Marek Miklewicz
787 lines
26 KiB
Bash
Executable File
787 lines
26 KiB
Bash
Executable File
#!/bin/bash
|
||
# =============================================================================
|
||
# postgresql_install.sh
|
||
# Instalacja PostgreSQL na AlmaLinux 8/9, CloudLinux 8/9
|
||
# i systemach kompatybilnych z RHEL pod kontrolą DirectAdmin
|
||
#
|
||
# Polityka bezpieczeństwa:
|
||
# - Dostęp wyłącznie przez localhost (listen_addresses = 'localhost')
|
||
# - Uwierzytelnianie hasłem dla WSZYSTKICH połączeń (brak peer, brak trust)
|
||
# - Połączenia replikacji odrzucone
|
||
#
|
||
# Rozszerzenia PHP:
|
||
# - Podejście przez custom configure (zapewnia pgsql + pdo_pgsql)
|
||
# - Obsługa: apache, nginx, nginx_apache, litespeed, openlitespeed
|
||
# - Tryby PHP: php-fpm, fastcgi, lsphp
|
||
# =============================================================================
|
||
|
||
set -euo pipefail
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Kolory
|
||
# ---------------------------------------------------------------------------
|
||
RED='\033[0;31m'
|
||
GREEN='\033[0;32m'
|
||
YELLOW='\033[1;33m'
|
||
CYAN='\033[0;36m'
|
||
BOLD='\033[1m'
|
||
NC='\033[0m'
|
||
|
||
info() { echo -e "${GREEN}[INFO]${NC} $*"; }
|
||
warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
|
||
sekcja() { echo -e "\n${BOLD}${CYAN}=== $* ===${NC}\n"; }
|
||
die() { echo -e "${RED}[BŁĄD]${NC} $*" >&2; exit 1; }
|
||
|
||
CB_PHP_WEBSERVER=""
|
||
CB_PHP_OPTIONS_CONF=""
|
||
DA_PG_RUNTIME_LIBDIR=""
|
||
DA_PG_RUNTIME_LIBPQ=""
|
||
declare -ag CB_PHP_VERSIONS=()
|
||
declare -ag CB_PHP_CODES=()
|
||
declare -ag CB_PHP_MODES=()
|
||
|
||
cb_pgsql_reset_php_targets() {
|
||
CB_PHP_VERSIONS=()
|
||
CB_PHP_CODES=()
|
||
CB_PHP_MODES=()
|
||
}
|
||
|
||
cb_pgsql_get_cb_option() {
|
||
local options_conf="$1"
|
||
local key="$2"
|
||
local value=""
|
||
|
||
[[ -f "$options_conf" ]] || return 1
|
||
value="$(awk -F= -v key="$key" '
|
||
$1 == key {
|
||
sub(/^[[:space:]]+/, "", $2)
|
||
sub(/[[:space:]]+$/, "", $2)
|
||
print $2
|
||
exit
|
||
}
|
||
' "$options_conf")"
|
||
[[ -n "$value" ]] || return 1
|
||
printf '%s\n' "$value"
|
||
}
|
||
|
||
cb_pgsql_php_code_from_version() {
|
||
printf '%s\n' "${1//./}"
|
||
}
|
||
|
||
cb_pgsql_php_version_from_code() {
|
||
local code="$1"
|
||
if [[ "$code" == *.* ]]; then
|
||
printf '%s\n' "$code"
|
||
elif [[ "$code" =~ ^[0-9]{2,3}$ ]]; then
|
||
printf '%s.%s\n' "${code:0:1}" "${code:1}"
|
||
else
|
||
printf '%s\n' "$code"
|
||
fi
|
||
}
|
||
|
||
cb_pgsql_add_php_target() {
|
||
local version="$1"
|
||
local mode="$2"
|
||
local code=""
|
||
local idx=""
|
||
|
||
[[ -n "$version" ]] || return 0
|
||
code="$(cb_pgsql_php_code_from_version "$version")"
|
||
for idx in "${!CB_PHP_CODES[@]}"; do
|
||
if [[ "${CB_PHP_CODES[$idx]}" == "$code" ]]; then
|
||
return 0
|
||
fi
|
||
done
|
||
|
||
CB_PHP_VERSIONS+=("$version")
|
||
CB_PHP_CODES+=("$code")
|
||
CB_PHP_MODES+=("${mode:-php-fpm}")
|
||
}
|
||
|
||
cb_pgsql_detect_webserver() {
|
||
local cb_dir="$1"
|
||
|
||
CB_PHP_OPTIONS_CONF="${cb_dir}/options.conf"
|
||
CB_PHP_WEBSERVER="apache"
|
||
|
||
if [[ -f "$CB_PHP_OPTIONS_CONF" ]]; then
|
||
CB_PHP_WEBSERVER="$(cb_pgsql_get_cb_option "$CB_PHP_OPTIONS_CONF" "webserver" || true)"
|
||
[[ -n "$CB_PHP_WEBSERVER" ]] || CB_PHP_WEBSERVER="apache"
|
||
fi
|
||
}
|
||
|
||
cb_pgsql_collect_php_targets() {
|
||
local cb_dir="$1"
|
||
local slot=""
|
||
local release=""
|
||
local mode=""
|
||
local default_mode=""
|
||
|
||
cb_pgsql_reset_php_targets
|
||
cb_pgsql_detect_webserver "$cb_dir"
|
||
|
||
# CloudLinux może używać lsphp także przy webserver=apache.
|
||
# Dlatego najpierw honorujemy phpN_mode/php1_mode z options.conf,
|
||
# a dopiero przy ich braku stosujemy domyślny tryb wynikający z webserwera.
|
||
case "$CB_PHP_WEBSERVER" in
|
||
litespeed|openlitespeed) default_mode="lsphp" ;;
|
||
*) default_mode="php-fpm" ;;
|
||
esac
|
||
|
||
for slot in 1 2 3 4 5 6 7 8 9; do
|
||
release="$(cb_pgsql_get_cb_option "$CB_PHP_OPTIONS_CONF" "php${slot}_release" || true)"
|
||
mode="$(cb_pgsql_get_cb_option "$CB_PHP_OPTIONS_CONF" "php${slot}_mode" || true)"
|
||
[[ -n "$mode" ]] || mode="$(cb_pgsql_get_cb_option "$CB_PHP_OPTIONS_CONF" "php1_mode" || true)"
|
||
[[ -n "$mode" ]] || mode="$default_mode"
|
||
case "${release,,}" in
|
||
""|no|off) continue ;;
|
||
esac
|
||
case "${mode,,}" in
|
||
no|off) continue ;;
|
||
esac
|
||
cb_pgsql_add_php_target "$release" "$mode"
|
||
done
|
||
}
|
||
|
||
cb_pgsql_build_file_candidates() {
|
||
local cb_dir="$1"
|
||
local mode="$2"
|
||
local code="$3"
|
||
local -n out_ref="$4"
|
||
|
||
out_ref=()
|
||
if [[ "$mode" == "lsphp" ]]; then
|
||
case "$CB_PHP_WEBSERVER" in
|
||
litespeed)
|
||
out_ref+=("${cb_dir}/configure/litespeed/configure.php${code}")
|
||
;;
|
||
openlitespeed)
|
||
out_ref+=("${cb_dir}/configure/openlitespeed/configure.php${code}")
|
||
;;
|
||
esac
|
||
out_ref+=("${cb_dir}/configure/lsphp/configure.lsphp${code}")
|
||
out_ref+=("${cb_dir}/configure/lsphp/configure.php${code}")
|
||
fi
|
||
out_ref+=("${cb_dir}/configure/php/configure.php${code}")
|
||
}
|
||
|
||
cb_pgsql_resolve_config_paths() {
|
||
local cb_dir="$1"
|
||
local version="$2"
|
||
local mode="$3"
|
||
local source_ref_name="$4"
|
||
local custom_ref_name="$5"
|
||
local code=""
|
||
local -a candidates=()
|
||
local candidate=""
|
||
|
||
code="$(cb_pgsql_php_code_from_version "$version")"
|
||
printf -v "$source_ref_name" '%s' ""
|
||
printf -v "$custom_ref_name" '%s' ""
|
||
|
||
cb_pgsql_build_file_candidates "$cb_dir" "$mode" "$code" candidates
|
||
|
||
for candidate in "${candidates[@]}"; do
|
||
if [[ -f "$candidate" ]]; then
|
||
printf -v "$source_ref_name" '%s' "$candidate"
|
||
printf -v "$custom_ref_name" '%s' "$(printf '%s\n' "$candidate" | sed "s#^${cb_dir}/configure/#${cb_dir}/custom/#")"
|
||
return 0
|
||
fi
|
||
done
|
||
|
||
for candidate in "${candidates[@]}"; do
|
||
candidate="$(printf '%s\n' "$candidate" | sed "s#^${cb_dir}/configure/#${cb_dir}/custom/#")"
|
||
if [[ -f "$candidate" ]]; then
|
||
printf -v "$source_ref_name" '%s' "$candidate"
|
||
printf -v "$custom_ref_name" '%s' "$candidate"
|
||
return 0
|
||
fi
|
||
done
|
||
|
||
return 1
|
||
}
|
||
|
||
cb_pgsql_insert_flags() {
|
||
local config_file="$1"
|
||
local pg_prefix="$2"
|
||
local tmp_file="${config_file}.tmp"
|
||
|
||
sed -i '/--with-pgsql=/d; /--with-pdo-pgsql=/d' "$config_file"
|
||
|
||
if grep -q -- '--with-pdo-mysql' "$config_file"; then
|
||
awk -v prefix="$pg_prefix" '
|
||
/--with-pdo-mysql/ {
|
||
print
|
||
print "\t--with-pgsql=" prefix " \\"
|
||
print "\t--with-pdo-pgsql=" prefix " \\"
|
||
next
|
||
}
|
||
{ print }
|
||
' "$config_file" > "$tmp_file"
|
||
else
|
||
awk -v prefix="$pg_prefix" '
|
||
/^[[:space:]]*--with/ { last = NR }
|
||
{ lines[NR] = $0 }
|
||
END {
|
||
if (last == 0) {
|
||
for (i = 1; i <= NR; i++) print lines[i]
|
||
exit
|
||
}
|
||
for (i = 1; i <= NR; i++) {
|
||
print lines[i]
|
||
if (i == last) {
|
||
print "\t--with-pgsql=" prefix " \\"
|
||
print "\t--with-pdo-pgsql=" prefix " \\"
|
||
}
|
||
}
|
||
}
|
||
' "$config_file" > "$tmp_file"
|
||
fi
|
||
|
||
mv "$tmp_file" "$config_file"
|
||
}
|
||
|
||
cb_pgsql_prepare_custom_config() {
|
||
local cb_dir="$1"
|
||
local version="$2"
|
||
local mode="$3"
|
||
local pg_prefix="$4"
|
||
local source_conf=""
|
||
local custom_conf=""
|
||
local ts=""
|
||
|
||
if ! cb_pgsql_resolve_config_paths "$cb_dir" "$version" "$mode" source_conf custom_conf; then
|
||
warn "Nie znaleziono configure dla PHP ${version} (tryb ${mode}, webserver ${CB_PHP_WEBSERVER})."
|
||
return 1
|
||
fi
|
||
|
||
mkdir -p "$(dirname "$custom_conf")"
|
||
ts="$(date +%s)"
|
||
|
||
if [[ "$source_conf" != "$custom_conf" && ! -f "$custom_conf" ]]; then
|
||
cp -p "$source_conf" "$custom_conf"
|
||
elif [[ -f "$custom_conf" ]]; then
|
||
cp -p "$custom_conf" "${custom_conf}.bak.${ts}"
|
||
fi
|
||
|
||
cb_pgsql_insert_flags "$custom_conf" "$pg_prefix"
|
||
chmod +x "$custom_conf" || true
|
||
info "Przygotowano configure dla PHP ${version}: ${custom_conf}"
|
||
return 0
|
||
}
|
||
|
||
cb_pgsql_configure_runtime_libpq() {
|
||
local pg_prefix="$1"
|
||
local pg_libdir="${pg_prefix}/lib"
|
||
local libpq_so="${pg_libdir}/libpq.so.5"
|
||
local ld_conf="/etc/ld.so.conf.d/00-da-postgresql-libpq.conf"
|
||
local old_ld_conf="/etc/ld.so.conf.d/da-postgresql-libpq.conf"
|
||
local preferred=""
|
||
|
||
[[ -d "$pg_libdir" ]] || die "Nie znaleziono katalogu bibliotek PostgreSQL: ${pg_libdir}"
|
||
[[ -r "$libpq_so" ]] || die "Nie znaleziono biblioteki libpq: ${libpq_so}"
|
||
|
||
printf '%s\n' "$pg_libdir" > "$ld_conf"
|
||
chmod 644 "$ld_conf"
|
||
[[ "$old_ld_conf" == "$ld_conf" ]] || rm -f "$old_ld_conf"
|
||
|
||
if command -v ldconfig >/dev/null 2>&1; then
|
||
ldconfig || die "Nie udało się odświeżyć cache bibliotek przez ldconfig."
|
||
preferred="$(ldconfig -p 2>/dev/null | awk '/libpq\.so\.5/{print $NF; exit}')"
|
||
if [[ -n "$preferred" && "$preferred" != "$libpq_so" ]]; then
|
||
warn "Domyślna libpq to ${preferred}; wymuszę właściwą bibliotekę przez LD_PRELOAD podczas kompilacji PHP."
|
||
fi
|
||
else
|
||
warn "Brak ldconfig. Kontynuuję z LD_LIBRARY_PATH."
|
||
fi
|
||
|
||
DA_PG_RUNTIME_LIBDIR="$pg_libdir"
|
||
DA_PG_RUNTIME_LIBPQ="$libpq_so"
|
||
info "Skonfigurowano bibliotekę runtime PostgreSQL: ${pg_libdir}"
|
||
}
|
||
|
||
cb_pgsql_find_php_bin_for_version() {
|
||
local version="$1"
|
||
local code=""
|
||
local candidate=""
|
||
|
||
code="$(cb_pgsql_php_code_from_version "$version")"
|
||
for candidate in \
|
||
"/usr/local/php${code}/bin/php" \
|
||
"/usr/local/php${code}/bin/lsphp" \
|
||
"/usr/local/lsphp${code}/bin/lsphp" \
|
||
"/usr/local/php${code}/bin/php-cgi"; do
|
||
if [[ -x "$candidate" ]]; then
|
||
printf '%s\n' "$candidate"
|
||
return 0
|
||
fi
|
||
done
|
||
return 1
|
||
}
|
||
|
||
cb_pgsql_probe_php_extensions() {
|
||
local php_bin="$1"
|
||
local pgsql_ref_name="$2"
|
||
local pdo_ref_name="$3"
|
||
local modules=""
|
||
local modules_lc=""
|
||
local probe_pgsql_status="NIE"
|
||
local probe_pdo_status="NIE"
|
||
|
||
modules="$("$php_bin" -m 2>/dev/null || true)"
|
||
if [[ -z "$modules" ]]; then
|
||
probe_pgsql_status="BŁĄD"
|
||
probe_pdo_status="BŁĄD"
|
||
printf -v "$pgsql_ref_name" '%s' "$probe_pgsql_status"
|
||
printf -v "$pdo_ref_name" '%s' "$probe_pdo_status"
|
||
return 1
|
||
fi
|
||
|
||
modules_lc="$(printf '%s\n' "$modules" | tr '[:upper:]' '[:lower:]')"
|
||
if printf '%s\n' "$modules_lc" | grep -qx 'pgsql'; then
|
||
probe_pgsql_status="OK"
|
||
fi
|
||
if printf '%s\n' "$modules_lc" | grep -qx 'pdo_pgsql'; then
|
||
probe_pdo_status="OK"
|
||
fi
|
||
|
||
printf -v "$pgsql_ref_name" '%s' "$probe_pgsql_status"
|
||
printf -v "$pdo_ref_name" '%s' "$probe_pdo_status"
|
||
return 0
|
||
}
|
||
|
||
cb_pgsql_render_extensions_table() {
|
||
local found=0
|
||
local idx=""
|
||
local version=""
|
||
local php_bin=""
|
||
local pgsql_status=""
|
||
local pdo_pgsql_status=""
|
||
|
||
echo "+------------+-------+-----------+"
|
||
printf "| %-10s | %-5s | %-9s |\n" "Wersja PHP" "PGSQL" "PDO_PGSQL"
|
||
echo "+------------+-------+-----------+"
|
||
|
||
for idx in "${!CB_PHP_VERSIONS[@]}"; do
|
||
version="${CB_PHP_VERSIONS[$idx]}"
|
||
php_bin="$(cb_pgsql_find_php_bin_for_version "$version" || true)"
|
||
if [[ -z "$php_bin" ]]; then
|
||
printf "| %-10s | %-5s | %-9s |\n" "PHP ${version}" "BRAK" "BRAK"
|
||
found=1
|
||
continue
|
||
fi
|
||
|
||
cb_pgsql_probe_php_extensions "$php_bin" pgsql_status pdo_pgsql_status >/dev/null 2>&1 || true
|
||
printf "| %-10s | %-5s | %-9s |\n" "PHP ${version}" "$pgsql_status" "$pdo_pgsql_status"
|
||
found=1
|
||
done
|
||
|
||
if [[ $found -eq 1 ]]; then
|
||
echo "+------------+-------+-----------+"
|
||
else
|
||
warn "Nie znaleziono wersji PHP do raportu."
|
||
fi
|
||
}
|
||
|
||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
||
POSTGRES_BACKUP_SRC="${SCRIPT_DIR}/postgres_backup.sh"
|
||
POSTGRES_BACKUP_DST="/opt/postgres_backup"
|
||
POSTGRES_BACKUP_CRON_LINE="0 2 * * * /opt/postgres_backup >/dev/null 2>&1"
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Wymagany root
|
||
# ---------------------------------------------------------------------------
|
||
[[ $EUID -eq 0 ]] || die "Skrypt musi być uruchomiony jako root."
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Plik logu – terminal: kolorowy output / plik: czysty tekst (bez ANSI)
|
||
# ---------------------------------------------------------------------------
|
||
LOGFILE="/var/log/postgresql_install_$(date +%Y%m%d_%H%M%S).log"
|
||
exec 1> >(tee >(sed 's/\x1b\[[0-9;]*[a-zA-Z]//g' >> "$LOGFILE")) 2>&1
|
||
info "Pełny log zapisany w: $LOGFILE"
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Wykrywanie systemu operacyjnego
|
||
# ---------------------------------------------------------------------------
|
||
sekcja "Wykrywanie systemu operacyjnego"
|
||
|
||
[[ -f /etc/os-release ]] || die "Nie można wykryć systemu: brak pliku /etc/os-release."
|
||
source /etc/os-release
|
||
|
||
OS_ID="${ID:-}"
|
||
OS_MAJOR="${VERSION_ID%%.*}"
|
||
|
||
case "$OS_ID" in
|
||
almalinux) OS_LABEL="AlmaLinux ${VERSION_ID}" ;;
|
||
cloudlinux) OS_LABEL="CloudLinux ${VERSION_ID}" ;;
|
||
centos|rhel|rocky|ol)
|
||
OS_LABEL="${NAME} ${VERSION_ID}"
|
||
warn "System '${OS_LABEL}' jest kompatybilny z RHEL, ale nie jest głównym celem skryptu."
|
||
;;
|
||
*)
|
||
die "Nieobsługiwany system: ${OS_ID}. Skrypt obsługuje AlmaLinux/CloudLinux 8 i 9."
|
||
;;
|
||
esac
|
||
|
||
[[ "$OS_MAJOR" == "8" || "$OS_MAJOR" == "9" ]] \
|
||
|| die "Nieobsługiwana wersja główna ${OS_MAJOR}. Obsługiwane są tylko wersje 8 i 9."
|
||
[[ "$(uname -m)" == "x86_64" ]] || die "Obsługiwana jest tylko architektura x86_64."
|
||
|
||
info "Wykryto: ${OS_LABEL} (EL${OS_MAJOR})"
|
||
|
||
# =============================================================================
|
||
# PYTANIA INTERAKTYWNE
|
||
# =============================================================================
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# P1: Wersja PostgreSQL
|
||
# ---------------------------------------------------------------------------
|
||
sekcja "Wybór wersji PostgreSQL"
|
||
|
||
AVAILABLE_VERSIONS=(14 15 16 17 18)
|
||
|
||
echo "Dostępne wersje PostgreSQL:"
|
||
idx=1
|
||
for v in "${AVAILABLE_VERSIONS[@]}"; do
|
||
echo " [${idx}] PostgreSQL ${v}"
|
||
((idx++))
|
||
done
|
||
echo " [${idx}] Inna (podaj ręcznie numer wersji)"
|
||
echo ""
|
||
|
||
while true; do
|
||
read -rp "Wybierz opcję [1-${idx}, domyślnie 4]: " _ver
|
||
_ver="${_ver:-4}"
|
||
if [[ ! "$_ver" =~ ^[0-9]+$ ]] || (( _ver < 1 || _ver > idx )); then
|
||
warn "Podaj liczbę od 1 do ${idx}."
|
||
continue
|
||
fi
|
||
|
||
if (( _ver < idx )); then
|
||
PG_VERSION="${AVAILABLE_VERSIONS[$((_ver-1))]}"
|
||
break
|
||
fi
|
||
|
||
while true; do
|
||
read -rp "Podaj ręcznie numer wersji PostgreSQL (np. 16 lub 17): " PG_VERSION
|
||
if [[ ! "$PG_VERSION" =~ ^[0-9]+$ ]]; then
|
||
warn "Dozwolone są tylko liczby całkowite, np. 16 lub 17."
|
||
continue
|
||
fi
|
||
break
|
||
done
|
||
break
|
||
done
|
||
|
||
info "Wybrano: PostgreSQL ${PG_VERSION}"
|
||
|
||
PG_SERVICE="postgresql-${PG_VERSION}"
|
||
PG_BINDIR="/usr/pgsql-${PG_VERSION}/bin"
|
||
PG_DATADIR="/var/lib/pgsql/${PG_VERSION}/data"
|
||
PG_HBA="${PG_DATADIR}/pg_hba.conf"
|
||
PG_CONF="${PG_DATADIR}/postgresql.conf"
|
||
PG_AUTH="scram-sha-256"
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# P2: Rozszerzenia PHP
|
||
# ---------------------------------------------------------------------------
|
||
CB_DIR="/usr/local/directadmin/custombuild"
|
||
INSTALL_PHP="nie"
|
||
|
||
if [[ -x "${CB_DIR}/build" ]]; then
|
||
while true; do
|
||
read -rp "Zainstalować rozszerzenia pgsql i pdo_pgsql dla PHP? [t/n, domyślnie t]: " _php
|
||
_php="${_php:-t}"
|
||
case "${_php,,}" in
|
||
t|tak) INSTALL_PHP="tak"; break ;;
|
||
n|nie) INSTALL_PHP="nie"; break ;;
|
||
*) warn "Podaj t lub n." ;;
|
||
esac
|
||
done
|
||
else
|
||
warn "Nie znaleziono DirectAdmin CustomBuild w ${CB_DIR}/build – pomijam instalację rozszerzeń PHP."
|
||
fi
|
||
|
||
# =============================================================================
|
||
# INSTALACJA
|
||
# =============================================================================
|
||
|
||
genpasswd() { tr -dc 'A-Za-z0-9_' </dev/urandom | head -c "${1:-32}"; echo; }
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# 1. Repozytorium PGDG
|
||
# ---------------------------------------------------------------------------
|
||
sekcja "Instalacja repozytorium PGDG (EL${OS_MAJOR})"
|
||
|
||
PGDG_RPM="https://download.postgresql.org/pub/repos/yum/reporpms/EL-${OS_MAJOR}-x86_64/pgdg-redhat-repo-latest.noarch.rpm"
|
||
|
||
if rpm -q pgdg-redhat-repo &>/dev/null; then
|
||
info "Usuwam istniejące repozytorium PGDG."
|
||
dnf remove -y pgdg-redhat-repo
|
||
fi
|
||
|
||
info "Instaluję: ${PGDG_RPM}"
|
||
dnf install -y "$PGDG_RPM" \
|
||
|| die "Nie udało się zainstalować repozytorium PGDG."
|
||
|
||
dnf -qy module disable postgresql 2>/dev/null || true
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# 2. Instalacja pakietów PostgreSQL
|
||
# ---------------------------------------------------------------------------
|
||
sekcja "Instalacja pakietów PostgreSQL ${PG_VERSION}"
|
||
|
||
dnf install -y \
|
||
"postgresql${PG_VERSION}-server" \
|
||
"postgresql${PG_VERSION}-contrib" \
|
||
"postgresql${PG_VERSION}" \
|
||
|| die "Nie udało się zainstalować pakietów PostgreSQL."
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# 3. Inicjalizacja klastra
|
||
# ---------------------------------------------------------------------------
|
||
sekcja "Inicjalizacja klastra PostgreSQL"
|
||
|
||
if [[ -f "${PG_DATADIR}/PG_VERSION" ]]; then
|
||
warn "Klaster jest już zainicjalizowany w ${PG_DATADIR}. Pomijam initdb."
|
||
else
|
||
"${PG_BINDIR}/postgresql-${PG_VERSION}-setup" initdb \
|
||
|| die "Inicjalizacja klastra nie powiodła się."
|
||
fi
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# 4. Zabezpieczenie postgresql.conf
|
||
# ---------------------------------------------------------------------------
|
||
sekcja "Zabezpieczanie postgresql.conf"
|
||
|
||
cp -p "$PG_CONF" "${PG_CONF}.bak.$(date +%s)"
|
||
|
||
pg_param() {
|
||
local param="$1" value="$2"
|
||
sed -i "s|^\s*${param}\s*=.*|#&|" "$PG_CONF"
|
||
echo "${param} = ${value}" >> "$PG_CONF"
|
||
}
|
||
|
||
pg_param listen_addresses "'localhost'"
|
||
pg_param password_encryption "scram-sha-256"
|
||
pg_param max_connections 100
|
||
pg_param unix_socket_permissions 0700
|
||
pg_param log_connections on
|
||
pg_param log_disconnections on
|
||
pg_param log_hostname off
|
||
pg_param log_line_prefix "'%m [%p] %q%u@%d '"
|
||
|
||
info "postgresql.conf zaktualizowany."
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# 5. Tymczasowy pg_hba.conf (tylko trust dla postgres przez socket)
|
||
# ---------------------------------------------------------------------------
|
||
cp -p "$PG_HBA" "${PG_HBA}.orig.$(date +%s)"
|
||
|
||
cat > "$PG_HBA" <<EOF
|
||
# TYMCZASOWY – zastąpiony po ustawieniu hasła
|
||
local all postgres trust
|
||
host all all 127.0.0.1/32 reject
|
||
host all all ::1/128 reject
|
||
EOF
|
||
|
||
chown postgres:postgres "$PG_HBA"
|
||
chmod 600 "$PG_HBA"
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# 6. Uruchomienie PostgreSQL
|
||
# ---------------------------------------------------------------------------
|
||
sekcja "Uruchamianie PostgreSQL ${PG_VERSION}"
|
||
|
||
systemctl enable "${PG_SERVICE}"
|
||
systemctl start "${PG_SERVICE}" \
|
||
|| die "Nie udało się uruchomić ${PG_SERVICE}. Sprawdź: journalctl -xe"
|
||
|
||
sleep 2
|
||
systemctl is-active --quiet "${PG_SERVICE}" \
|
||
|| die "Serwis ${PG_SERVICE} nie jest aktywny po uruchomieniu."
|
||
info "Serwis ${PG_SERVICE} działa."
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# 7. Ustawienie hasła superużytkownika postgres
|
||
# ---------------------------------------------------------------------------
|
||
sekcja "Ustawianie hasła superużytkownika postgres"
|
||
|
||
POSTGRES_PASS=$(genpasswd 32)
|
||
|
||
sudo -u postgres psql -c "ALTER USER postgres WITH PASSWORD '${POSTGRES_PASS}';" \
|
||
|| die "Nie udało się ustawić hasła dla użytkownika postgres."
|
||
|
||
info "Hasło użytkownika postgres ustawione."
|
||
|
||
# Zapis poświadczeń w formacie pgpass (host:port:db:user:password)
|
||
CRED_FILE="/usr/local/directadmin/conf/postgresql.conf"
|
||
mkdir -p "$(dirname "$CRED_FILE")"
|
||
printf 'localhost:5432:*:postgres:%s\n' "$POSTGRES_PASS" > "$CRED_FILE"
|
||
chmod 600 "$CRED_FILE"
|
||
if id diradmin &>/dev/null; then
|
||
chown diradmin:diradmin "$CRED_FILE"
|
||
fi
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# 8. Finalny pg_hba.conf
|
||
# ---------------------------------------------------------------------------
|
||
cat > "$PG_HBA" <<EOF
|
||
# pg_hba.conf – zarządzany przez postgresql_install.sh
|
||
# Wygenerowano: $(date)
|
||
#
|
||
# Polityka bezpieczeństwa:
|
||
# - Uwierzytelnianie hasłem dla WSZYSTKICH połączeń (brak peer, brak trust)
|
||
# - Wyłącznie localhost (127.0.0.1/32 i ::1/128)
|
||
# - Połączenia zdalne zablokowane przez listen_addresses = 'localhost'
|
||
# - Replikacja jawnie odrzucona
|
||
#
|
||
# RODZAJ BAZA UŻYTKOWNIK ADRES METODA
|
||
|
||
local all all ${PG_AUTH}
|
||
host all all 127.0.0.1/32 ${PG_AUTH}
|
||
host all all ::1/128 ${PG_AUTH}
|
||
local replication all reject
|
||
host replication all 127.0.0.1/32 reject
|
||
host replication all ::1/128 reject
|
||
EOF
|
||
|
||
chown postgres:postgres "$PG_HBA"
|
||
chmod 600 "$PG_HBA"
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# 9. Przeładowanie konfiguracji + weryfikacja połączenia
|
||
# ---------------------------------------------------------------------------
|
||
sekcja "Przeładowanie konfiguracji PostgreSQL"
|
||
|
||
systemctl reload "${PG_SERVICE}" \
|
||
|| die "Nie udało się przeładować ${PG_SERVICE}."
|
||
info "Konfiguracja przeładowana."
|
||
|
||
sleep 1
|
||
|
||
info "Test uwierzytelniania hasłem..."
|
||
if PGPASSWORD="$POSTGRES_PASS" \
|
||
psql -U postgres -h 127.0.0.1 -p 5432 -d postgres -c "SELECT version();" &>/dev/null; then
|
||
info "Test połączenia: OK"
|
||
else
|
||
warn "Test połączenia nie powiódł się. Sprawdź pg_hba.conf i password_encryption."
|
||
fi
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# 10. Rozszerzenia PHP pgsql i pdo_pgsql przez CustomBuild
|
||
# ---------------------------------------------------------------------------
|
||
if [[ "$INSTALL_PHP" == "tak" ]]; then
|
||
sekcja "Rozszerzenia PHP pgsql i pdo_pgsql – DirectAdmin CustomBuild"
|
||
|
||
cb_pgsql_collect_php_targets "$CB_DIR"
|
||
|
||
info "Web serwer: ${CB_PHP_WEBSERVER}"
|
||
if [[ ${#CB_PHP_VERSIONS[@]} -gt 0 ]]; then
|
||
info "Wykryte wersje PHP: $(IFS=', '; echo "${CB_PHP_VERSIONS[*]}")"
|
||
else
|
||
warn "Nie wykryto wersji PHP w DirectAdmin CustomBuild."
|
||
fi
|
||
|
||
info "Instaluję postgresql${PG_VERSION}-devel..."
|
||
dnf install -y "postgresql${PG_VERSION}-devel" \
|
||
"postgresql${PG_VERSION}-libs" \
|
||
|| die "Nie udało się zainstalować postgresql${PG_VERSION}-devel/libs."
|
||
|
||
PG_PREFIX="/usr/pgsql-${PG_VERSION}"
|
||
PG_CONFIG_SRC="${PG_BINDIR}/pg_config"
|
||
PG_CONFIG_LINK="/usr/local/bin/pg_config"
|
||
|
||
if [[ -x "$PG_CONFIG_SRC" ]]; then
|
||
if [[ -e "$PG_CONFIG_LINK" && ! -L "$PG_CONFIG_LINK" ]]; then
|
||
warn "${PG_CONFIG_LINK} istnieje i nie jest dowiązaniem – pomijam symlink."
|
||
else
|
||
ln -sf "$PG_CONFIG_SRC" "$PG_CONFIG_LINK"
|
||
fi
|
||
else
|
||
die "Nie znaleziono pg_config w ${PG_CONFIG_SRC}."
|
||
fi
|
||
|
||
cb_pgsql_configure_runtime_libpq "$PG_PREFIX"
|
||
|
||
PHP_PREPARED=0
|
||
for idx in "${!CB_PHP_VERSIONS[@]}"; do
|
||
if cb_pgsql_prepare_custom_config "$CB_DIR" "${CB_PHP_VERSIONS[$idx]}" "${CB_PHP_MODES[$idx]}" "$PG_PREFIX"; then
|
||
PHP_PREPARED=1
|
||
fi
|
||
done
|
||
|
||
if [[ "$PHP_PREPARED" -eq 1 ]]; then
|
||
cd "$CB_DIR"
|
||
LD_LIBRARY_PATH="${DA_PG_RUNTIME_LIBDIR}${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}" \
|
||
LD_PRELOAD="${DA_PG_RUNTIME_LIBPQ}${LD_PRELOAD:+:${LD_PRELOAD}}" \
|
||
LIBRARY_PATH="${DA_PG_RUNTIME_LIBDIR}${LIBRARY_PATH:+:${LIBRARY_PATH}}" \
|
||
PKG_CONFIG_PATH="${DA_PG_RUNTIME_LIBDIR}/pkgconfig${PKG_CONFIG_PATH:+:${PKG_CONFIG_PATH}}" \
|
||
LDFLAGS="-L${DA_PG_RUNTIME_LIBDIR} ${LDFLAGS:-}" \
|
||
CPPFLAGS="-I${PG_PREFIX}/include ${CPPFLAGS:-}" \
|
||
./build php \
|
||
|| die "Rekompilacja PHP nie powiodła się. Sprawdź logi w ${CB_DIR}/."
|
||
./build rewrite_confs \
|
||
|| warn "rewrite_confs zakończył się błędem – sprawdź konfigurację ręcznie."
|
||
cd - > /dev/null
|
||
info "Rekompilacja PHP zakończona."
|
||
else
|
||
warn "Nie przygotowano żadnych plików configure dla PHP – pomijam rekompilację."
|
||
fi
|
||
fi
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# 11. Instalacja narzędzia backupu w /opt + cron root (02:00)
|
||
# ---------------------------------------------------------------------------
|
||
sekcja "Instalacja narzędzia backupu i konfiguracja crona"
|
||
|
||
[[ -f "$POSTGRES_BACKUP_SRC" ]] || die "Brak pliku: ${POSTGRES_BACKUP_SRC}"
|
||
|
||
cp -f "$POSTGRES_BACKUP_SRC" "$POSTGRES_BACKUP_DST"
|
||
|
||
chown root:root "$POSTGRES_BACKUP_DST"
|
||
chmod 700 "$POSTGRES_BACKUP_DST"
|
||
|
||
CURRENT_CRONTAB="$(crontab -l 2>/dev/null || true)"
|
||
if printf '%s\n' "$CURRENT_CRONTAB" | grep -Fqx "$POSTGRES_BACKUP_CRON_LINE"; then
|
||
info "Wpis cron już istnieje w crontab roota: /opt/postgres_backup"
|
||
else
|
||
TMP_CRON="$(mktemp)"
|
||
if [[ -n "$CURRENT_CRONTAB" ]]; then
|
||
printf '%s\n' "$CURRENT_CRONTAB" > "$TMP_CRON"
|
||
fi
|
||
printf '%s\n' "$POSTGRES_BACKUP_CRON_LINE" >> "$TMP_CRON"
|
||
crontab "$TMP_CRON"
|
||
rm -f "$TMP_CRON"
|
||
info "Dodano wpis do crontab roota (02:00): /opt/postgres_backup"
|
||
fi
|
||
|
||
info "Skopiowano: ${POSTGRES_BACKUP_DST}"
|
||
|
||
# =============================================================================
|
||
# PODSUMOWANIE
|
||
# =============================================================================
|
||
|
||
sekcja "Instalacja zakończona"
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Tabela rozszerzeń PHP
|
||
# ---------------------------------------------------------------------------
|
||
if [[ "$INSTALL_PHP" == "tak" ]]; then
|
||
echo -e "${BOLD}Rozszerzenia PHP:${NC}"
|
||
echo ""
|
||
cb_pgsql_collect_php_targets "$CB_DIR"
|
||
cb_pgsql_render_extensions_table
|
||
echo ""
|
||
fi
|
||
|
||
info "Pełny log: ${LOGFILE}"
|
||
echo -e "${BOLD}Podsumowanie instalacji:${NC}"
|
||
printf "Host:\t%s\n" "localhost"
|
||
printf "Login:\t%s\n" "postgres"
|
||
printf "Hasło:\t%s\n" "${POSTGRES_PASS}"
|
||
printf "Port:\t%s\n" "5432"
|
||
printf "Plik danych dostępowych:\t%s\n" "${CRED_FILE}"
|
||
echo ""
|
||
exit 0
|