server/user-documentation
10
3
Fork 8
Code Issues Pull requests 2 Projects Activity

Draft to update doc to F43.

Browse source
This commit is contained in:
Peter Boy 2025-12-03 22:17:53 +01:00
commit 9e75b185f8
2 changed files with 73 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

2
modules/ROOT/pages/index.adoc
View file

@ -36,7 +36,7 @@ Detailed step-by-step instructions are given for various typical areas of applic
- People, policies, and working methods
[updating-f43]
=== Updating to Fedora 43
The recommended procedure is upgrading using the _DNF System Upgrade_ plugin. This applies to Fedora Server Edition on hardware as well as in a virtual machine.

105
modules/ROOT/pages/services/postgresql-setup.adoc
View file

@ -1,16 +1,14 @@
= Setting up PostgreSQL Database Server
Peter Boy
:page-authors: {author}
:revnumber: F35-F37
:revdate: 2022-11-15
:revnumber: F35-F43
:revdate: 2025-12-04
// :revremark: a new beginning
:page-aliases: service-postgresql-installation.adoc
:page-aliases: services/postgresql-installation.adoc
[abstract]
____
Postgresql is the recommended database management system of Fedora. It is a key functionality that is part of the Release criteria.
____
// Before publishing on main site, comment out
@ -24,7 +22,7 @@ ____
// *Status of this document*: Updated to f41.
//====
Fedora 40 and 41 both include PostgreSQL 16.3. So there is no need to update the database when updating to Release 41.
Fedora 43 includes PostgreSQL 18.1 If you update from F42, read the release notes or the xref:index.adoc#updating-f43[update description on Server home page] for detailed instructions.
== 1. Storage preparation
@ -35,16 +33,21 @@ Following the Fedora storage concept, a dedicated file system on a logical volum
A convenient descriptive name for both the logical volume and the file system is `pgsql`. The volume group that contains the logical volume is called `fedora_fedora` in a default installation. A suitable initial size is likely to be 50 GiB in many cases.
In any case, the system administrator must adapt the following command sequence according to the local requirements! With a Linux LVM and Software raid, XFS can autonomously determine its optimal configuration values. With some hardware raids, intervention by the administrator can also be useful for this.
First, check for the VG name and then adjust the following commands.
[source,]
----
[…]# vgs
[…]# lvcreate -L 50G -n pgsql fedora_fedora
[…]# mkfs.xfs -L pgsql /dev/mapper/fedora_fedora-pgsql
VG #PV #LV #SN Attr VSize VFree
systemVG 1 1 0 wz--n- 7.55g <4.42g
[…]# lvcreate -L 50G -n pgsql systemVG
Logical volume "pgsql" created.
[…]# mkfs.xfs -L pgsql /dev/mapper/systemVG-pgsql
meta-data=/dev/mapper/systemVG-pgsql isize=512 agcount=4, agsize=655360 blks
...
Discarding blocks...Done.
[…]# mkdir /var/lib/pgsql
[…]# vim /etc/fstab
(insert)
/dev/mapper/fedora_fedora-pgsql /var/lib/pgsql auto defaults 0 0
(save & quit)
[…]# echo "UUID=$(blkid -s UUID -o value /dev/systemVG/pgsql) /var/lib/pgsql auto defaults 0 0" >> /etc/fstab
[…]# mount -a
[…]# df -h
----
@ -58,17 +61,17 @@ The package provides the pure server functionality. Fedora additionally loads th
----
[…]# dnf install postgresql-server
...
==============================================================================================
Package Architectur Version Repository Size
==============================================================================================
==============================================================================
Package Architectur Version
==============================================================================
Installing:
postgresql-server x86_64 14.3-2.fc37 updates 5.9 M
postgresql-server x86_64 18.0-1.fc43
Installing dependencies
postgresql x86_64 14.3-2.fc37 updates 1.6 M
postgresql-private-libs x86_64 14.3-2.fc37 updates 138 k
postgresql x86_64 18.0-1.fc43
postgresql-private-libs x86_64 18.0-1.fc43
Transaction Summary
==============================================================================================
==============================================================================
Install 3 packages
----
@ -107,6 +110,31 @@ When all the requirements are met, perform the initialization of the database cl
Fedora preconfigures Postgresql in a way that in any case ensures reliable and maintainable operation on the one hand and secure operation as far as possible on the other.
=== Database connection paths
A client can connect to the server either by a Unix socket connection or a TCP/IP connection.
If the client does not specify a hostname parameter (-h), a Unix socket connection is established. Postgres uses this method to ensure that root can always securely establish a connection, regardless of password loss, for example. The root user always has permission to assume the identity of the postgresql master user (su - postgres). By default, no other user has this option. As root, you get in any circumstances administrative access to the database.
[source]
----
[…]# su - postgres
[…]$ psql
----
Specifying the host parameter results in an attempt to establish a TCP/IP connection. Postgresql uses port 5432 by default for this purpose. In Fedora, all interfaces are protected by a firewall by default, except for localhost. A connection therefore requires opening a suitable port.
Fedora abstracts the technical details with Firewalld, so that the administrator does not need to bother with details. For most common uses there are predefined services. So, if you want the database to be accessible via the internal interface assigned to the internal zone, for example, you need just two simple instructions.
[source]
----
[…]$ sudo firewall-cmd --zone=internal --permanent --add-service=postgresql
[…]$ sudo firewall-cmd --reload
----
[TIP]
====
In case of connection issues there is most probably a SELinux configuration missing, in most case a "__name_connect access on the tcp_socket__" issue. Check the SELinux module in Cockpit. It helps you in detail to establish a local policy to fix it. It is easy, just a matter of 2 instructions.
====
=== Authentification options
==== Administrative access
@ -117,26 +145,34 @@ If local regulations make it necessary to replace these procedures with a dedica
==== Client user access
In the initial configuration postgresql restricts any authentication to peer as above described or ident (i.e. asking a ident server). In most cases you need an authentication based on a kind of password, mostly still md5 despite its security issues. The details depend on the prospective clients. As a typical use case we will accept connections from the internal network to VMs, by default 192.169.122.0/24.
In the initial configuration postgresql restricts any authentication to peer as above described or ident (i.e. asking an ident server, that Fedora doesn't install). In most cases you need an authentication based on a password. The details depend on the prospective clients. As a typical use case we will accept connections from the internal network to VMs, by default 192.169.122.0/24.
The configuration is done in the file `pg_hba.conf` in the `data` subdirectory. Edit the file to match the pattern below.
[source,]
----
[…]# vim /var/lib/pgsql/data/pg_hba.conf
# TYPE DATABASE USER ADDRESS METHOD
# "local" is for Unix domain socket connections only
local all all peer
# IPv4 local connections:
host all all 127.0.0.1/32 ident
# IPv4 internal network connections: # <- modification!
host all all 192.168.122.1/24 md5 # <- modification!
# IPv6 local connections:
host all all ::1/128 ident
[…]# vim /var/lib/pgsql/data/pg_hba.conf
# PostgreSQL Client Authentication Configuration File
# ===================================================
# TYPE DATABASE USER ADDRESS METHOD
# "local" is for Unix domain socket connections only
local all all peer
# IPv4 local connections:
host all all 127.0.0.1/32 ident
# IPv4 internal network connections: # <- modification!
host all all 192.168.122.1/24 scram-sha-256 # <- modification!
# IPv6 local connections:
host all all ::1/128 ident
# Allow replication connections from localhost, by a user with the
----
Add further entries according to the need, as far as they are already known. Additions are possible at any time later, but require a reload of the server, i.e. at least a short service interruption.
For further details see the PostgreSQL documentation, chapter https://www.postgresql.org/docs/13/auth-methods.html[20.3. Authentication Methods]
To make access via the 192.168.122.1/24 host interface really work, you have to add the host's IP address on that network to postgresql.conf.
For further details see the PostgreSQL documentation, chapter https://www.postgresql.org/docs/current/auth-pg-hba-conf.html[20.1. The pg_hba.conf File].
[TIP]
====
Some of the possible authentication methods require additional settings for SELinux. For example, the _PAM_ method requires unix_chkpwd access permissions. A typical error message is “__SELinux is preventing auth from name_connect access on the tcp_socket port 5432__”. The easiest way to fix this is to use the SELinux module from Cockpit..
====
=== Connection options
@ -153,11 +189,11 @@ Connections granted are configured in ~/data/postgresql.conf. To grant access t
# - Connection Settings -
listen_addresses = 'localhost, 192.168.122.1/24'
#listen_addresses = 'localhost' # what IP address(es) to listen on;
# comma-separated list of addresses;
# defaults to 'localhost'; use '*' for all
# (change requires restart)
listen_addresses = 'localhost, 192.168.122.1/24'
#port = 5432 # (change requires restart)
max_connections = 100 # (change requires restart)
...
@ -172,6 +208,8 @@ You are now ready to start the PostgreSQL server.
----
[…]# systemctl start postgresql
[…]# systemctl status postgresql
...
... systemd[1]: Started postgresql.service - PostgreSQL database server.
----
If no errors are reported, try to connect as user postgres using the psql cli client. Once connected, start commands with backslash, e.g. \? to get help or \q to quit.
@ -179,7 +217,7 @@ If no errors are reported, try to connect as user postgres using the psql cli cl
----
[…]# su - postgres
[…]$ psql
psql (13.4)
psql (18.0)
Enter »help« ...
postgres=# \dg
@ -189,7 +227,8 @@ If no errors are reported, try to connect as user postgres using the psql cli cl
postgres | Superuser, Create role, Create DB, Replication, Bypass RLS | {}
postgres-# \q
[…]$
[…]$ exit
[…]#
----
If everything works as expected, enable autostart of postgresql,