# SPDX-License-Identifier: MIT-0
---
- name: Install PostgreSQL packages
  ansible.builtin.dnf:
    name: ["postgresql-server", "python3-psycopg2"]
    state: present

- name: Initialize the PostgreSQL database
  ansible.builtin.command: postgresql-setup --initdb
  args:
    creates: /var/lib/pgsql/data/postgresql.conf

- name: Copy PostgreSQL server certificate
  ansible.builtin.copy:
    src: "{{ koji_pki_dir }}/postgresql.crt"
    dest: "/var/lib/pgsql/data/server.crt"
    owner: postgres
    group: postgres
    mode: "0644"
  notify: Restart postgresql

- name: Copy PostgreSQL server key
  ansible.builtin.copy:
    src: "{{ koji_pki_dir }}/postgresql.key"
    dest: "/var/lib/pgsql/data/server.key"
    owner: postgres
    group: postgres
    mode: "0600"
  notify: Restart postgresql

- name: Copy CA certificate to PostgreSQL data directory
  ansible.builtin.copy:
    src: "{{ koji_pki_dir }}/{{ koji_ca_name }}_cert.crt"
    dest: "/var/lib/pgsql/data/ca.crt"
    owner: postgres
    group: postgres
    mode: "0644"
  notify: Restart postgresql

- name: Start and enable PostgreSQL service
  ansible.builtin.service:
    name: postgresql
    state: started
    enabled: true

- name: Configure PostgreSQL settings for SSL and listening
  ansible.builtin.lineinfile:
    path: /var/lib/pgsql/data/postgresql.conf
    regexp: "^{{ item.regexp }}"
    line: "{{ item.line }}"
    state: present
    backup: true
  loop:
    - { regexp: '#?ssl\\s*=\\s*.*', line: "ssl = on" }
    - { regexp: '#?ssl_cert_file\\s*=\\s*.*', line: "ssl_cert_file = 'server.crt'" }
    - { regexp: '#?ssl_key_file\\s*=\\s*.*', line: "ssl_key_file = 'server.key'" }
    - { regexp: '#?ssl_ca_file\\s*=\\s*.*', line: "ssl_ca_file = 'ca.crt'" }
    - { regexp: '#?listen_addresses\\s*=\\s*.*', line: "listen_addresses = '*'" }
    - { regexp: '#?max_connections\\s*=\\s*.*', line: "max_connections = 200" }
  become: true
  become_user: postgres
  notify: Restart postgresql

- name: Configure pg_hba.conf to allow connection from the Koji hub (IPv4 address)
  community.postgresql.postgresql_pg_hba:
    dest: /var/lib/pgsql/data/pg_hba.conf
    contype: hostssl
    databases: "{{ koji_db_name }}"
    users: "{{ koji_db_user }}"
    address: "{{ hostvars[item].ansible_default_ipv4.address }}/32"
    method: scram-sha-256
    backup: true
  loop: "{{ groups['kojihub'] }}"
  notify: Restart postgresql

- name: Configure pg_hba.conf to allow IPv6 connection from the Koji hub
  community.postgresql.postgresql_pg_hba:
    dest: /var/lib/pgsql/data/pg_hba.conf
    contype: hostssl
    databases: "{{ koji_db_name }}"
    users: "{{ koji_db_user }}"
    address: "{{ hostvars[item].ansible_default_ipv6.address }}/128"
    method: scram-sha-256
    backup: true
  loop: "{{ groups['kojihub'] }}"
  when: hostvars[item].ansible_default_ipv6.address is defined
  notify: Restart postgresql

- name: Configure pg_hba.conf for local postgres user trust authentication
  community.postgresql.postgresql_pg_hba:
    dest: /var/lib/pgsql/data/pg_hba.conf
    contype: local
    databases: all
    users: postgres
    method: peer
    backup: true
  notify: Restart postgresql

- name: Flush handlers
  ansible.builtin.meta: flush_handlers

- name: Create Koji database user
  community.postgresql.postgresql_user:
    name: "{{ koji_db_user }}"
    password: "{{ koji_db_password }}"
  become: true
  become_user: postgres

- name: Create Koji database
  community.postgresql.postgresql_db:
    name: "{{ koji_db_name }}"
    owner: "{{ koji_db_user }}"
  become: true
  become_user: postgres

- name: Open firewall for PostgreSQL
  ansible.posix.firewalld:
    port: 5432/tcp
    permanent: true
    state: enabled
  notify: Reload firewalld