first commit

tasks/Debian/main.yaml

@@ -0,0 +1,69 @@
+- name: Add gpg package
+  apt:
+    name: gpg
+
+- name: Add gpg keys for patroni
+  ansible.builtin.apt_key:
+    url: "{{ item.url }}"
+    keyring: "{{ item.keyring }}"
+  loop: "{{ patroni_apt_key }}"
+
+- name: Add Patroni repository
+  apt_repository:
+    repo: "{{ item.repo }}"
+    state: present
+    filename: "{{ item.filename }}"
+    update_cache: yes
+  loop: "{{ patroni_apt_repository }}" 
+
+- name: Check if PostgreSQL is installed
+  ansible.builtin.shell: dpkg-query -l {{ patroni_postgresql_package_name }} 2>&1 | grep {{ patroni_postgresql_version }}
+  ignore_errors: True
+  register: is_patroni_postgresql
+  changed_when: is_patroni_postgresql.rc != 0
+  failed_when: False
+
+- name: Mask PostgreSQL before install
+  ansible.builtin.systemd:
+    name: "{{ patroni_postgresql_package_name }}"
+    masked: yes
+  when: is_patroni_postgresql.rc != 0
+
+- name: "Install {{ patroni_postgresql_package_name }}-{{ patroni_postgresql_version }}"
+  apt:
+    name: "{{ patroni_postgresql_package }}"
+    update_cache: yes
+  register: patroni_postgresql_setup
+  when: is_patroni_postgresql.rc != 0
+
+- name: Unmask PostgreSQL after install
+  ansible.builtin.systemd:
+    name: "{{ patroni_postgresql_package_name }}"
+    masked: no
+  when: is_patroni_postgresql.rc != 0
+
+- name: Check if Patroni is installed
+  ansible.builtin.shell: dpkg-query -l {{ patroni_package_name }} 2>&1 | grep {{ patroni_version }}
+  ignore_errors: True
+  register: is_patroni
+  changed_when: is_patroni.rc != 0
+  failed_when: False
+
+- name: Mask Patroni before install
+  ansible.builtin.systemd:
+    name: "{{ patroni_package_name }}"
+    masked: yes
+  when: is_patroni.rc != 0
+
+- name: "Install {{ patroni_package_name }}-{{ patroni_version }}"
+  apt:
+    name: "{{ patroni_package }}"
+    update_cache: yes
+  register: patroni_setup
+  when: is_patroni.rc != 0
+
+- name: Unmask Patroni after install
+  ansible.builtin.systemd:
+    name: "{{ patroni_package_name }}"
+    masked: no
+  when: is_patroni.rc != 0

tasks/RedHat/cacert.yaml

@@ -0,0 +1,177 @@
+- name: Check if ssl dir exist
+  file: 
+    name: "{{ patroni_ssl_path }}"
+    state: directory
+    owner: postgres
+    group: postgres
+  when: patroni_ssl
+
+- name: Add predefined ssl cert for Patroni
+  copy:
+    src: "{{ patroni_cert_name }}"
+    dest: "{{ patroni_ssl_path }}/{{ patroni_cert_name }}"
+    owner: postgres
+    group: postgres
+  notify: Restart Patroni
+  when: patroni_cert is defined
+
+- name: Generate OpenSSL key and cert for Patroni
+  when: "inventory_hostname == groups.patroni|first"
+  block:
+    - name: Generate an OpenSSL private CA key with the default values (4096 bits, RSA)
+      community.crypto.openssl_privatekey:
+        path: "{{ patroni_ssl_path }}/CA-{{ patroni_self_signed_cert_name }}.key"
+        owner: postgres
+        group: postgres
+      when: patroni_cert is not defined
+      register: patroni_ca_key_gen
+
+    - name: Generate an OpenSSL Certificate Signing Request
+      community.crypto.openssl_csr:
+        path: "{{ patroni_ssl_path }}/CA-{{ patroni_self_signed_cert_name }}.csr"
+        privatekey_path: "{{ patroni_ssl_path }}/CA-{{ patroni_self_signed_cert_name }}.key"
+        use_common_name_for_san: false
+        basic_constraints:
+          - 'CA:TRUE'
+        basic_constraints_critical: yes
+        key_usage:
+          - keyCertSign
+        key_usage_critical: true
+        common_name: "CA-{{ patroni_self_signed_cert_name }}"
+        owner: postgres
+        group: postgres
+      register: patroni_ca_csr
+    
+    - name: Generate a Self Signed OpenSSL CA certificate
+      community.crypto.x509_certificate:
+        path: "{{ patroni_ssl_path }}/CA-{{ patroni_self_signed_cert_name }}.crt"
+        csr_path: "{{ patroni_ssl_path }}/CA-{{ patroni_self_signed_cert_name }}.csr"
+        privatekey_path: "{{ patroni_ssl_path }}/CA-{{ patroni_self_signed_cert_name }}.key"
+        provider: selfsigned
+        owner: postgres
+        group: postgres
+      when: patroni_cert is not defined
+      register: patroni_ca_cert_gen
+
+    - name: Generate an OpenSSL private client key with the default values (4096 bits, RSA)
+      community.crypto.openssl_privatekey:
+        path: "{{ patroni_ssl_path }}/{{ patroni_self_signed_cert_name }}.key"
+        owner: postgres
+        group: postgres
+      when: patroni_cert is not defined
+      register: patroni_key_gen
+
+    - name: Generate subject_alt_ips
+      set_fact:
+        client_subject_alt_ips: "{{ groups.patroni | map('extract', hostvars, ['ansible_host']) | map('regex_replace', '^', 'IP:') | list }}"
+
+    - name: Print alt subjects ips
+      debug:
+        msg: "{{ client_subject_alt_ips }}"
+        verbosity: 2
+
+    - name: Generate subject_alt_names
+      set_fact:
+        client_subject_alt_names: "{{ groups.patroni | map('extract', hostvars, ['inventory_hostname']) | map('regex_replace', '^', 'DNS:') | list }}"
+
+    - name: Print alt subjects names
+      debug:
+        msg: "{{ client_subject_alt_names }}"
+        verbosity: 2
+
+    - name: Generate an OpenSSL Certificate Signing Request for client
+      community.crypto.openssl_csr:
+        path: "{{ patroni_ssl_path }}/{{ patroni_self_signed_cert_name }}.csr"
+        privatekey_path: "{{ patroni_ssl_path }}/{{ patroni_self_signed_cert_name }}.key"
+        common_name: "{{ patroni_self_signed_cert_name }}"
+        subject_alt_name: "{{ (( groups.patroni | map('extract', hostvars, ['ansible_host']) | map('regex_replace', '^', 'IP:') | list | default([])) + (groups.patroni | map('extract', hostvars, ['inventory_hostname']) | map('regex_replace', '^', 'DNS:') | list | default([]))) }}"
+        owner: postgres
+        group: postgres
+      register: patroni_csr
+
+    - name: Generate an OpenSSL certificate for client signed with your own CA certificate
+      community.crypto.x509_certificate:
+        path: "{{ patroni_ssl_path }}/{{ patroni_self_signed_cert_name }}.crt"
+        csr_path: "{{ patroni_ssl_path }}/{{ patroni_self_signed_cert_name }}.csr"
+        ownca_path: "{{ patroni_ssl_path }}/CA-{{ patroni_self_signed_cert_name }}.crt"
+        ownca_privatekey_path: "{{ patroni_ssl_path }}/CA-{{ patroni_self_signed_cert_name }}.key"
+        provider: ownca
+        owner: postgres
+        group: postgres
+      register: patroni_cert
+
+    - name: Get CA cert content
+      slurp:
+        src: "{{ patroni_ssl_path }}/CA-{{ patroni_self_signed_cert_name }}.crt"
+      register: patroni_ca_cert_b64
+
+    - name: Get CA key content
+      slurp:
+        src: "{{ patroni_ssl_path }}/CA-{{ patroni_self_signed_cert_name }}.key"
+      register: patroni_ca_key_b64
+
+    - name: Get client cert content
+      slurp:
+        src: "{{ patroni_ssl_path }}/{{ patroni_self_signed_cert_name }}.crt"
+      register: patroni_cert_b64
+
+    - name: Get client key content
+      slurp:
+        src: "{{ patroni_ssl_path }}/{{ patroni_self_signed_cert_name }}.key"
+      register: patroni_key_b64
+
+    - name: Set facts about key and cert
+      set_fact:
+        patroni_ca_key: "{{ patroni_ca_key_b64.content | b64decode }}"
+        patroni_ca_cert: "{{ patroni_ca_cert_b64.content | b64decode }}"
+        patroni_key: "{{ patroni_key_b64.content | b64decode }}"
+        patroni_cert: "{{ patroni_cert_b64.content | b64decode }}"
+      delegate_to: "{{ item }}"
+      delegate_facts: true
+      run_once: true
+      loop: "{{ groups.patroni }}"
+
+- name: Put Patroni CA OpenSSL key
+  copy:
+    content: "{{ patroni_ca_key }}"
+    dest: "{{ patroni_ssl_path }}/CA-{{ patroni_self_signed_cert_name }}.key"
+    owner: postgres
+    group: postgres
+    mode: 0600
+  notify: Restart Patroni
+
+- name: Put Patroni CA OpenSSL cert
+  copy:
+    content: "{{ patroni_ca_cert }}"
+    dest: "{{ patroni_ssl_path }}/CA-{{ patroni_self_signed_cert_name }}.crt"
+    owner: postgres
+    group: postgres
+  notify: Restart Patroni
+
+- name: Put Patroni CA OpenSSL cert to PKI
+  copy:
+    content: "{{ patroni_ca_cert }}"
+    dest: "/etc/pki/ca-trust/source/anchors/CA-{{ patroni_self_signed_cert_name }}.crt"
+  register: ca_trust_anchors
+  notify: Restart Patroni
+
+- name: Update CA trust
+  shell: update-ca-trust extract
+  when: ca_trust_anchors.changed
+
+- name: Put Patroni OpenSSL key
+  copy:
+    content: "{{ patroni_key }}"
+    dest: "{{ patroni_ssl_path }}/{{ patroni_self_signed_cert_name }}.key"
+    owner: postgres
+    group: postgres
+    mode: 0600
+  notify: Restart Patroni
+
+- name: Put Patroni OpenSSL cert
+  copy:
+    content: "{{ patroni_cert }}"
+    dest: "{{ patroni_ssl_path }}/{{ patroni_self_signed_cert_name }}.crt"
+    owner: postgres
+    group: postgres
+  notify: Restart Patroni

tasks/RedHat/install.yaml

@@ -0,0 +1,45 @@
+- name: Install Patroni {{ patroni_version }} with Python 3.6
+  when: "patroni_use_python39 is not defined or not patroni_use_python39"
+  block:
+    - name: Add Patroni repository
+      dnf: 
+        name: "{{ patroni_repo_package }}"
+        state: present     
+        disable_gpg_check: yes
+    
+    - name: "Install Patroni {{ patroni_version }} with Python 3.6"
+      dnf:
+        name: "{{ item }}"
+        state: present
+        disable_gpg_check: yes
+        update_cache: yes
+      loop:
+        - "{{ patroni_default_packages }}"
+      register: patroni_setup
+
+- name: Install Patroni {{ patroni_version }} with Python 3.9
+  when:
+    - patroni_use_python39 is defined
+    - patroni_use_python39
+  block:
+    - name: Enable Python 3.9 module
+      shell: dnf module enable -y python39
+      register: enable_python39_module
+      changed_when: "'Nothing to do' not in enable_python39_module.stdout"
+    
+    - name: Install Python 3.9
+      dnf:
+        name: python39
+        state: present
+    
+    - name: Set python3.9 as python 
+      shell: alternatives --set python /usr/bin/python3.9
+      register: set_python39_as_python
+      changed_when: false
+      failed_when: set_python39_as_python.stdout != ''
+    
+    - name: "Install Patroni {{ patroni_version }} with Python 3.9"
+      dnf:
+        name: "{{ patroni_python39_packages }}"
+        disablerepo: pgdg*
+        state: latest

tasks/RedHat/main.yaml

@@ -0,0 +1,44 @@
+- name: Disable PostgreSQL module
+  shell: dnf module disable -y postgresql
+  register: disable_postgresql_module
+  changed_when: "'Nothing to do' not in disable_postgresql_module.stdout"
+
+- name: "Install EPEL"
+  dnf:
+    name: "epel-release"
+    state: present
+
+- name: Add PostgreSQL repository
+  dnf:
+    name: "{{ patroni_postgresql_repo_package }}"
+    state: present     
+    disable_gpg_check: yes
+  when: patroni_postgresql_install_repo
+
+- name: "Install PostgreSQL {{ patroni_postgresql_version }}"
+  dnf:
+    name: "{{ item }}"
+    state: present
+    disable_gpg_check: yes
+  loop:
+    - "{{ patroni_postgresql_packages }}"
+  register: patroni_postgresql_setup
+
+- name: Manage TLS/SSL certificates
+  include_tasks: cacert.yaml
+  when: patroni_ssl
+
+- name: Add WAL-G to patroni_create_replica_methods
+  set_fact:
+    patroni_create_replica_methods: "{{ patroni_create_replica_methods + [ 'wal_g' ] }}"
+  when: patroni_wal_g_install
+
+- name: Include WAL-G role
+  ansible.builtin.include_role:
+    name: wal-g
+  vars:
+    wal_g_pg: yes
+  when: patroni_wal_g_install
+
+- name: Include Patroni {{ patroni_version }} install
+  include_tasks: install.yaml

tasks/RedHat/python36.yaml

@@ -0,0 +1,15 @@
+- name: Add Patroni repository
+  dnf: 
+    name: "{{ patroni_repo_package }}"
+    state: present     
+    disable_gpg_check: yes
+
+- name: "Install Patroni {{ patroni_version }} with Python 3.6"
+  dnf:
+    name: "{{ item }}"
+    state: present
+    disable_gpg_check: yes
+    update_cache: yes
+  loop:
+    - "{{ patroni_default_packages }}"
+  register: patroni_setup

tasks/RedHat/python39.yaml

@@ -0,0 +1,21 @@
+- name: Enable Python 3.9 module
+  shell: dnf module enable -y python39
+  register: enable_python39_module
+  changed_when: "'Nothing to do' not in enable_python39_module.stdout"
+
+- name: Install Python 3.9
+  dnf:
+    name: python39
+    state: present
+
+- name: Set python3.9 as python 
+  shell: alternatives --set python /usr/bin/python3.9
+  register: set_python39_as_python
+  changed_when: false
+  failed_when: set_python39_as_python.stdout != ''
+
+- name: "Install Patroni {{ patroni_version }} with Python 3.9"
+  dnf:
+    name: "{{ patroni_python39_packages }}"
+    disablerepo: pgdg*
+    state: latest

tasks/config.yaml

@@ -0,0 +1,38 @@
+---
+- name: Merge user options for PostgreSQL part of Patroni config
+  set_fact:
+    patroni_postgresql_parameters_combined: "{{ patroni_postgresql_default_parameters | combine(patroni_postgresql_parameters|default({}), recursive=true) }}"
+
+- name: Template Patroni default config
+  set_fact:
+    patroni_default_config: "{{ lookup('template', 'patroni.yaml.j2') | from_yaml }}"
+
+- name: Print Patroni default config
+  debug:
+    msg: "{{ patroni_default_config }}"
+    verbosity: 2
+
+- name: Merge user options with default Patroni config
+  set_fact:
+    patroni_config_combined: "{{ patroni_default_config | combine(patroni_config|default({}), recursive=true) }}"
+
+- name: Create folder for Patroni config
+  file:
+    name: "{{ item }}"
+    state: directory
+    owner: "postgres"
+    group: "postgres"
+  loop:
+    - /etc/patroni
+    - /var/log/postgresql
+    - /var/lib/pgsql_stats_tmp
+
+- name: Propagate Patroni config
+  copy:
+    content: "{{ patroni_config_combined | to_nice_yaml }}"
+    dest: "/etc/patroni/patroni.yml"
+    owner: "postgres"
+    group: "postgres"
+    mode: 0644
+  register: patroni_config_file
+  notify: Restart Patroni

tasks/dynamic_config.yaml

@@ -0,0 +1,38 @@
+---
+- name: Propagate Patroni dynamic config
+  copy:
+    content: "{{ patroni_postgresql_dynamic_parameters | to_nice_json }}"
+    dest: "/etc/patroni/dynamic.json"
+    owner: "postgres"
+    group: "postgres"
+    mode: 0644
+  register: patroni_dynamic_config_file
+
+- name: Dynamic configuration parameters for Patroni
+  when: patroni_dynamic_config_file.changed
+  block:
+    - name: Find Patroni master
+      ansible.builtin.uri:
+        url: "{{ 'https://' if patroni_ssl else 'http://' }}{{ hostvars[inventory_hostname]['ansible_default_ipv4']['address'] }}:{{ patroni_restapi_listen_port }}"
+        method: GET
+        body_format: json
+        status_code:
+          - 200
+          - 503
+      register: patroni_role
+
+    - name: Set fact about roles
+      set_fact:
+        role: "{{ patroni_role.json.role }}"
+
+    - name: Apply dynamic configuration parameters for Patroni
+      ansible.builtin.uri:
+        url: "{{ 'https://' if patroni_ssl else 'http://' }}{{ hostvars[inventory_hostname]['ansible_default_ipv4']['address'] }}:{{ patroni_restapi_listen_port }}/config"
+        user: "{{ patroni_restapi_username }}"
+        password: "{{ patroni_restapi_password }}"
+        method: PATCH
+        body: "{{ patroni_postgresql_dynamic_parameters | to_nice_json }}"
+        force_basic_auth: yes
+      when:
+        - "hostvars[inventory_hostname]['role'] == 'master'"
+

tasks/main.yaml

@@ -0,0 +1,45 @@
+- name: Make sure handlers are flushed immediately
+  meta: flush_handlers
+
+- name: Load a variable file based on the OS type
+  include_vars: "{{ lookup('first_found', params) }}"
+  vars:
+    params:
+      files:
+        - "{{ ansible_facts['distribution'] }}.yaml"
+        - "{{ ansible_facts['os_family'] }}.yaml"
+      paths:
+        - "vars"
+  tags: always, patroni_vars
+
+- name: Task name
+  stat:
+    path: /etc/patroni/patroni.yaml
+  register: patroni_config
+
+- name: "Install Patroni for {{ ansible_facts['os_family'] }}"
+  include_tasks: "{{ ansible_facts['os_family'] }}/main.yaml"
+  tags: patroni_install
+
+- name: "Bootstrap Patroni configuration"
+  include_tasks: config.yaml
+  when: not patroni_config.stat.exists
+  tags: patroni_configure
+
+- name: Enable and start patroni
+  systemd:
+    daemon_reload: true
+    name: patroni
+    enabled: true
+    state: started
+    masked: no
+  register: patroni_enable_and_start
+  tags: patroni, patroni_start
+
+- name: "Dynamic Patroni configuration"
+  include_tasks: dynamic_config.yaml
+  when:
+  #- patroni_config.stat.exists
+    - patroni_postgresql_dynamic_parameters
+  tags: patroni_dynamic_configure
+