/docs/pgsql/config/kernel.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
title: Kernel Version
3-
weight: 1202
3+
weight: 20
44
description: How to choose the appropriate PostgreSQL kernel and major version.
55
icon: fa-solid fa-microchip
66
module: [PGSQL]
@@ -23,12 +23,12 @@ Pigsty supports PostgreSQL from version 10 onwards. The current version packages
2323
```yaml
2424
all:
2525
vars:
26-
pg_version: 17
26+
pg_version: 18
2727
pg_packages: [ pgsql-main pgsql-common ]
2828
pg_extensions: [ postgis, timescaledb, pgvector, pgml ]
2929
```
3030
31-
> Effect: Ansible will pull packages corresponding to `pg_version=17` during installation, pre-install extensions to the system, and database initialization scripts can then directly `CREATE EXTENSION`.
31+
> Effect: Ansible will pull packages corresponding to `pg_version=18` during installation, pre-install extensions to the system, and database initialization scripts can then directly `CREATE EXTENSION`.
3232

3333
Extension support varies across versions in Pigsty's offline repository: 12/13 only provide core and tier-1 extensions, while 15/17/18 cover all extensions. If an extension is not pre-packaged, it can be added via `repo_packages_extra`.
3434

0 commit comments

Comments
 (0)