Fix #236: Restart postgres service after ACL changes in pg_hba.conf

postgres/server/init.sls

@@ -84,7 +84,7 @@ postgresql-cluster-prepared:
       - pkg: postgresql-server
       - file: postgresql-cluster-prepared
     - watch_in:
-      - module: postgresql-service-restart
+      - service: postgresql-running
 {%- endif %}
 
 postgresql-config-dir:
@@ -143,17 +143,10 @@ postgresql-conf:
       - file: postgresql-conf-comment-port
       {%- endif %}
     - watch_in:
-      - module: postgresql-service-restart
+      - service: postgresql-running
 
 {%- endif %}
 
-# Restart the service where reloading is not sufficient
-# Currently when the cluster is created or changes made to `postgresql.conf`
-postgresql-service-restart:
-  module.wait:
-    - name: service.restart
-    - m_name: {{ postgres.service }}
-
 {%- set pg_hba_path = salt['file.join'](postgres.conf_dir, 'pg_hba.conf') %}
 
 postgresql-pg_hba:
@@ -180,6 +173,8 @@ postgresql-pg_hba:
 {%- endif %}
     - require:
       - file: postgresql-config-dir
+    - watch_in:
+      - service: postgresql-running
 
 {%- set pg_ident_path = salt['file.join'](postgres.conf_dir, 'pg_ident.conf') %}
 
@@ -212,6 +207,12 @@ postgresql-pg_ident:
       {%- else %}
       - file: postgresql-cluster-prepared
       {%- endif %}
+    - watch_in:
+      {%- if grains.os not in ('MacOS',) %}
+      - module: postgresql-service-reload
+      {%- else %}
+      - service: postgresql-running
+      {%- endif %}
 
 {%- for name, tblspace in postgres.tablespaces|dictsort() %}
 
@@ -256,15 +257,22 @@ postgresql-tablespace-dir-{{ name }}-fcontext:
 {%- if not postgres.bake_image %}
 
 # Start PostgreSQL server using OS init
+# Note: This is also the target for numerous `watch_in` requisites above, used
+# for the necessary service restart after changing the relevant configuration files
 postgresql-running:
   service.running:
     - name: {{ postgres.service }}
     - enable: True
-   {% if grains.os not in ('MacOS',) %}
-    - reload: True
-   {% endif %}
-    - watch:
-      - file: postgresql-pg_hba
-      - file: postgresql-pg_ident
+
+# Reload the service for changes made to `pg_ident.conf`, except for `MacOS`
+# which is handled by `postgresql-running` above.
+{%- if grains.os not in ('MacOS',) %}
+postgresql-service-reload:
+  module.wait:
+    - name: service.reload
+    - m_name: {{ postgres.service }}
+    - require:
+      - service: postgresql-running
+{%- endif %}
 
 {%- endif %}

postgres/templates/pg_ident.conf.j2

@@ -47,5 +47,5 @@
 # MAPNAME       SYSTEM-USERNAME         PG-USERNAME
 
 {%- for mapping in mappings %}
-{{ '{0:<15} {1:<22} {2}'.format(mapping) -}}
+{{ '{0:<15} {1:<22} {2}'.format(*mapping) -}}
 {% endfor %}