drop postgres module from soc defaults injection

The soc binary on 3/dev does not register a postgres module, so injecting
postgres into soc.config.server.modules makes soc abort at launch with
'Module does not exist: postgres'. The soc-side module is staged on
feature/postgres but is not landing this release. Drop the injection
until the module ships; salt/postgres state and pillars are unchanged.

salt/firewall/defaults.yaml

@@ -398,7 +398,6 @@ firewall:
                 - elasticsearch_rest
                 - docker_registry
                 - influxdb
-                - postgres
                 - sensoroni
                 - yum
                 - beats_5044
@@ -411,7 +410,6 @@ firewall:
               portgroups:
                 - docker_registry
                 - influxdb
-                - postgres
                 - sensoroni
                 - yum
                 - beats_5044
@@ -429,7 +427,6 @@ firewall:
                 - yum
                 - docker_registry
                 - influxdb
-                - postgres
                 - sensoroni
             searchnode:
               portgroups:
@@ -440,7 +437,6 @@ firewall:
                 - yum
                 - docker_registry
                 - influxdb
-                - postgres
                 - elastic_agent_control
                 - elastic_agent_data
                 - elastic_agent_update
@@ -454,7 +450,6 @@ firewall:
                 - yum
                 - docker_registry
                 - influxdb
-                - postgres
                 - elastic_agent_control
                 - elastic_agent_data
                 - elastic_agent_update
@@ -464,7 +459,6 @@ firewall:
                 - yum
                 - docker_registry
                 - influxdb
-                - postgres
                 - elastic_agent_control
                 - elastic_agent_data
                 - elastic_agent_update
@@ -498,7 +492,6 @@ firewall:
               portgroups:
                 - docker_registry
                 - influxdb
-                - postgres
                 - sensoroni
                 - yum
                 - elastic_agent_control
@@ -509,7 +502,6 @@ firewall:
                 - yum
                 - docker_registry
                 - influxdb
-                - postgres
                 - elastic_agent_control
                 - elastic_agent_data
                 - elastic_agent_update
@@ -618,7 +610,6 @@ firewall:
                 - elasticsearch_rest
                 - docker_registry
                 - influxdb
-                - postgres
                 - sensoroni
                 - yum
                 - beats_5044
@@ -631,7 +622,6 @@ firewall:
               portgroups:
                 - docker_registry
                 - influxdb
-                - postgres
                 - sensoroni
                 - yum
                 - beats_5044
@@ -649,7 +639,6 @@ firewall:
                 - yum
                 - docker_registry
                 - influxdb
-                - postgres
                 - sensoroni
             searchnode:
               portgroups:
@@ -660,7 +649,6 @@ firewall:
                 - yum
                 - docker_registry
                 - influxdb
-                - postgres
                 - elastic_agent_control
                 - elastic_agent_data
                 - elastic_agent_update
@@ -674,7 +662,6 @@ firewall:
                 - yum
                 - docker_registry
                 - influxdb
-                - postgres
                 - elastic_agent_control
                 - elastic_agent_data
                 - elastic_agent_update
@@ -684,7 +671,6 @@ firewall:
                 - yum
                 - docker_registry
                 - influxdb
-                - postgres
                 - elastic_agent_control
                 - elastic_agent_data
                 - elastic_agent_update
@@ -716,7 +702,6 @@ firewall:
               portgroups:
                 - docker_registry
                 - influxdb
-                - postgres
                 - sensoroni
                 - yum
                 - elastic_agent_control
@@ -727,7 +712,6 @@ firewall:
                 - yum
                 - docker_registry
                 - influxdb
-                - postgres
                 - elastic_agent_control
                 - elastic_agent_data
                 - elastic_agent_update
@@ -836,7 +820,6 @@ firewall:
                 - elasticsearch_rest
                 - docker_registry
                 - influxdb
-                - postgres
                 - sensoroni
                 - yum
                 - beats_5044
@@ -849,7 +832,6 @@ firewall:
               portgroups:
                 - docker_registry
                 - influxdb
-                - postgres
                 - sensoroni
                 - yum
                 - beats_5044
@@ -867,7 +849,6 @@ firewall:
                 - yum
                 - docker_registry
                 - influxdb
-                - postgres
                 - sensoroni
             searchnode:
               portgroups:
@@ -877,7 +858,6 @@ firewall:
                 - yum
                 - docker_registry
                 - influxdb
-                - postgres
                 - elastic_agent_control
                 - elastic_agent_data
                 - elastic_agent_update
@@ -890,7 +870,6 @@ firewall:
                 - yum
                 - docker_registry
                 - influxdb
-                - postgres
                 - elastic_agent_control
                 - elastic_agent_data
                 - elastic_agent_update
@@ -900,7 +879,6 @@ firewall:
                 - yum
                 - docker_registry
                 - influxdb
-                - postgres
                 - elastic_agent_control
                 - elastic_agent_data
                 - elastic_agent_update
@@ -934,7 +912,6 @@ firewall:
               portgroups:
                 - docker_registry
                 - influxdb
-                - postgres
                 - sensoroni
                 - yum
                 - elastic_agent_control
@@ -945,7 +922,6 @@ firewall:
                 - yum
                 - docker_registry
                 - influxdb
-                - postgres
                 - elastic_agent_control
                 - elastic_agent_data
                 - elastic_agent_update
@@ -1064,7 +1040,6 @@ firewall:
                 - elasticsearch_rest
                 - docker_registry
                 - influxdb
-                - postgres
                 - sensoroni
                 - yum
                 - beats_5044
@@ -1077,7 +1052,6 @@ firewall:
               portgroups:
                 - docker_registry
                 - influxdb
-                - postgres
                 - sensoroni
                 - yum
                 - beats_5044
@@ -1089,7 +1063,6 @@ firewall:
               portgroups:
                 - docker_registry
                 - influxdb
-                - postgres
                 - sensoroni
                 - yum
                 - beats_5044
@@ -1101,7 +1074,6 @@ firewall:
               portgroups:
                 - docker_registry
                 - influxdb
-                - postgres
                 - sensoroni
                 - yum
                 - redis
@@ -1111,7 +1083,6 @@ firewall:
               portgroups:
                 - docker_registry
                 - influxdb
-                - postgres
                 - sensoroni
                 - yum
                 - redis
@@ -1122,7 +1093,6 @@ firewall:
                 - yum
                 - docker_registry
                 - influxdb
-                - postgres
                 - elastic_agent_control
                 - elastic_agent_data
                 - elastic_agent_update
@@ -1159,7 +1129,6 @@ firewall:
               portgroups:
                 - docker_registry
                 - influxdb
-                - postgres
                 - sensoroni
                 - yum
                 - elastic_agent_control
@@ -1170,7 +1139,6 @@ firewall:
                 - yum
                 - docker_registry
                 - influxdb
-                - postgres
                 - elastic_agent_control
                 - elastic_agent_data
                 - elastic_agent_update
@@ -1514,7 +1482,6 @@ firewall:
                 - kibana
                 - redis
                 - influxdb
-                - postgres
                 - elasticsearch_rest
                 - elasticsearch_node
                 - elastic_agent_control

salt/firewall/map.jinja

@@ -1,5 +1,6 @@
 {% from 'vars/globals.map.jinja' import GLOBALS %}
 {% from 'docker/docker.map.jinja' import DOCKERMERGED %}
+{% from 'telegraf/map.jinja' import TELEGRAFMERGED %}
 {% import_yaml 'firewall/defaults.yaml' as FIREWALL_DEFAULT %}
 
 {# add our ip to self #}
@@ -55,4 +56,16 @@
 
 {% endif %}
 
+{# Open Postgres (5432) to minion hostgroups when Telegraf is configured to write to Postgres #}
+{% set TG_OUT = TELEGRAFMERGED.output | upper %}
+{% if TG_OUT in ['POSTGRES', 'BOTH'] %}
+{%   if role.startswith('manager') or role == 'standalone' or role == 'eval' %}
+{%     for r in ['sensor', 'searchnode', 'heavynode', 'receiver', 'fleet', 'idh', 'desktop', 'import'] %}
+{%       if FIREWALL_DEFAULT.firewall.role[role].chain["DOCKER-USER"].hostgroups[r] is defined %}
+{%         do FIREWALL_DEFAULT.firewall.role[role].chain["DOCKER-USER"].hostgroups[r].portgroups.append('postgres') %}
+{%       endif %}
+{%     endfor %}
+{%   endif %}
+{% endif %}
+
 {% set FIREWALL_MERGED = salt['pillar.get']('firewall', FIREWALL_DEFAULT.firewall, merge=True) %}

salt/soc/defaults.map.jinja

@@ -24,11 +24,6 @@
 
 {% do SOCDEFAULTS.soc.config.server.modules.elastic.update({'username': GLOBALS.elasticsearch.auth.users.so_elastic_user.user, 'password': GLOBALS.elasticsearch.auth.users.so_elastic_user.pass}) %}
 
-{% if GLOBALS.postgres is defined and GLOBALS.postgres.auth is defined %}
-{%   set PG_ADMIN_PASS = salt['pillar.get']('secrets:postgres_pass', '') %}
-{% do SOCDEFAULTS.soc.config.server.modules.update({'postgres': {'hostUrl': GLOBALS.manager_ip, 'port': 5432, 'username': GLOBALS.postgres.auth.users.so_postgres_user.user, 'password': GLOBALS.postgres.auth.users.so_postgres_user.pass, 'adminUser': 'postgres', 'adminPassword': PG_ADMIN_PASS, 'dbname': 'securityonion', 'sslMode': 'require', 'assistantEnabled': true, 'esHostUrl': 'https://' ~ GLOBALS.manager_ip ~ ':9200', 'esUsername': GLOBALS.elasticsearch.auth.users.so_elastic_user.user, 'esPassword': GLOBALS.elasticsearch.auth.users.so_elastic_user.pass, 'esVerifyCert': false}}) %}
-{% endif %}
-
 {% do SOCDEFAULTS.soc.config.server.modules.influxdb.update({'hostUrl': 'https://' ~ GLOBALS.influxdb_host ~ ':8086'}) %}
 {% do SOCDEFAULTS.soc.config.server.modules.influxdb.update({'token': INFLUXDB_TOKEN}) %}
 {% for tool in SOCDEFAULTS.soc.config.server.client.tools %}