Use role "geerlingguy.postgresql"

host_vars/postgres.crypto-libertarian.com.yml

@@ -17,72 +17,76 @@ common__certbot__cert_domains:
 common__certbot__post_hook: null
 common__certbot__pre_hook: null
 
-postgres__hba:
+postgresql_global_config_options:
+  - option: listen_addresses
+    value: '*'
+
+postgresql_hba_entries:
   - type: local
     database: all
     user: postgres
-    method: peer
+    auth_method: peer
 
   - type: local
     database: all
     user: all
-    method: peer
+    auth_method: peer
 
   - type: host
     database: all
     user: all
     address: '127.0.0.1/32'
-    method: md5
+    auth_method: md5
 
   - type: host
     database: all
     user: all
     address: '::1/128'
-    method: md5
+    auth_method: md5
 
   - type: local
     database: replication
     user: all
-    method: peer
+    auth_method: peer
 
   - type: host
     database: replication
     user: all
     address: '127.0.0.1/32'
-    method: md5
+    auth_method: md5
 
   - type: host
     database: replication
     user: all
     address: '::1/128'
-    method: md5
+    auth_method: md5
 
   - type: hostssl
     database: matrix_synapse
     user: matrix_synapse
     address: '134.209.196.172/32'
-    method: md5
+    auth_method: md5
 
   - type: hostssl
     database: matrix_synapse
     user: matrix_synapse
     address: '2a03:b0c0:2:f0::142:3001/128'
-    method: md5
+    auth_method: md5
 
   - type: hostssl
     database: matrix_synapse
     user: matrix_synapse
     address: '10.133.8.214/32'
-    method: md5
+    auth_method: md5
 
   - type: host
     database: all
     user: all
     address: '0.0.0.0/0'
-    method: reject
+    auth_method: reject
 
   - type: host
     database: all
     user: all
     address: '::/0'
-    method: reject
+    auth_method: reject

playbooks/deploy/postgres.yml

@@ -7,4 +7,4 @@
       cache_valid_time: 86400
   roles:
     - kotovalexarian.common
-    - ../../roles/postgres
+    - geerlingguy.postgresql

requirements.yml

@@ -1,3 +1,5 @@
 ---
 - src: kotovalexarian.common
   version: v0.0.35
+- src: geerlingguy.postgresql
+  version: 2.2.1

roles/postgres/defaults/main.yml

@@ -1,44 +0,0 @@
----
-postgres__hba:
-  - type: local
-    database: all
-    user: postgres
-    method: peer
-
-  - type: local
-    database: all
-    user: all
-    method: peer
-
-  - type: host
-    database: all
-    user: all
-    address: '127.0.0.1/32'
-    method: md5
-
-  - type: host
-    database: all
-    user: all
-    address: '::1/128'
-    method: md5
-
-  - type: local
-    database: replication
-    user: all
-    method: peer
-
-  - type: host
-    database: replication
-    user: all
-    address: '127.0.0.1/32'
-    method: md5
-
-  - type: host
-    database: replication
-    user: all
-    address: '::1/128'
-    method: md5
-
-postgres__config:
-  - key: listen_addresses
-    value: '*'

roles/postgres/handlers/main.yml

@@ -1,5 +0,0 @@
----
-- name: Restart Postgres
-  systemd:
-    name: postgresql@12-main
-    state: restarted

roles/postgres/tasks/main.yml

@@ -1,23 +0,0 @@
----
-- name: Install system packages
-  apt:
-    name: postgresql
-  notify: Restart Postgres
-
-- name: Install pg_hba.conf
-  template:
-    src: '../templates/pg_hba.conf'
-    dest: '/etc/postgresql/12/main/pg_hba.conf'
-    mode: 'u=rw,g=r,o='
-    owner: postgres
-    group: postgres
-  notify: Restart Postgres
-
-- name: Change config
-  lineinfile:
-    dest: '/etc/postgresql/12/main/postgresql.conf'
-    regexp: '^#?{{ item.key }}(( |=).*)?$'
-    line: "{{ item.key }} = '{{ item.value }}'"
-    state: "{{ item.state | default('present') }}"
-  with_items: '{{ postgres__config }}'
-  notify: Restart Postgres

roles/postgres/templates/pg_hba.conf

@@ -1,77 +0,0 @@
-# PostgreSQL Client Authentication Configuration File
-# ===================================================
-#
-# Refer to the "Client Authentication" section in the PostgreSQL
-# documentation for a complete description of this file.  A short
-# synopsis follows.
-#
-# This file controls: which hosts are allowed to connect, how clients
-# are authenticated, which PostgreSQL user names they can use, which
-# databases they can access.  Records take one of these forms:
-#
-# local      DATABASE  USER  METHOD  [OPTIONS]
-# host       DATABASE  USER  ADDRESS  METHOD  [OPTIONS]
-# hostssl    DATABASE  USER  ADDRESS  METHOD  [OPTIONS]
-# hostnossl  DATABASE  USER  ADDRESS  METHOD  [OPTIONS]
-#
-# (The uppercase items must be replaced by actual values.)
-#
-# The first field is the connection type: "local" is a Unix-domain
-# socket, "host" is either a plain or SSL-encrypted TCP/IP socket,
-# "hostssl" is an SSL-encrypted TCP/IP socket, and "hostnossl" is a
-# plain TCP/IP socket.
-#
-# DATABASE can be "all", "sameuser", "samerole", "replication", a
-# database name, or a comma-separated list thereof. The "all"
-# keyword does not match "replication". Access to replication
-# must be enabled in a separate record (see example below).
-#
-# USER can be "all", a user name, a group name prefixed with "+", or a
-# comma-separated list thereof.  In both the DATABASE and USER fields
-# you can also write a file name prefixed with "@" to include names
-# from a separate file.
-#
-# ADDRESS specifies the set of hosts the record matches.  It can be a
-# host name, or it is made up of an IP address and a CIDR mask that is
-# an integer (between 0 and 32 (IPv4) or 128 (IPv6) inclusive) that
-# specifies the number of significant bits in the mask.  A host name
-# that starts with a dot (.) matches a suffix of the actual host name.
-# Alternatively, you can write an IP address and netmask in separate
-# columns to specify the set of hosts.  Instead of a CIDR-address, you
-# can write "samehost" to match any of the server's own IP addresses,
-# or "samenet" to match any address in any subnet that the server is
-# directly connected to.
-#
-# METHOD can be "trust", "reject", "md5", "password", "scram-sha-256",
-# "gss", "sspi", "ident", "peer", "pam", "ldap", "radius" or "cert".
-# Note that "password" sends passwords in clear text; "md5" or
-# "scram-sha-256" are preferred since they send encrypted passwords.
-#
-# OPTIONS are a set of options for the authentication in the format
-# NAME=VALUE.  The available options depend on the different
-# authentication methods -- refer to the "Client Authentication"
-# section in the documentation for a list of which options are
-# available for which authentication methods.
-#
-# Database and user names containing spaces, commas, quotes and other
-# special characters must be quoted.  Quoting one of the keywords
-# "all", "sameuser", "samerole" or "replication" makes the name lose
-# its special character, and just match a database or username with
-# that name.
-#
-# This file is read on server startup and when the server receives a
-# SIGHUP signal.  If you edit the file on a running system, you have to
-# SIGHUP the server for the changes to take effect, run "pg_ctl reload",
-# or execute "SELECT pg_reload_conf()".
-#
-# Put your actual configuration here
-# ----------------------------------
-#
-# If you want to allow non-local connections, you need to add more
-# "host" records.  In that case you will also need to make PostgreSQL
-# listen on a non-local interface via the listen_addresses
-# configuration parameter, or via the -i or -h command line switches.
-
-{% for item in postgres__hba %}
-{{ item.type }} {{ item.database }} {{ item.user }} {{ item.address | default('') }} {{ item.method }}
-{% endfor %}