6

I'm attempting to get a server provisioned using ansible, meaning that I can't type in a password. I'm doing a master-slave topology and I need to run pg_basebackup on the slave machine to accomplish this. I've looked into using .pgpass, but that appears to be for my shell user, not the postgres account.

Is this possible? Or will I have to make a manual stage in my deployment?

1

2 Answers 2

6

Create a .pgpass in the home directory for the postgres user, or whatever user you run pg_basebackup as.

Link to the manual: http://www.postgresql.org/docs/current/static/libpq-pgpass.html

1

You should probably use ansible-vault that way you won't leave an unencrypted copy of the password laying around on the filesystem of the target host.

.pgpass is fine for your dev environment, but it's about as effective as taping plain text passwords to the bottom of your keyboard in terms of effective security.

3
  • Thanks Larry. I'll definitely consider doing that at some point. Commented Oct 8, 2015 at 20:02
  • 3
    Is the vault a commercial product? If yes, are you affiliated with the company (coworker, retailer, other)? In any case, how do you set it up to do what the OP wants? Furthermore, if you secure your OS, the .pgpass way is totally acceptable in production, too. Commented Oct 8, 2015 at 20:15
  • 3
    So how do you tell Postgres (or more specifically: libpq) to read this encrypted file?
    – user1822
    Commented Oct 8, 2015 at 20:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.