PostgreSQL

Linux · Apps and databases

Replaces TLS files for the selected PostgreSQL instance and checks its local certificate.

What happens

The service agent on the server fetches the task from the appliance over outbound HTTPS, port 443.
Finds PostgreSQL instances and their configured TLS files. You select the instance; relative file paths start at its data directory.
Validates the certificate and key, saves the previous files and installs with the service owner and a protected key. Only the selected instance reloads; PostgreSQL 9.6 restarts. If it fails: A broken file switch triggers an attempt to restore the previous files and check local identity. If the old certificate still serves, the run reports failure without an unnecessary restore.
Verification: PostgreSQL TLS negotiation on loopback compares the served certificate with the new file. Unproved local activation is reported with a warning.

Connection: The package runs through the service agent on the server. The agent connects over outbound HTTPS to the appliance, port 443 by default. You open no port into the server.
Service ports: 5432
You need: The service agent installed on the server. Python 3.6 or newer, OpenSSL and PostgreSQL service tools on the server. The account must be root or the service owner and able to write TLS files and activate the selected instance.
Actions: Discovery, Installation, Verification, Rollback
Packages: postgresql-ssh 1.3.0
Note: Discovery reads the configuration the running PostgreSQL was started with (data directory and config_file, else the systemd unit), with includes and postgresql.auto.conf, as PostgreSQL reads them; relative paths are read from the data directory. When the account cannot read the data directory, discovery warns that ALTER SYSTEM settings were not seen. Deploy and rollback also accept files outside the standard folders when the live configuration uses exactly that pair.
Discovery uses readable configuration files and can flag external file writers, but its inventory is incomplete. CA, CRL and client access settings stay unchanged.
The local check observes certificate identity; it does not validate CA trust or hostname. Instance, service and loopback port can be supplied when automatic selection does not fit.