Skip to content

Commit 917c093

Browse files
AndriciucAndriciuc
committed
PG-2246 - pgBackRest chapter updates (16)
Backport for #931, for PPG 16.
1 parent 621c96f commit 917c093

1 file changed

Lines changed: 42 additions & 31 deletions

File tree

‎docs/solutions/pgbackrest.md‎

Lines changed: 42 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,16 @@
11
# pgBackRest setup
22

3-
[pgBackRest :octicons-link-external-16:](https://pgbackrest.org/) is a backup tool used to perform PostgreSQL database backup, archiving, restoration, and point-in-time recovery.
3+
[pgBackRest :octicons-link-external-16:](https://pgbackrest.org/) is a tool used to perform PostgreSQL database backups, archiving, restoration, and point-in-time recovery.
44

5-
In our solution we deploy a [pgBackRest server on a dedicated host :octicons-link-external-16:](https://pgbackrest.org/user-guide-rhel.html#repo-host) and also deploy pgBackRest on the PostgreSQL servers. Them we configure PostgreSQL servers to use it for backups and archiving.
6-
7-
You also need a backup storage to store the backups. It can either be a remote storage such as AWS S3, S3-compatible storages or Azure blob storage, or a filesystem-based one.
5+
In this solution, a [pgBackRest server on a dedicated host :octicons-link-external-16:](https://pgbackrest.org/user-guide-rhel.html#repo-host) is deployed. pgBackRest is also installed and configured on the PostgreSQL servers to perform backups and manage WAL archiving.
86

97
## Preparation
108

119
Make sure to complete the [initial setup](ha-init-setup.md) steps.
1210

1311
## Install pgBackRest
1412

15-
Install pgBackRest on the following nodes: `node1`, `node2`, `node3`, `backup`
13+
Install pgBackRest on all nodes: `node1`, `node2`, `node3`, and `backup`.
1614

1715
=== ":material-debian: On Debian/Ubuntu"
1816

@@ -35,14 +33,14 @@ Do the following steps on the `backup` node.
3533
1. Create environment variables to simplify the config file creation:
3634

3735
```{.bash data-prompt="$"}
38-
$ export SRV_NAME="backup"
39-
$ export NODE1_NAME="node1"
40-
$ export NODE2_NAME="node2"
41-
$ export NODE3_NAME="node3"
42-
$ export CA_PATH="/etc/ssl/certs/pg_ha"
36+
export SRV_NAME="backup"
37+
export NODE1_NAME="node1"
38+
export NODE2_NAME="node2"
39+
export NODE3_NAME="node3"
40+
export CA_PATH="/etc/ssl/certs/pg_ha"
4341
```
4442

45-
2. Create the `pgBackRest` repository, *if necessary*
43+
2. Create the `pgBackRest` repository, *if necessary*.
4644

4745
A repository is where `pgBackRest` stores backups. In this example, the backups will be saved to `/var/lib/pgbackrest`.
4846

@@ -118,8 +116,8 @@ Do the following steps on the `backup` node.
118116
pg1-port=5432
119117
pg1-path=/var/lib/postgresql/{{pgversion}}/main
120118
pg1-host-type=tls
121-
pg1-host-cert-file=${CA_PATH}/${SRV_NAME}.crt
122-
pg1-host-key-file=${CA_PATH}/${SRV_NAME}.key
119+
pg1-host-cert-file=${CA_PATH}/${NODE1_NAME}.crt
120+
pg1-host-key-file=${CA_PATH}/${NODE1_NAME}.key
123121
pg1-host-ca-file=${CA_PATH}/ca.crt
124122
pg1-socket-path=/var/run/postgresql
125123
@@ -128,8 +126,8 @@ Do the following steps on the `backup` node.
128126
pg2-port=5432
129127
pg2-path=/var/lib/postgresql/{{pgversion}}/main
130128
pg2-host-type=tls
131-
pg2-host-cert-file=${CA_PATH}/${SRV_NAME}.crt
132-
pg2-host-key-file=${CA_PATH}/${SRV_NAME}.key
129+
pg2-host-cert-file=${CA_PATH}/${NODE2_NAME}.crt
130+
pg2-host-key-file=${CA_PATH}/${NODE2_NAME}.key
133131
pg2-host-ca-file=${CA_PATH}/ca.crt
134132
pg2-socket-path=/var/run/postgresql
135133
@@ -138,8 +136,8 @@ Do the following steps on the `backup` node.
138136
pg3-port=5432
139137
pg3-path=/var/lib/postgresql/{{pgversion}}/main
140138
pg3-host-type=tls
141-
pg3-host-cert-file=${CA_PATH}/${SRV_NAME}.crt
142-
pg3-host-key-file=${CA_PATH}/${SRV_NAME}.key
139+
pg3-host-cert-file=${CA_PATH}/${NODE3_NAME}.crt
140+
pg3-host-key-file=${CA_PATH}/${NODE3_NAME}.key
143141
pg3-host-ca-file=${CA_PATH}/ca.crt
144142
pg3-socket-path=/var/run/postgresql
145143
@@ -200,8 +198,8 @@ Do the following steps on the `backup` node.
200198
pg1-port=5432
201199
pg1-path=/var/lib/postgresql/{{pgversion}}/main
202200
pg1-host-type=tls
203-
pg1-host-cert-file=${CA_PATH}/${SRV_NAME}.crt
204-
pg1-host-key-file=${CA_PATH}/${SRV_NAME}.key
201+
pg1-host-cert-file=${CA_PATH}/${NODE1_NAME}.crt
202+
pg1-host-key-file=${CA_PATH}/${NODE1_NAME}.key
205203
pg1-host-ca-file=${CA_PATH}/ca.crt
206204
pg1-socket-path=/var/run/postgresql
207205
@@ -210,8 +208,8 @@ Do the following steps on the `backup` node.
210208
pg2-port=5432
211209
pg2-path=/var/lib/postgresql/{{pgversion}}/main
212210
pg2-host-type=tls
213-
pg2-host-cert-file=${CA_PATH}/${SRV_NAME}.crt
214-
pg2-host-key-file=${CA_PATH}/${SRV_NAME}.key
211+
pg2-host-cert-file=${CA_PATH}/${NODE2_NAME}.crt
212+
pg2-host-key-file=${CA_PATH}/${NODE2_NAME}.key
215213
pg2-host-ca-file=${CA_PATH}/ca.crt
216214
pg2-socket-path=/var/run/postgresql
217215
@@ -220,15 +218,27 @@ Do the following steps on the `backup` node.
220218
pg3-port=5432
221219
pg3-path=/var/lib/postgresql/{{pgversion}}/main
222220
pg3-host-type=tls
223-
pg3-host-cert-file=${CA_PATH}/${SRV_NAME}.crt
224-
pg3-host-key-file=${CA_PATH}/${SRV_NAME}.key
221+
pg3-host-cert-file=${CA_PATH}/${NODE3_NAME}.crt
222+
pg3-host-key-file=${CA_PATH}/${NODE3_NAME}.key
225223
pg3-host-ca-file=${CA_PATH}/ca.crt
226224
pg3-socket-path=/var/run/postgresql
227225
228226
" | sudo tee /etc/pgbackrest.conf
229227
```
230228
231-
*NOTE*: The option `backup-standby=y` above indicates the backups should be taken from a standby server. If you are operating with a primary only, or if your secondaries are not configured with `pgBackRest`, set this option to `n`.
229+
Where:
230+
231+
* `pgX-host` specifies the hostname of the PostgreSQL node
232+
* `pgX-host-port` specifies the port used by the pgBackRest server daemon on that node. The default pgBackRest server port is `8432`
233+
* `pgX-port` specifies the PostgreSQL server port (default `5432`)
234+
* `pgX-path` specifies the PostgreSQL data directory on the node
235+
236+
The `pgX` prefix is repeated for each PostgreSQL node in the cluster (for example `pg1`, `pg2`, `pg3`).
237+
238+
The numbering (`pg1`, `pg2`, `pg3`) represents individual PostgreSQL nodes defined in the cluster stanza.
239+
240+
!!! note
241+
The option `backup-standby=y` above indicates the backups should be taken from a standby server. If you are operating with a primary only, or if your secondaries are not configured with `pgBackRest`, set this option to `n`.
232242
233243
### Create the certificate files
234244
@@ -252,21 +262,21 @@ Run the following commands as a root user or with `sudo` privileges
252262
$ sudo openssl req -new -x509 -days 365 -nodes -out ${CA_PATH}/ca.crt -keyout ${CA_PATH}/ca.key -subj "/CN=root-ca"
253263
```
254264
255-
3. Create the certificate and keys for the backup server
265+
4. Create the certificate and keys for the backup server
256266
257267
```{.bash data-prompt="$"}
258268
$ sudo openssl req -new -nodes -out ${CA_PATH}/${SRV_NAME}.csr -keyout ${CA_PATH}/${SRV_NAME}.key -subj "/CN=${SRV_NAME}"
259269
```
260270
261-
4. Create the certificates and keys for each PostgreSQL node
271+
5. Create the certificates and keys for each PostgreSQL node
262272
263273
```{.bash data-prompt="$"}
264274
$ sudo openssl req -new -nodes -out ${CA_PATH}/${NODE1_NAME}.csr -keyout ${CA_PATH}/${NODE1_NAME}.key -subj "/CN=${NODE1_NAME}"
265275
$ sudo openssl req -new -nodes -out ${CA_PATH}/${NODE2_NAME}.csr -keyout ${CA_PATH}/${NODE2_NAME}.key -subj "/CN=${NODE2_NAME}"
266276
$ sudo openssl req -new -nodes -out ${CA_PATH}/${NODE3_NAME}.csr -keyout ${CA_PATH}/${NODE3_NAME}.key -subj "/CN=${NODE3_NAME}"
267277
```
268278
269-
4. Sign all certificates with the `root-ca` key
279+
6. Sign all certificates with the `root-ca` key
270280
271281
```{.bash data-prompt="$"}
272282
$ sudo openssl x509 -req -in ${CA_PATH}/${SRV_NAME}.csr -days 365 -CA ${CA_PATH}/ca.crt -CAkey ${CA_PATH}/ca.key -CAcreateserial -out ${CA_PATH}/${SRV_NAME}.crt
@@ -275,7 +285,7 @@ Run the following commands as a root user or with `sudo` privileges
275285
$ sudo openssl x509 -req -in ${CA_PATH}/${NODE3_NAME}.csr -days 365 -CA ${CA_PATH}/ca.crt -CAkey ${CA_PATH}/ca.key -CAcreateserial -out ${CA_PATH}/${NODE3_NAME}.crt
276286
```
277287
278-
5. Remove temporary files, set ownership of the remaining files to the `postgres` user, and restrict their access:
288+
7. Remove temporary files, set ownership of the remaining files to the `postgres` user, and restrict their access:
279289
280290
```{.bash data-prompt="$"}
281291
$ sudo rm -f ${CA_PATH}/*.csr
@@ -445,7 +455,7 @@ Run the following commands on `node1`, `node2`, and `node3`.
445455
WantedBy=multi-user.target
446456
```
447457
448-
8. Reload the `systemd`, the start the service
458+
8. Reload `systemd` and start the service:
449459
450460
```{.bash data-prompt="$"}
451461
$ sudo systemctl daemon-reload
@@ -511,13 +521,14 @@ Run the following commands on `node1`, `node2`, and `node3`.
511521
512522
It may take a while to reload the new configuration.
513523
514-
*NOTE*: When configuring a PostgreSQL server that is not managed by Patroni to archive/restore WALs from the `pgBackRest` server, edit the server's main configuration file directly and adjust the `archive_command` and `restore_command` variables as shown above.
524+
!!! note
525+
When configuring a PostgreSQL server that is not managed by Patroni to archive/restore WALs from the `pgBackRest` server, edit the server's main configuration file directly and adjust the `archive_command` and `restore_command` variables as shown above.
515526

516527
## Create backups
517528

518529
Run the following commands on the **backup server**:
519530

520-
1. Create the stanza. A stanza is the configuration for a PostgreSQL database cluster that defines where it is located, how it will be backed up, archiving options, etc.
531+
1. Create the stanza. A stanza is the configuration for a PostgreSQL database cluster that defines where it is located, how it will be backed up, archiving options, etc.
521532

522533
```{.bash data-prompt="$"}
523534
$ sudo -iu postgres pgbackrest --stanza=cluster_1 stanza-create

0 commit comments

Comments
 (0)