Thread: [GENERAL] Allow only certain query on replication slave

[GENERAL] Allow only certain query on replication slave

From
basti
Date:
Hello,

I have a Postgres slave (wal replication) and want no query on it, expect

- SELECT pg_last_xlog_receive_location()
- SELECT pg_last_xlog_replay_location()

When I set hot_standby = off in postgres.conf nobody can query the
replication cluster.

Is there a way to allow only the above query and deny all other?

Best Regards,
basti


-- 
Sent via pgsql-general mailing list (pgsql-general@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-general

Re: [GENERAL] Allow only certain query on replication slave

From
Michael Paquier
Date:
On Tue, Oct 24, 2017 at 6:12 AM, basti <mailinglist@unix-solution.de> wrote:
> I have a Postgres slave (wal replication) and want no query on it, expect
>
> - SELECT pg_last_xlog_receive_location()
> - SELECT pg_last_xlog_replay_location()
>
> When I set hot_standby = off in postgres.conf nobody can query the
> replication cluster.
>
> Is there a way to allow only the above query and deny all other?

There is a trick you could use here with two hooks: the planner hook
and the utility hook. The idea is to filter all queries and refuse
them when RecoveryInProgress() is satisfied. The parsed tree can be
used in the planner hook to check for those functions and accept them.
-- 
Michael


-- 
Sent via pgsql-general mailing list (pgsql-general@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-general

Re: [GENERAL] Allow only certain query on replication slave

From
Don Seiler
Date:
On Tue, Oct 24, 2017 at 8:12 AM, basti <mailinglist@unix-solution.de> wrote:

Is there a way to allow only the above query and deny all other?

Probably easiest to just configure your HBA to restrict all connections/uses except the one that does your xlog query checks.

Don. 
--
Don Seiler
www.seiler.us