primer commit
This commit is contained in:
commit
864b3e4008
GPG key ID:
BDA314B08CB17657
105 changed files with 3185 additions and 0 deletions
128
roles/postgresql/tasks/main.yaml
Normal file
128
roles/postgresql/tasks/main.yaml
Normal file
|
|
@ -0,0 +1,128 @@
|
|||
#SPDX-License-Identifier: MIT-0
|
||||
---
|
||||
- name: Install PostgreSQL packages
|
||||
ansible.builtin.dnf:
|
||||
name: ["postgresql-server", "python3-psycopg2"]
|
||||
state: present
|
||||
|
||||
- name: Initialize the PostgreSQL database
|
||||
ansible.builtin.command: postgresql-setup --initdb
|
||||
args:
|
||||
creates: /var/lib/pgsql/data/postgresql.conf
|
||||
|
||||
- name: Copy PostgreSQL server certificate
|
||||
ansible.builtin.copy:
|
||||
src: "{{ koji_pki_dir }}/postgresql.crt"
|
||||
dest: "/var/lib/pgsql/data/server.crt"
|
||||
owner: postgres
|
||||
group: postgres
|
||||
mode: "0644"
|
||||
notify: Restart postgresql
|
||||
|
||||
- name: Copy PostgreSQL server key
|
||||
ansible.builtin.copy:
|
||||
src: "{{ koji_pki_dir }}/postgresql.key"
|
||||
dest: "/var/lib/pgsql/data/server.key"
|
||||
owner: postgres
|
||||
group: postgres
|
||||
mode: "0600"
|
||||
notify: Restart postgresql
|
||||
|
||||
- name: Copy CA certificate to PostgreSQL data directory
|
||||
ansible.builtin.copy:
|
||||
src: "{{ koji_pki_dir }}/{{ koji_ca_name }}_cert.crt"
|
||||
dest: "/var/lib/pgsql/data/ca.crt"
|
||||
owner: postgres
|
||||
group: postgres
|
||||
mode: "0644"
|
||||
notify: Restart postgresql
|
||||
|
||||
- name: Start and enable PostgreSQL service
|
||||
ansible.builtin.service:
|
||||
name: postgresql
|
||||
state: started
|
||||
enabled: true
|
||||
|
||||
- name: Configure PostgreSQL settings
|
||||
community.postgresql.postgresql_set:
|
||||
name: "{{ item.name }}"
|
||||
value: "{{ item.value }}"
|
||||
loop:
|
||||
- { name: 'ssl_ca_file', value: 'ca.crt' }
|
||||
- { name: 'ssl', value: 'on' }
|
||||
- { name: 'ssl_cert_file', value: 'server.crt' }
|
||||
- { name: 'ssl_key_file', value: 'server.key' }
|
||||
- { name: 'max_connections', value: '200' }
|
||||
- { name: 'listen_addresses', value: '*' }
|
||||
become: true
|
||||
become_user: postgres
|
||||
notify: Restart postgresql
|
||||
|
||||
|
||||
|
||||
- name: Remove old pg_hba.conf entry for Koji hub (IPv4 network)
|
||||
community.postgresql.postgresql_pg_hba:
|
||||
dest: /var/lib/pgsql/data/pg_hba.conf
|
||||
contype: hostssl
|
||||
databases: "{{ koji_db_name }}"
|
||||
users: "{{ koji_db_user }}"
|
||||
address: "{{ koji_db_network }}"
|
||||
method: scram-sha-256
|
||||
state: absent
|
||||
notify: Restart postgresql
|
||||
|
||||
- name: Configure pg_hba.conf to allow connection from the Koji hub (IPv4 address)
|
||||
community.postgresql.postgresql_pg_hba:
|
||||
dest: /var/lib/pgsql/data/pg_hba.conf
|
||||
contype: hostssl
|
||||
databases: "{{ koji_db_name }}"
|
||||
users: "{{ koji_db_user }}"
|
||||
address: "{{ hostvars[groups['kojihub'][0]].ansible_default_ipv4.address }}/32"
|
||||
method: scram-sha-256
|
||||
backup: true
|
||||
notify: Restart postgresql
|
||||
|
||||
- name: Configure pg_hba.conf to allow IPv6 connection from the Koji hub
|
||||
community.postgresql.postgresql_pg_hba:
|
||||
dest: /var/lib/pgsql/data/pg_hba.conf
|
||||
contype: hostssl
|
||||
databases: "{{ koji_db_name }}"
|
||||
users: "{{ koji_db_user }}"
|
||||
address: "{{ hostvars[groups['kojihub'][0]].ansible_default_ipv6.address }}/128"
|
||||
method: scram-sha-256
|
||||
backup: true
|
||||
notify: Restart postgresql
|
||||
|
||||
- name: Configure pg_hba.conf for local postgres user trust authentication
|
||||
community.postgresql.postgresql_pg_hba:
|
||||
dest: /var/lib/pgsql/data/pg_hba.conf
|
||||
contype: local
|
||||
databases: all
|
||||
users: postgres
|
||||
method: peer
|
||||
backup: true
|
||||
notify: Restart postgresql
|
||||
|
||||
- name: Flush handlers
|
||||
ansible.builtin.meta: flush_handlers
|
||||
|
||||
- name: Create Koji database user
|
||||
community.postgresql.postgresql_user:
|
||||
name: "{{ koji_db_user }}"
|
||||
password: "{{ koji_db_password }}"
|
||||
become: true
|
||||
become_user: postgres
|
||||
|
||||
- name: Create Koji database
|
||||
community.postgresql.postgresql_db:
|
||||
name: "{{ koji_db_name }}"
|
||||
owner: "{{ koji_db_user }}"
|
||||
become: true
|
||||
become_user: postgres
|
||||
|
||||
- name: Open firewall for PostgreSQL
|
||||
ansible.posix.firewalld:
|
||||
port: 5432/tcp
|
||||
permanent: true
|
||||
state: enabled
|
||||
notify: Reload firewalld
|
||||
44
roles/postgresql/tasks/reset_db.yaml
Normal file
44
roles/postgresql/tasks/reset_db.yaml
Normal file
|
|
@ -0,0 +1,44 @@
|
|||
---
|
||||
- name: Stop Koji Hub and Kojira services before database reset
|
||||
ansible.builtin.service:
|
||||
name: "{{ item }}"
|
||||
state: stopped
|
||||
loop:
|
||||
- httpd
|
||||
- kojira
|
||||
delegate_to: "{{ groups['kojihub'][0] }}"
|
||||
|
||||
- name: Terminate all active connections to Koji database
|
||||
community.postgresql.postgresql_query:
|
||||
query: "SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname = '{{ koji_db_name }}';"
|
||||
login_db: postgres
|
||||
become: true
|
||||
become_user: postgres
|
||||
|
||||
- name: Drop Koji database
|
||||
community.postgresql.postgresql_db:
|
||||
name: "{{ koji_db_name }}"
|
||||
state: absent
|
||||
become: true
|
||||
become_user: postgres
|
||||
|
||||
- name: Drop Koji database user
|
||||
community.postgresql.postgresql_user:
|
||||
name: "{{ koji_db_user }}"
|
||||
state: absent
|
||||
become: true
|
||||
become_user: postgres
|
||||
|
||||
- name: Create Koji database user
|
||||
community.postgresql.postgresql_user:
|
||||
name: "{{ koji_db_user }}"
|
||||
password: "{{ koji_db_password }}"
|
||||
become: true
|
||||
become_user: postgres
|
||||
|
||||
- name: Create Koji database
|
||||
community.postgresql.postgresql_db:
|
||||
name: "{{ koji_db_name }}"
|
||||
owner: "{{ koji_db_user }}"
|
||||
become: true
|
||||
become_user: postgres
|
||||
Loading…
Reference in a new issue