From 0ad740fa57504254028cac5de8b7950dcb7f9b79 Mon Sep 17 00:00:00 2001
From: Tom Hughes <tom@compton.nu>
Date: Fri, 3 Jul 2026 10:40:41 +0100
Subject: [PATCH] Configure pgbackrest on the dev server

---
 cookbooks/postgresql/attributes/default.rb    |  3 ++
 cookbooks/postgresql/recipes/default.rb       | 30 ++++++++++++----
 .../templates/default/pgbackrest.conf.erb     | 36 +++++++++++++++++++
 roles/dev.rb                                  | 20 ++++++++++-
 4 files changed, 82 insertions(+), 7 deletions(-)
 create mode 100644 cookbooks/postgresql/templates/default/pgbackrest.conf.erb

diff --git a/cookbooks/postgresql/attributes/default.rb b/cookbooks/postgresql/attributes/default.rb
index aa3e4b8ac..532998eea 100644
--- a/cookbooks/postgresql/attributes/default.rb
+++ b/cookbooks/postgresql/attributes/default.rb
@@ -51,3 +51,6 @@ default[:postgresql][:settings][:defaults][:user_name_maps] = {}
 default[:postgresql][:settings][:defaults][:early_authentication_rules] = []
 default[:postgresql][:settings][:defaults][:late_authentication_rules] = []
 default[:postgresql][:settings][:defaults][:standby_mode] = "off"
+default[:postgresql][:pgbackrest][:repo_type] = "posix"
+default[:postgresql][:pgbackrest][:repo_path] = "/var/lib/pgbackrest"
+default[:postgresql][:pgbackrest][:repo_retention_full] = "2"
diff --git a/cookbooks/postgresql/recipes/default.rb b/cookbooks/postgresql/recipes/default.rb
index 1281fb3df..b2d1ebf3b 100644
--- a/cookbooks/postgresql/recipes/default.rb
+++ b/cookbooks/postgresql/recipes/default.rb
@@ -20,14 +20,32 @@
 include_recipe "apt::postgresql"
 include_recipe "prometheus"
 
-package "locales-all"
-package "postgresql-common"
+package %w[
+  locales-all
+  pgbackrest
+  postgresql-common
+]
+
+if node[:postgresql][:pgbackrest][:credentials_bag]
+  pgbackrest_credentials = data_bag_item(node[:postgresql][:pgbackrest][:credentials_bag],
+                                         node[:postgresql][:pgbackrest][:credentials_item])
+end
+
+template "/etc/pgbackrest.conf" do
+  source "pgbackrest.conf.erb"
+  owner "postgres"
+  group "postgres"
+  mode "640"
+  variables :credentials => pgbackrest_credentials
+end
 
 node[:postgresql][:versions].each do |version|
-  package "postgresql-#{version}"
-  package "postgresql-client-#{version}"
-  package "postgresql-contrib-#{version}"
-  package "postgresql-server-dev-#{version}"
+  package %W[
+    postgresql-#{version}
+    postgresql-client-#{version}
+    postgresql-contrib-#{version}
+    postgresql-server-dev-#{version}
+  ]
 
   defaults = node[:postgresql][:settings][:defaults] || {}
   settings = node[:postgresql][:settings][version] || {}
diff --git a/cookbooks/postgresql/templates/default/pgbackrest.conf.erb b/cookbooks/postgresql/templates/default/pgbackrest.conf.erb
new file mode 100644
index 000000000..dbd181d48
--- /dev/null
+++ b/cookbooks/postgresql/templates/default/pgbackrest.conf.erb
@@ -0,0 +1,36 @@
+[global]
+archive-async=y
+compress-type=zst
+repo1-type=<%= node[:postgresql][:pgbackrest][:repo_type] %>
+repo1-path=<%= node[:postgresql][:pgbackrest][:repo_path] %>
+repo1-block=y
+repo1-bundle=y
+repo1-retention-full=<%= node[:postgresql][:pgbackrest][:repo_retention_full] %>
+<% if node[:postgresql][:pgbackrest][:repo_s3_bucket] -%>
+repo1-s3-bucket=<%= node[:postgresql][:pgbackrest][:repo_s3_bucket] %>
+<% end -%>
+<% if node[:postgresql][:pgbackrest][:repo_s3_endpoint] -%>
+repo1-s3-endpoint=<%= node[:postgresql][:pgbackrest][:repo_s3_endpoint] %>
+<% end -%>
+<% if node[:postgresql][:pgbackrest][:repo_s3_key] -%>
+repo1-s3-key=<%= @credentials[node[:postgresql][:pgbackrest][:repo_s3_key]] %>
+<% end -%>
+<% if node[:postgresql][:pgbackrest][:repo_s3_key_secret] -%>
+repo1-s3-key-secret=<%= @credentials[node[:postgresql][:pgbackrest][:repo_s3_key_secret]] %>
+<% end -%>
+<% if node[:postgresql][:pgbackrest][:repo_s3_region] -%>
+repo1-s3-region=<%= node[:postgresql][:pgbackrest][:repo_s3_region] %>
+<% end -%>
+
+[global:archive-get]
+process-max=2
+
+[global:archive-push]
+process-max=2
+<% node[:postgresql][:clusters].each do |name, details| -%>
+<% if details[:pgbackrest_stanza] -%>
+
+[<%= details[:pgbackrest_stanza] %>]
+pg1-path=/var/lib/postgresql/<%= name %>
+<% end -%>
+<% end -%>
diff --git a/roles/dev.rb b/roles/dev.rb
index 3f5e244c0..d3085f843 100644
--- a/roles/dev.rb
+++ b/roles/dev.rb
@@ -147,6 +147,11 @@ default_attributes(
   },
   :postgresql => {
     :versions => %w[18],
+    :clusters => {
+      "18/main" => {
+        :pgbackrest_stanza => "main"
+      }
+    },
     :settings => {
       :defaults => {
         :max_connections => "500",
@@ -158,8 +163,21 @@ default_attributes(
       },
       "18" => {
         :port => "5432",
-        :wal_level => "logical"
+        :wal_level => "logical",
+        :archive_mode => "on",
+        :archive_command => "/bin/pgbackrest --stanza=main archive-push %p"
       }
+    },
+    :pgbackrest => {
+      :credentials_bag => "dev",
+      :credentials_item => "aws",
+      :repo_type => "s3",
+      :repo_path => "/",
+      :repo_s3_bucket => "openstreetmap-wal-dev-1a05a5",
+      :repo_s3_endpoint => "s3.eu-north-1.amazonaws.com",
+      :repo_s3_key => "wal_access_key_id",
+      :repo_s3_key_secret => "wal_secret_access_key",
+      :repo_s3_region => "eu-north-1"
     }
   },
   :ruby => {
-- 
2.47.3