Skip to content

Commit 4d53b0e

Browse files
AndriciucAndriciuc
committed
PG-2246 - pgBackRest chapter updates (14)
Backport for #931, for PPG 14.
1 parent 6f484b2 commit 4d53b0e

1 file changed

Lines changed: 44 additions & 37 deletions

File tree

‎docs/solutions/pgbackrest.md‎

Lines changed: 44 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,21 @@
11
# pgBackRest setup
22

3-
[pgBackRest :octicons-link-external-16:](https://pgbackrest.org/) is a backup tool used to perform PostgreSQL database backup, archiving, restoration, and point-in-time recovery.
3+
[pgBackRest :octicons-link-external-16:](https://pgbackrest.org/) is a tool used to perform PostgreSQL database backups, archiving, restoration, and point-in-time recovery.
44

5-
In our solution we deploy a [pgBackRest server on a dedicated host :octicons-link-external-16:](https://pgbackrest.org/user-guide-rhel.html#repo-host) and also deploy pgBackRest on the PostgreSQL servers. Them we configure PostgreSQL servers to use it for backups and archiving.
6-
7-
You also need a backup storage to store the backups. It can either be a remote storage such as AWS S3, S3-compatible storages or Azure blob storage, or a filesystem-based one.
5+
In this solution, a [pgBackRest server on a dedicated host :octicons-link-external-16:](https://pgbackrest.org/user-guide-rhel.html#repo-host) is deployed. pgBackRest is also installed and configured on the PostgreSQL servers to perform backups and manage WAL archiving.
86

97
## Preparation
108

119
Make sure to complete the [initial setup](ha-init-setup.md) steps.
1210

1311
## Install pgBackRest
1412

15-
Install pgBackRest on the following nodes: `node1`, `node2`, `node3`, `backup`
13+
Install pgBackRest on all nodes: `node1`, `node2`, `node3`, and `backup`.
1614

1715
=== ":material-debian: On Debian/Ubuntu"
1816

1917
```{.bash data-prompt="$"}
20-
$ export SRV_NAME="backup"
21-
$ export NODE1_NAME="node1"
22-
$ export NODE2_NAME="node2"
23-
$ export NODE3_NAME="node3"
24-
$ export CA_PATH="/etc/ssl/certs/pg_ha"
18+
$ sudo apt install percona-pgbackrest
2519
```
2620

2721
=== ":material-redhat: On RHEL/derivatives"
@@ -39,14 +33,14 @@ Do the following steps on the `backup` node.
3933
1. Create environment variables to simplify the config file creation:
4034

4135
```{.bash data-prompt="$"}
42-
$ export SRV_NAME="backup"
43-
$ export NODE1_NAME="node1"
44-
$ export NODE2_NAME="node2"
45-
$ export NODE3_NAME="node3"
46-
$ export CA_PATH="/etc/ssl/certs/pg_ha"
36+
export SRV_NAME="backup"
37+
export NODE1_NAME="node1"
38+
export NODE2_NAME="node2"
39+
export NODE3_NAME="node3"
40+
export CA_PATH="/etc/ssl/certs/pg_ha"
4741
```
4842

49-
2. Create the `pgBackRest` repository, *if necessary*
43+
2. Create the `pgBackRest` repository, *if necessary*.
5044

5145
A repository is where `pgBackRest` stores backups. In this example, the backups will be saved to `/var/lib/pgbackrest`.
5246

@@ -122,8 +116,8 @@ Do the following steps on the `backup` node.
122116
pg1-port=5432
123117
pg1-path=/var/lib/postgresql/{{pgversion}}/main
124118
pg1-host-type=tls
125-
pg1-host-cert-file=${CA_PATH}/${SRV_NAME}.crt
126-
pg1-host-key-file=${CA_PATH}/${SRV_NAME}.key
119+
pg1-host-cert-file=${CA_PATH}/${NODE1_NAME}.crt
120+
pg1-host-key-file=${CA_PATH}/${NODE1_NAME}.key
127121
pg1-host-ca-file=${CA_PATH}/ca.crt
128122
pg1-socket-path=/var/run/postgresql
129123
@@ -132,8 +126,8 @@ Do the following steps on the `backup` node.
132126
pg2-port=5432
133127
pg2-path=/var/lib/postgresql/{{pgversion}}/main
134128
pg2-host-type=tls
135-
pg2-host-cert-file=${CA_PATH}/${SRV_NAME}.crt
136-
pg2-host-key-file=${CA_PATH}/${SRV_NAME}.key
129+
pg2-host-cert-file=${CA_PATH}/${NODE2_NAME}.crt
130+
pg2-host-key-file=${CA_PATH}/${NODE2_NAME}.key
137131
pg2-host-ca-file=${CA_PATH}/ca.crt
138132
pg2-socket-path=/var/run/postgresql
139133
@@ -142,8 +136,8 @@ Do the following steps on the `backup` node.
142136
pg3-port=5432
143137
pg3-path=/var/lib/postgresql/{{pgversion}}/main
144138
pg3-host-type=tls
145-
pg3-host-cert-file=${CA_PATH}/${SRV_NAME}.crt
146-
pg3-host-key-file=${CA_PATH}/${SRV_NAME}.key
139+
pg3-host-cert-file=${CA_PATH}/${NODE3_NAME}.crt
140+
pg3-host-key-file=${CA_PATH}/${NODE3_NAME}.key
147141
pg3-host-ca-file=${CA_PATH}/ca.crt
148142
pg3-socket-path=/var/run/postgresql
149143
@@ -204,8 +198,8 @@ Do the following steps on the `backup` node.
204198
pg1-port=5432
205199
pg1-path=/var/lib/postgresql/{{pgversion}}/main
206200
pg1-host-type=tls
207-
pg1-host-cert-file=${CA_PATH}/${SRV_NAME}.crt
208-
pg1-host-key-file=${CA_PATH}/${SRV_NAME}.key
201+
pg1-host-cert-file=${CA_PATH}/${NODE1_NAME}.crt
202+
pg1-host-key-file=${CA_PATH}/${NODE1_NAME}.key
209203
pg1-host-ca-file=${CA_PATH}/ca.crt
210204
pg1-socket-path=/var/run/postgresql
211205
@@ -214,8 +208,8 @@ Do the following steps on the `backup` node.
214208
pg2-port=5432
215209
pg2-path=/var/lib/postgresql/{{pgversion}}/main
216210
pg2-host-type=tls
217-
pg2-host-cert-file=${CA_PATH}/${SRV_NAME}.crt
218-
pg2-host-key-file=${CA_PATH}/${SRV_NAME}.key
211+
pg2-host-cert-file=${CA_PATH}/${NODE2_NAME}.crt
212+
pg2-host-key-file=${CA_PATH}/${NODE2_NAME}.key
219213
pg2-host-ca-file=${CA_PATH}/ca.crt
220214
pg2-socket-path=/var/run/postgresql
221215
@@ -224,15 +218,27 @@ Do the following steps on the `backup` node.
224218
pg3-port=5432
225219
pg3-path=/var/lib/postgresql/{{pgversion}}/main
226220
pg3-host-type=tls
227-
pg3-host-cert-file=${CA_PATH}/${SRV_NAME}.crt
228-
pg3-host-key-file=${CA_PATH}/${SRV_NAME}.key
221+
pg3-host-cert-file=${CA_PATH}/${NODE3_NAME}.crt
222+
pg3-host-key-file=${CA_PATH}/${NODE3_NAME}.key
229223
pg3-host-ca-file=${CA_PATH}/ca.crt
230224
pg3-socket-path=/var/run/postgresql
231225
232226
" | sudo tee /etc/pgbackrest.conf
233227
```
234228
235-
*NOTE*: The option `backup-standby=y` above indicates the backups should be taken from a standby server. If you are operating with a primary only, or if your secondaries are not configured with `pgBackRest`, set this option to `n`.
229+
Where:
230+
231+
* `pgX-host` specifies the hostname of the PostgreSQL node
232+
* `pgX-host-port` specifies the port used by the pgBackRest server daemon on that node. The default pgBackRest server port is `8432`
233+
* `pgX-port` specifies the PostgreSQL server port (default `5432`)
234+
* `pgX-path` specifies the PostgreSQL data directory on the node
235+
236+
The `pgX` prefix is repeated for each PostgreSQL node in the cluster (for example `pg1`, `pg2`, `pg3`).
237+
238+
The numbering (`pg1`, `pg2`, `pg3`) represents individual PostgreSQL nodes defined in the cluster stanza.
239+
240+
!!! note
241+
The option `backup-standby=y` above indicates the backups should be taken from a standby server. If you are operating with a primary only, or if your secondaries are not configured with `pgBackRest`, set this option to `n`.
236242
237243
### Create the certificate files
238244
@@ -256,21 +262,21 @@ Run the following commands as a root user or with `sudo` privileges
256262
$ sudo openssl req -new -x509 -days 365 -nodes -out ${CA_PATH}/ca.crt -keyout ${CA_PATH}/ca.key -subj "/CN=root-ca"
257263
```
258264
259-
3. Create the certificate and keys for the backup server
265+
4. Create the certificate and keys for the backup server
260266
261267
```{.bash data-prompt="$"}
262268
$ sudo openssl req -new -nodes -out ${CA_PATH}/${SRV_NAME}.csr -keyout ${CA_PATH}/${SRV_NAME}.key -subj "/CN=${SRV_NAME}"
263269
```
264270
265-
4. Create the certificates and keys for each PostgreSQL node
271+
5. Create the certificates and keys for each PostgreSQL node
266272
267273
```{.bash data-prompt="$"}
268274
$ sudo openssl req -new -nodes -out ${CA_PATH}/${NODE1_NAME}.csr -keyout ${CA_PATH}/${NODE1_NAME}.key -subj "/CN=${NODE1_NAME}"
269275
$ sudo openssl req -new -nodes -out ${CA_PATH}/${NODE2_NAME}.csr -keyout ${CA_PATH}/${NODE2_NAME}.key -subj "/CN=${NODE2_NAME}"
270276
$ sudo openssl req -new -nodes -out ${CA_PATH}/${NODE3_NAME}.csr -keyout ${CA_PATH}/${NODE3_NAME}.key -subj "/CN=${NODE3_NAME}"
271277
```
272278
273-
4. Sign all certificates with the `root-ca` key
279+
6. Sign all certificates with the `root-ca` key
274280
275281
```{.bash data-prompt="$"}
276282
$ sudo openssl x509 -req -in ${CA_PATH}/${SRV_NAME}.csr -days 365 -CA ${CA_PATH}/ca.crt -CAkey ${CA_PATH}/ca.key -CAcreateserial -out ${CA_PATH}/${SRV_NAME}.crt
@@ -279,7 +285,7 @@ Run the following commands as a root user or with `sudo` privileges
279285
$ sudo openssl x509 -req -in ${CA_PATH}/${NODE3_NAME}.csr -days 365 -CA ${CA_PATH}/ca.crt -CAkey ${CA_PATH}/ca.key -CAcreateserial -out ${CA_PATH}/${NODE3_NAME}.crt
280286
```
281287
282-
5. Remove temporary files, set ownership of the remaining files to the `postgres` user, and restrict their access:
288+
7. Remove temporary files, set ownership of the remaining files to the `postgres` user, and restrict their access:
283289
284290
```{.bash data-prompt="$"}
285291
$ sudo rm -f ${CA_PATH}/*.csr
@@ -359,7 +365,7 @@ Run the following commands on `node1`, `node2`, and `node3`.
359365
```{.bash data-prompt="$"}
360366
$ sudo scp ${SRV_NAME}:${CA_PATH}/{$NODE_NAME.crt,$NODE_NAME.key,ca.crt} ${CA_PATH}/
361367
$ sudo chown postgres:postgres -R ${CA_PATH}
362-
$ sudo chmod 0600 ${CA_PATH}/*
368+
$ sudo chmod 0600 ${CA_PATH}/*
363369
```
364370
365371
5. Make a copy of the configuration file. The path to it can be either `/etc/pgbackrest/pgbackrest.conf` or `/etc/pgbackrest.conf`:
@@ -449,7 +455,7 @@ Run the following commands on `node1`, `node2`, and `node3`.
449455
WantedBy=multi-user.target
450456
```
451457
452-
8. Reload the `systemd`, the start the service
458+
8. Reload `systemd` and start the service:
453459
454460
```{.bash data-prompt="$"}
455461
$ sudo systemctl daemon-reload
@@ -515,13 +521,14 @@ Run the following commands on `node1`, `node2`, and `node3`.
515521
516522
It may take a while to reload the new configuration.
517523
518-
*NOTE*: When configuring a PostgreSQL server that is not managed by Patroni to archive/restore WALs from the `pgBackRest` server, edit the server's main configuration file directly and adjust the `archive_command` and `restore_command` variables as shown above.
524+
!!! note
525+
When configuring a PostgreSQL server that is not managed by Patroni to archive/restore WALs from the `pgBackRest` server, edit the server's main configuration file directly and adjust the `archive_command` and `restore_command` variables as shown above.
519526

520527
## Create backups
521528

522529
Run the following commands on the **backup server**:
523530

524-
1. Create the stanza. A stanza is the configuration for a PostgreSQL database cluster that defines where it is located, how it will be backed up, archiving options, etc.
531+
1. Create the stanza. A stanza is the configuration for a PostgreSQL database cluster that defines where it is located, how it will be backed up, archiving options, etc.
525532

526533
```{.bash data-prompt="$"}
527534
$ sudo -iu postgres pgbackrest --stanza=cluster_1 stanza-create

0 commit comments

Comments
 (0)