From 8cb61793deb1cf886a9fd2b1a43ea8043d1beae7 Mon Sep 17 00:00:00 2001 From: Alex Kotov Date: Sun, 5 Jul 2020 11:58:00 +0500 Subject: [PATCH] Use role "geerlingguy.postgresql" --- host_vars/postgres.crypto-libertarian.com.yml | 30 ++++---- playbooks/deploy/postgres.yml | 2 +- requirements.yml | 2 + roles/postgres/defaults/main.yml | 44 ----------- roles/postgres/handlers/main.yml | 5 -- roles/postgres/tasks/main.yml | 23 ------ roles/postgres/templates/pg_hba.conf | 77 ------------------- 7 files changed, 20 insertions(+), 163 deletions(-) delete mode 100644 roles/postgres/defaults/main.yml delete mode 100644 roles/postgres/handlers/main.yml delete mode 100644 roles/postgres/tasks/main.yml delete mode 100644 roles/postgres/templates/pg_hba.conf diff --git a/host_vars/postgres.crypto-libertarian.com.yml b/host_vars/postgres.crypto-libertarian.com.yml index 160a073..51a8f20 100644 --- a/host_vars/postgres.crypto-libertarian.com.yml +++ b/host_vars/postgres.crypto-libertarian.com.yml @@ -17,72 +17,76 @@ common__certbot__cert_domains: common__certbot__post_hook: null common__certbot__pre_hook: null -postgres__hba: +postgresql_global_config_options: + - option: listen_addresses + value: '*' + +postgresql_hba_entries: - type: local database: all user: postgres - method: peer + auth_method: peer - type: local database: all user: all - method: peer + auth_method: peer - type: host database: all user: all address: '127.0.0.1/32' - method: md5 + auth_method: md5 - type: host database: all user: all address: '::1/128' - method: md5 + auth_method: md5 - type: local database: replication user: all - method: peer + auth_method: peer - type: host database: replication user: all address: '127.0.0.1/32' - method: md5 + auth_method: md5 - type: host database: replication user: all address: '::1/128' - method: md5 + auth_method: md5 - type: hostssl database: matrix_synapse user: matrix_synapse address: '134.209.196.172/32' - method: md5 + auth_method: md5 - type: hostssl database: matrix_synapse user: matrix_synapse address: '2a03:b0c0:2:f0::142:3001/128' - method: md5 + auth_method: md5 - type: hostssl database: matrix_synapse user: matrix_synapse address: '10.133.8.214/32' - method: md5 + auth_method: md5 - type: host database: all user: all address: '0.0.0.0/0' - method: reject + auth_method: reject - type: host database: all user: all address: '::/0' - method: reject + auth_method: reject diff --git a/playbooks/deploy/postgres.yml b/playbooks/deploy/postgres.yml index 1f9671d..9a48c75 100644 --- a/playbooks/deploy/postgres.yml +++ b/playbooks/deploy/postgres.yml @@ -7,4 +7,4 @@ cache_valid_time: 86400 roles: - kotovalexarian.common - - ../../roles/postgres + - geerlingguy.postgresql diff --git a/requirements.yml b/requirements.yml index d01241b..c17bacd 100644 --- a/requirements.yml +++ b/requirements.yml @@ -1,3 +1,5 @@ --- - src: kotovalexarian.common version: v0.0.35 +- src: geerlingguy.postgresql + version: 2.2.1 diff --git a/roles/postgres/defaults/main.yml b/roles/postgres/defaults/main.yml deleted file mode 100644 index c7dd439..0000000 --- a/roles/postgres/defaults/main.yml +++ /dev/null @@ -1,44 +0,0 @@ ---- -postgres__hba: - - type: local - database: all - user: postgres - method: peer - - - type: local - database: all - user: all - method: peer - - - type: host - database: all - user: all - address: '127.0.0.1/32' - method: md5 - - - type: host - database: all - user: all - address: '::1/128' - method: md5 - - - type: local - database: replication - user: all - method: peer - - - type: host - database: replication - user: all - address: '127.0.0.1/32' - method: md5 - - - type: host - database: replication - user: all - address: '::1/128' - method: md5 - -postgres__config: - - key: listen_addresses - value: '*' diff --git a/roles/postgres/handlers/main.yml b/roles/postgres/handlers/main.yml deleted file mode 100644 index 2b8a3bf..0000000 --- a/roles/postgres/handlers/main.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -- name: Restart Postgres - systemd: - name: postgresql@12-main - state: restarted diff --git a/roles/postgres/tasks/main.yml b/roles/postgres/tasks/main.yml deleted file mode 100644 index 385e5a6..0000000 --- a/roles/postgres/tasks/main.yml +++ /dev/null @@ -1,23 +0,0 @@ ---- -- name: Install system packages - apt: - name: postgresql - notify: Restart Postgres - -- name: Install pg_hba.conf - template: - src: '../templates/pg_hba.conf' - dest: '/etc/postgresql/12/main/pg_hba.conf' - mode: 'u=rw,g=r,o=' - owner: postgres - group: postgres - notify: Restart Postgres - -- name: Change config - lineinfile: - dest: '/etc/postgresql/12/main/postgresql.conf' - regexp: '^#?{{ item.key }}(( |=).*)?$' - line: "{{ item.key }} = '{{ item.value }}'" - state: "{{ item.state | default('present') }}" - with_items: '{{ postgres__config }}' - notify: Restart Postgres diff --git a/roles/postgres/templates/pg_hba.conf b/roles/postgres/templates/pg_hba.conf deleted file mode 100644 index 1f4df36..0000000 --- a/roles/postgres/templates/pg_hba.conf +++ /dev/null @@ -1,77 +0,0 @@ -# PostgreSQL Client Authentication Configuration File -# =================================================== -# -# Refer to the "Client Authentication" section in the PostgreSQL -# documentation for a complete description of this file. A short -# synopsis follows. -# -# This file controls: which hosts are allowed to connect, how clients -# are authenticated, which PostgreSQL user names they can use, which -# databases they can access. Records take one of these forms: -# -# local DATABASE USER METHOD [OPTIONS] -# host DATABASE USER ADDRESS METHOD [OPTIONS] -# hostssl DATABASE USER ADDRESS METHOD [OPTIONS] -# hostnossl DATABASE USER ADDRESS METHOD [OPTIONS] -# -# (The uppercase items must be replaced by actual values.) -# -# The first field is the connection type: "local" is a Unix-domain -# socket, "host" is either a plain or SSL-encrypted TCP/IP socket, -# "hostssl" is an SSL-encrypted TCP/IP socket, and "hostnossl" is a -# plain TCP/IP socket. -# -# DATABASE can be "all", "sameuser", "samerole", "replication", a -# database name, or a comma-separated list thereof. The "all" -# keyword does not match "replication". Access to replication -# must be enabled in a separate record (see example below). -# -# USER can be "all", a user name, a group name prefixed with "+", or a -# comma-separated list thereof. In both the DATABASE and USER fields -# you can also write a file name prefixed with "@" to include names -# from a separate file. -# -# ADDRESS specifies the set of hosts the record matches. It can be a -# host name, or it is made up of an IP address and a CIDR mask that is -# an integer (between 0 and 32 (IPv4) or 128 (IPv6) inclusive) that -# specifies the number of significant bits in the mask. A host name -# that starts with a dot (.) matches a suffix of the actual host name. -# Alternatively, you can write an IP address and netmask in separate -# columns to specify the set of hosts. Instead of a CIDR-address, you -# can write "samehost" to match any of the server's own IP addresses, -# or "samenet" to match any address in any subnet that the server is -# directly connected to. -# -# METHOD can be "trust", "reject", "md5", "password", "scram-sha-256", -# "gss", "sspi", "ident", "peer", "pam", "ldap", "radius" or "cert". -# Note that "password" sends passwords in clear text; "md5" or -# "scram-sha-256" are preferred since they send encrypted passwords. -# -# OPTIONS are a set of options for the authentication in the format -# NAME=VALUE. The available options depend on the different -# authentication methods -- refer to the "Client Authentication" -# section in the documentation for a list of which options are -# available for which authentication methods. -# -# Database and user names containing spaces, commas, quotes and other -# special characters must be quoted. Quoting one of the keywords -# "all", "sameuser", "samerole" or "replication" makes the name lose -# its special character, and just match a database or username with -# that name. -# -# This file is read on server startup and when the server receives a -# SIGHUP signal. If you edit the file on a running system, you have to -# SIGHUP the server for the changes to take effect, run "pg_ctl reload", -# or execute "SELECT pg_reload_conf()". -# -# Put your actual configuration here -# ---------------------------------- -# -# If you want to allow non-local connections, you need to add more -# "host" records. In that case you will also need to make PostgreSQL -# listen on a non-local interface via the listen_addresses -# configuration parameter, or via the -i or -h command line switches. - -{% for item in postgres__hba %} -{{ item.type }} {{ item.database }} {{ item.user }} {{ item.address | default('') }} {{ item.method }} -{% endfor %}