GitLab āĻĄāĻžāϟāĻžāĻŦ⧇āϏ⧇āϰ āĻŦāĻšāĻŋāϰāĻžāĻ—āϤ PostgreSQL-āĻ āĻ¸ā§āĻĨāĻžāύāĻžāĻ¨ā§āϤāϰ

āĻšā§āϝāĻžāϞ⧋ āϏāĻŦāĻžāχ!

āĻāχ āύāĻŋāĻŦāĻ¨ā§āϧ⧇, āφāĻŽāϰāĻž GitLab āĻĄāĻžāϟāĻžāĻŦ⧇āϏāϕ⧇ āĻ…āĻ­ā§āϝāĻ¨ā§āϤāϰ⧀āĻŖ PostgreSQL āĻĨ⧇āϕ⧇ āĻ¸ā§āĻĨāĻžāύāĻžāĻ¨ā§āϤāϰ āĻ•āϰāĻŦ, āϝāĻž GitLab-āĻāϰ āϏāĻžāĻĨ⧇ āχāύāĻ¸ā§āϟāϞ āĻ•āϰāĻž āφāϛ⧇, āĻŦāĻšāĻŋāϰāĻžāĻ—āϤ PostgreSQL-āĻ āϝāĻž āχāϤāĻŋāĻŽāĻ§ā§āϝ⧇āχ āĻ…āĻ¨ā§āϝ āϏāĻžāĻ°ā§āĻ­āĻžāϰ⧇ āχāύāĻ¸ā§āϟāϞ āĻ•āϰāĻž āφāϛ⧇āĨ¤

GitLab āĻĄāĻžāϟāĻžāĻŦ⧇āϏ⧇āϰ āĻŦāĻšāĻŋāϰāĻžāĻ—āϤ PostgreSQL-āĻ āĻ¸ā§āĻĨāĻžāύāĻžāĻ¨ā§āϤāϰ

āωāĻ˛ā§āϞ⧇āĻ–ā§āϝ
āϏāĻŽāĻ¸ā§āϤ āĻĒāĻĻāĻ•ā§āώ⧇āĻĒ āĻ•āĻžāĻ°ā§āϝāĻ•āϰ āĻšāĻ“āϝāĻŧāĻžāϰ āύāĻŋāĻļā§āϚāϝāĻŧāϤāĻž āĻĻ⧇āĻ“āϝāĻŧāĻž āĻšāϝāĻŧ CentOS ā§­.ā§­.⧧⧝ā§Ļā§Ž, āĻĒā§‹āĻ¸ā§āϟāĻ—ā§āϰ⧇āϏāĻ•āĻŋāωāĻāϞ ⧧⧍ āĻāĻŦāĻ‚ āĻ—āĻŋāϟāĻ˛ā§āϝāĻžāĻŦ ⧧⧍.ā§Ē.⧍-āχāχ.ā§ĻāĨ¤

āĻĒā§āϰāĻžāĻĨāĻŽāĻŋāĻ• āĻĒā§āϰāĻ¸ā§āϤ⧁āϤāĻŋ

āφāϏ⧁āύ āφāϗ⧇ āĻĨ⧇āϕ⧇ āϤāĻŋāύāϟāĻŋ āϜāĻŋāύāĻŋāϏ āĻ•āϰāĻŋ:

1āĨ¤ āωāĻĒāϰ āϏāĻžāĻ°ā§āĻ­āĻžāϰ PostgreSQL āĻĢāĻžāϝāĻŧāĻžāϰāĻ“āϝāĻŧāĻžāϞ⧇ āĻāĻ•āϟāĻŋ āύāĻŋāϝāĻŧāĻŽ āϝ⧋āĻ— āĻ•āϰ⧁āύ āϝāĻž PostgreSQL āĻĒā§‹āĻ°ā§āϟ 5432/TCP-āϤ⧇ āχāύāĻ•āĻžāĻŽāĻŋāĻ‚ āϏāĻ‚āϝ⧋āĻ—āϗ⧁āϞāĻŋāϕ⧇ āĻ…āύ⧁āĻŽāϤāĻŋ āĻĻ⧇āϝāĻŧāĨ¤

āφāĻŽāĻžāϰ āĻ•ā§āώ⧇āĻ¤ā§āϰ⧇:

firewall-cmd --add-service=postgresql --zone=internal --permanent
success
firewall-cmd --reload
success

2. āĻāĻ•āχ āϜāĻžāϝāĻŧāĻ—āĻžāϝāĻŧ, āĻ•āĻŋāĻ¨ā§āϤ⧁ postgresql.conf āĻĢāĻžāχāϞ⧇, āύ⧇āϟāĻ“āϝāĻŧāĻžāĻ°ā§āĻ• āχāĻ¨ā§āϟāĻžāϰāĻĢ⧇āϏāϕ⧇ āĻŦāĻžāχāϰ⧇ āĻĨ⧇āϕ⧇ āφāĻ—āϤ āϏāĻ‚āϝ⧋āĻ— āĻ—ā§āϰāĻšāĻŖ āĻ•āϰāĻžāϰ āĻ…āύ⧁āĻŽāϤāĻŋ āĻĻāĻŋāύāĨ¤ postgresql.conf āĻĢāĻžāχāϞāϟāĻŋ āϖ⧁āϞ⧁āύ, āĻŽāĻ¨ā§āϤāĻŦā§āϝ āĻ•āϰāĻž āϞāĻžāχāύāϟāĻŋ āϖ⧁āρāϜ⧁āύ "#listen_addresses = 'āĻ¸ā§āĻĨāĻžāύ⧀āϝāĻŧ āĻšā§‹āĻ¸ā§āϟ'" āĻāĻŦāĻ‚ āĻāϰ āύ⧀āĻšā§‡ āύ⧀āĻšā§‡āϰ āĻŽāϤ āĻāĻ•āϟāĻŋ āϞāĻžāχāύ āϝ⧋āĻ— āĻ•āϰ⧁āύāĨ¤ āϝ⧇āĻ–āĻžāύ⧇ - 10.0.0.2, āφāĻĒāύāĻžāϰ āχāĻ¨ā§āϟāĻžāϰāĻĢ⧇āϏ⧇āϰ āĻ āĻŋāĻ•āĻžāύāĻžāĨ¤

āφāĻŽāĻžāϰ āĻ•ā§āώ⧇āĻ¤ā§āϰ⧇:

vi /var/lib/pgsql/12/data/postgresql.conf
# - Connection Settings -

#listen_addresses = 'localhost'         # what IP address(es) to listen on;
listen_addresses = 'localhost, 10.0.0.2'
                                        # comma-separated list of addresses;

ā§Š. āϝ⧇āĻšā§‡āϤ⧁ āĻ—āĻŋāϟāĻ˛ā§āϝāĻžāĻŦ āϏāĻžāĻ°ā§āĻ­āĻžāϰāϟāĻŋ āĻāĻ•āϟāĻŋ āĻŦāĻšāĻŋāϰāĻžāĻ—āϤ āĻĄāĻžāϟāĻžāĻŦ⧇āϏ⧇āϰ āϏāĻžāĻĨ⧇ āϏāĻ‚āϝ⧁āĻ•ā§āϤ āĻšāĻŦ⧇, āϤāĻžāχ āϏāĻžāĻ°ā§āĻ­āĻžāϰ pg_hba.conf āĻĢāĻžāχāϞ⧇ PostgreSQL āϏāĻ•ā§āϰāĻŋāϝāĻŧ āĻ•āϰāϤ⧇ āĻšāĻŦ⧇āĨ¤ āφāĻŽāĻžāϰ GitLab āϏāĻžāĻ°ā§āĻ­āĻžāϰ āĻ āĻŋāĻ•āĻžāύāĻž āĻšāϞ 10.0.0.4āĨ¤

pg_hba.conf āĻĢāĻžāχāϞāϟāĻŋ āϖ⧁āϞ⧁āύ āĻāĻŦāĻ‚ āϏ⧇āĻ–āĻžāύ⧇ āϞāĻžāχāύ āϝ⧋āĻ— āĻ•āϰ⧁āύ:

host    all             gitlab               10.0.0.4/24             md5

āĻāϟāĻŋ āĻāχ āĻŽāϤ āĻĻ⧇āĻ–āĻžāĻŦ⧇:

# TYPE  DATABASE        USER            ADDRESS                 METHOD

# "local" is for Unix domain socket connections only
local   all             postgres                                     md5

# IPv4 local connections:
host    all             postgres             127.0.0.1/32            md5
host    all             gitlab               10.0.0.4/24             md5

āĻāĻŦāĻ‚ āĻ…āĻŦāĻļ⧇āώ⧇, āφāĻŽāϰāĻž postgresql āĻĒāϰāĻŋāώ⧇āĻŦāĻž āĻĒ⧁āύāϰāĻžāϝāĻŧ āϚāĻžāϞ⧁ āĻ•āϰāĻŋ:

systemctl restart postgresql-12.service

āĻāĻ•āϟāĻŋ GitLab āĻĄāĻžāϟāĻžāĻŦ⧇āϏ āϰāĻĒā§āϤāĻžāύāĻŋ āĻ•āϰāĻž āĻšāĻšā§āϛ⧇

āĻ—āĻŋāϟāĻ˛ā§āϝāĻžāĻŦ āϏāĻžāĻ°ā§āĻ­āĻžāϰ⧇ āĻāĻ•āϟāĻŋ āĻĄāĻžāϟāĻžāĻŦ⧇āϏ āĻŦā§āϝāĻžāĻ•āφāĻĒ āĻ•āϰāĻž āϝāĻžāĻ•:

sudo -u gitlab-psql /opt/gitlab/embedded/bin/pg_dumpall -U gitlab-psql --host=/var/opt/gitlab/postgresql > /tmp/internal-gitlab.sql

āĻŦā§āϝāĻžāĻ•āφāĻĒāϟāĻŋ /tmp āĻ āωāĻĒāĻ¸ā§āĻĨāĻŋāϤ āĻšāϝāĻŧ⧇āĻ›āĻŋāϞ:

ls -lh
total 836K
-rw-r--r--. 1 root root 836K Nov 18 12:59 internal-gitlab.sql

āφāϏ⧁āύ āĻāχ āĻ…āύ⧁āϞāĻŋāĻĒāĻŋāϟāĻŋ PostgreSQL āϏāĻžāĻ°ā§āĻ­āĻžāϰ⧇ āĻ…āύ⧁āϞāĻŋāĻĒāĻŋ āĻ•āϰāĻŋ:

scp /tmp/internal-gitlab.sql 10.0.0.2:/tmp/
internal-gitlab.sql                                                                               100%  835KB  50.0MB/s   00:00

PostgreSQL āĻ "internal-gitlab.sql" āφāĻŽāĻĻāĻžāύāĻŋ āĻ•āϰāĻž āĻšāĻšā§āϛ⧇

PostgreSQL āĻ āĻĄāĻžāϟāĻžāĻŦ⧇āϏ āφāĻŽāĻĻāĻžāύāĻŋ āĻ•āϰ⧁āύ:

sudo -u postgres psql -f /tmp/internal-gitlab.sql

āĻĒāϰ⧀āĻ•ā§āώāĻž āĻ•āϰ⧁āύ āϝ⧇ āĻĄāĻžāϟāĻžāĻŦ⧇āϏ āĻāĻ–āύ PostgreSQL āĻ āφāϛ⧇:

sudo -u postgres psql -l

āύāĻŋāĻŽā§āύāϞāĻŋāĻ–āĻŋāϤ āϞāĻžāχāύ āωāĻĒāĻ¸ā§āĻĨāĻŋāϤ āĻšāĻ“āϝāĻŧāĻž āωāϚāĻŋāϤ:

gitlabhq_production | gitlab   | UTF8     | en_US.UTF-8 | en_US.UTF-8 |

āĻ—āĻŋāϟāĻ˛ā§āϝāĻžāĻŦ āĻ•āύāĻĢāĻŋāĻ—āĻžāϰ āĻ•āϰāĻž āĻšāĻšā§āϛ⧇

āĻĒā§‹āĻ¸ā§āϟāĻ—ā§āϰ⧇āĻāϏāĻ•āĻŋāωāĻāϞ-āĻ āĻĄāĻžāϟāĻžāĻŦ⧇āϏ āφāĻŽāĻĻāĻžāύāĻŋ āĻ•āϰāĻžāϰ āĻĒāϰ⧇, āĻāĻ•āϟāĻŋ āĻ—āĻŋāϟāĻ˛ā§āϝāĻžāĻŦ āĻŦā§āϝāĻŦāĻšāĻžāϰāĻ•āĻžāϰ⧀ āϤ⧈āϰāĻŋ āĻ•āϰāĻž āĻšāϝāĻŧ⧇āĻ›āĻŋāϞāĨ¤ āφāĻĒāύāĻžāϕ⧇ āĻāχ āĻŦā§āϝāĻŦāĻšāĻžāϰāĻ•āĻžāϰ⧀āϰ āĻĒāĻžāϏāĻ“āϝāĻŧāĻžāĻ°ā§āĻĄ āĻĒāϰāĻŋāĻŦāĻ°ā§āϤāύ āĻ•āϰāϤ⧇ āĻšāĻŦ⧇āĨ¤

āĻĒāĻžāϏāĻ“āϝāĻŧāĻžāĻ°ā§āĻĄ āĻĒāϰāĻŋāĻŦāĻ°ā§āϤāύ āĻ•āϰāĻž:

sudo -u postgres psql -c "ALTER USER gitlab ENCRYPTED PASSWORD 'ПАРОЛĐŦ' VALID UNTIL 'infinity';"
Password for user postgres:
ALTER ROLE

āϤāĻžāϰāĻĒāϰ, āĻ—āĻŋāϟāĻ˛ā§āϝāĻžāĻŦ āϏāĻžāĻ°ā§āĻ­āĻžāϰ⧇, āĻ•āύāĻĢāĻŋāĻ—āĻžāϰ⧇āĻļāύ āĻĢāĻžāχāϞ /etc/gitlab/gitlab.rb-āĻ, āφāĻŽāϰāĻž āĻŦāĻšāĻŋāϰāĻžāĻ—āϤ PostgreSQL āĻāϰ āϏāĻŽāĻ¸ā§āϤ āĻĄā§‡āϟāĻž āύāĻŋāĻ°ā§āĻĻ⧇āĻļ āĻ•āϰāĻŦāĨ¤

āφāϏ⧁āύ gitlab.rb āĻĢāĻžāχāϞ⧇āϰ āĻāĻ•āϟāĻŋ āĻŦā§āϝāĻžāĻ•āφāĻĒ āĻ•āĻĒāĻŋ āϤ⧈āϰāĻŋ āĻ•āϰāĻŋ:

cp /etc/gitlab/gitlab.rb /etc/gitlab/gitlab.rb.orig

āĻāĻ–āύ gitlab.rb āĻĢāĻžāχāϞ⧇āϰ āĻļ⧇āώ⧇ āĻāχ āϞāĻžāχāύāϗ⧁āϞāĻŋ āϝ⧋āĻ— āĻ•āϰ⧁āύ:

# ĐžŅ‚ĐēĐģŅŽŅ‡Đ¸Ņ‚ŅŒ Đ˛ŅŅ‚Ņ€ĐžĐĩĐŊĐŊŅ‹Đš PostgreSQL.
postgresql['enable'] = false

# ДаĐŊĐŊŅ‹Đĩ Đ´ĐģŅ ĐŋОдĐēĐģŅŽŅ‡ĐĩĐŊĐ¸Ņ Đē вĐŊĐĩ҈ĐŊĐĩĐš йаСĐĩ. ĐŖĐēĐ°ĐˇŅ‹Đ˛Đ°ĐšŅ‚Đĩ ŅĐ˛ĐžĐ¸.
gitlab_rails['db_adapter'] = 'postgresql'
gitlab_rails['db_encoding'] = 'utf8'
gitlab_rails['db_host'] = '10.0.0.2'
gitlab_rails['db_port'] = 5432
gitlab_rails['db_database'] = "gitlabhq_production"
gitlab_rails['db_username'] = 'gitlab'
gitlab_rails['db_password'] = '******'

āĻĢāĻžāχāϞāϟāĻŋ āϏāĻ‚āϰāĻ•ā§āώāĻŖ āĻ•āϰ⧁āύ /etc/gitlab/gitlab.rb āĻāĻŦāĻ‚ GitLab āĻĒ⧁āύāϰāĻžāϝāĻŧ āĻ•āύāĻĢāĻŋāĻ—āĻžāϰ āĻ•āϰ⧁āύ:

gitlab-ctl reconfigure && gitlab-ctl restart

āĻāĻ–āĻžāύ⧇āχ āĻļ⧇āώ :)

āĻŦāĻĄāĻŧ āĻ…āύ⧁āϰ⧋āϧāĨ¤ āϝāĻĻāĻŋ āφāĻĒāύāĻŋ āĻāĻ•āϟāĻŋ āĻŦāĻŋāϝāĻŧā§‹āĻ— āĻ•āϰāĻž, āĻŽāĻ¨ā§āϤāĻŦā§āϝ⧇ āĻ•āĻžāϰāĻŖ āϞāĻŋāϖ⧁āύ.

āωāĻ¤ā§āϏ: www.habr.com

DDoS āϏ⧁āϰāĻ•ā§āώāĻž, VPS VDS āϏāĻžāĻ°ā§āĻ­āĻžāϰ āϏāĻš āϏāĻžāχāϟāϗ⧁āϞāĻŋāϰ āϜāĻ¨ā§āϝ āύāĻŋāĻ°ā§āĻ­āϰāϝ⧋āĻ—ā§āϝ āĻšā§‹āĻ¸ā§āϟāĻŋāĻ‚ āĻ•āĻŋāύ⧁āύ đŸ”Ĩ DDoS āϏ⧁āϰāĻ•ā§āώāĻž āϏāĻš āύāĻŋāĻ°ā§āĻ­āϰāϝ⧋āĻ—ā§āϝ āĻ“āϝāĻŧ⧇āĻŦāϏāĻžāχāϟ āĻšā§‹āĻ¸ā§āϟāĻŋāĻ‚ āĻ•āĻŋāύ⧁āύ, VPS VDS āϏāĻžāĻ°ā§āĻ­āĻžāϰ | ProHoster