defined_type_definition.diff

diff --git a/modules/govuk_postgresql/manifests/db.pp b/modules/govuk_postgresql/manifests/db.pp
index ce2179b..4624170 100644
--- a/modules/govuk_postgresql/manifests/db.pp
+++ b/modules/govuk_postgresql/manifests/db.pp
@@ -16,6 +16,10 @@
 # call to postgresql_password to enable it to be passed in to the
 # postgresql::server::db type.
 #
+# [*collectd_password*]
+# The plaintext password for the 'collectd' PostgreSQL user to collect
+# metrics about this database.
+#
 # [*database*]
 # An optional name for this database. It will default to the resource title.
 # Default: $title
@@ -57,6 +61,7 @@
 define govuk_postgresql::db (
     $user,
     $password,
+    $collectd_password,
     $database                = undef,
     $owner                   = undef,
     $encoding                = 'UTF8',
@@ -129,6 +134,9 @@ define govuk_postgresql::db (
         }
     }
 
-    collectd::plugin::postgresql_db{$db_name:}
+    collectd::plugin::postgresql_db { $db_name:
+        password => $collectd_password,
+    }
+
     govuk_postgresql::monitoring::db{$db_name:}
 }

defined_type_use.diff

diff --git a/modules/govuk/manifests/apps/url_arbiter/db.pp b/modules/govuk/manifests/apps/url_arbiter/db.pp
index c55429f..4a1d5b2 100644
--- a/modules/govuk/manifests/apps/url_arbiter/db.pp
+++ b/modules/govuk/manifests/apps/url_arbiter/db.pp
@@ -5,17 +5,22 @@
 # [*password*]
 #   The DB instance password.
 #
+# [*collectd_password*]
+#   Password for the collectd user to collect metrics about this database.
+#
 # [*backend_ip_range*]
 #   Backend IP addresses to allow access to the database.
 #
 class govuk::apps::url_arbiter::db (
   $password,
+  $collectd_password,
   $backend_ip_range = '10.3.0.0/16',
 ) {
 
   govuk_postgresql::db { 'url-arbiter_production':
     user                    => 'url-arbiter',
     password                => $password,
+    collectd_password       => $collectd_password,
     allow_auth_from_backend => true,
     backend_ip_range        => $backend_ip_range,
   }

hieradata.diff

diff --git a/hieradata/credentials.yaml b/hieradata/credentials.yaml
index 8e0117e..5ea1d85 100644
--- a/hieradata/credentials.yaml
+++ b/hieradata/credentials.yaml
@@ -21,6 +21,8 @@ backup::server::backup_private_key: |
   can
   -----END RSA PRIVATE KEY-----
 
+govuk::apps::url_arbiter::db::collectd_password: 'password'
+
 govuk::apps::authenticating_proxy::errbit_api_key: 'foo'
 govuk::apps::bouncer::postgresql_role::password: 'bar'
 govuk::apps::collections_publisher::db::mysql_password: 'baz'