mirror of
https://gitea.0xace.cc/ansible-galaxy/patroni.git
synced 2025-06-29 02:53:07 +00:00
first commit
This commit is contained in:
177
tasks/RedHat/cacert.yaml
Normal file
177
tasks/RedHat/cacert.yaml
Normal file
@ -0,0 +1,177 @@
|
||||
- name: Check if ssl dir exist
|
||||
file:
|
||||
name: "{{ patroni_ssl_path }}"
|
||||
state: directory
|
||||
owner: postgres
|
||||
group: postgres
|
||||
when: patroni_ssl
|
||||
|
||||
- name: Add predefined ssl cert for Patroni
|
||||
copy:
|
||||
src: "{{ patroni_cert_name }}"
|
||||
dest: "{{ patroni_ssl_path }}/{{ patroni_cert_name }}"
|
||||
owner: postgres
|
||||
group: postgres
|
||||
notify: Restart Patroni
|
||||
when: patroni_cert is defined
|
||||
|
||||
- name: Generate OpenSSL key and cert for Patroni
|
||||
when: "inventory_hostname == groups.patroni|first"
|
||||
block:
|
||||
- name: Generate an OpenSSL private CA key with the default values (4096 bits, RSA)
|
||||
community.crypto.openssl_privatekey:
|
||||
path: "{{ patroni_ssl_path }}/CA-{{ patroni_self_signed_cert_name }}.key"
|
||||
owner: postgres
|
||||
group: postgres
|
||||
when: patroni_cert is not defined
|
||||
register: patroni_ca_key_gen
|
||||
|
||||
- name: Generate an OpenSSL Certificate Signing Request
|
||||
community.crypto.openssl_csr:
|
||||
path: "{{ patroni_ssl_path }}/CA-{{ patroni_self_signed_cert_name }}.csr"
|
||||
privatekey_path: "{{ patroni_ssl_path }}/CA-{{ patroni_self_signed_cert_name }}.key"
|
||||
use_common_name_for_san: false
|
||||
basic_constraints:
|
||||
- 'CA:TRUE'
|
||||
basic_constraints_critical: yes
|
||||
key_usage:
|
||||
- keyCertSign
|
||||
key_usage_critical: true
|
||||
common_name: "CA-{{ patroni_self_signed_cert_name }}"
|
||||
owner: postgres
|
||||
group: postgres
|
||||
register: patroni_ca_csr
|
||||
|
||||
- name: Generate a Self Signed OpenSSL CA certificate
|
||||
community.crypto.x509_certificate:
|
||||
path: "{{ patroni_ssl_path }}/CA-{{ patroni_self_signed_cert_name }}.crt"
|
||||
csr_path: "{{ patroni_ssl_path }}/CA-{{ patroni_self_signed_cert_name }}.csr"
|
||||
privatekey_path: "{{ patroni_ssl_path }}/CA-{{ patroni_self_signed_cert_name }}.key"
|
||||
provider: selfsigned
|
||||
owner: postgres
|
||||
group: postgres
|
||||
when: patroni_cert is not defined
|
||||
register: patroni_ca_cert_gen
|
||||
|
||||
- name: Generate an OpenSSL private client key with the default values (4096 bits, RSA)
|
||||
community.crypto.openssl_privatekey:
|
||||
path: "{{ patroni_ssl_path }}/{{ patroni_self_signed_cert_name }}.key"
|
||||
owner: postgres
|
||||
group: postgres
|
||||
when: patroni_cert is not defined
|
||||
register: patroni_key_gen
|
||||
|
||||
- name: Generate subject_alt_ips
|
||||
set_fact:
|
||||
client_subject_alt_ips: "{{ groups.patroni | map('extract', hostvars, ['ansible_host']) | map('regex_replace', '^', 'IP:') | list }}"
|
||||
|
||||
- name: Print alt subjects ips
|
||||
debug:
|
||||
msg: "{{ client_subject_alt_ips }}"
|
||||
verbosity: 2
|
||||
|
||||
- name: Generate subject_alt_names
|
||||
set_fact:
|
||||
client_subject_alt_names: "{{ groups.patroni | map('extract', hostvars, ['inventory_hostname']) | map('regex_replace', '^', 'DNS:') | list }}"
|
||||
|
||||
- name: Print alt subjects names
|
||||
debug:
|
||||
msg: "{{ client_subject_alt_names }}"
|
||||
verbosity: 2
|
||||
|
||||
- name: Generate an OpenSSL Certificate Signing Request for client
|
||||
community.crypto.openssl_csr:
|
||||
path: "{{ patroni_ssl_path }}/{{ patroni_self_signed_cert_name }}.csr"
|
||||
privatekey_path: "{{ patroni_ssl_path }}/{{ patroni_self_signed_cert_name }}.key"
|
||||
common_name: "{{ patroni_self_signed_cert_name }}"
|
||||
subject_alt_name: "{{ (( groups.patroni | map('extract', hostvars, ['ansible_host']) | map('regex_replace', '^', 'IP:') | list | default([])) + (groups.patroni | map('extract', hostvars, ['inventory_hostname']) | map('regex_replace', '^', 'DNS:') | list | default([]))) }}"
|
||||
owner: postgres
|
||||
group: postgres
|
||||
register: patroni_csr
|
||||
|
||||
- name: Generate an OpenSSL certificate for client signed with your own CA certificate
|
||||
community.crypto.x509_certificate:
|
||||
path: "{{ patroni_ssl_path }}/{{ patroni_self_signed_cert_name }}.crt"
|
||||
csr_path: "{{ patroni_ssl_path }}/{{ patroni_self_signed_cert_name }}.csr"
|
||||
ownca_path: "{{ patroni_ssl_path }}/CA-{{ patroni_self_signed_cert_name }}.crt"
|
||||
ownca_privatekey_path: "{{ patroni_ssl_path }}/CA-{{ patroni_self_signed_cert_name }}.key"
|
||||
provider: ownca
|
||||
owner: postgres
|
||||
group: postgres
|
||||
register: patroni_cert
|
||||
|
||||
- name: Get CA cert content
|
||||
slurp:
|
||||
src: "{{ patroni_ssl_path }}/CA-{{ patroni_self_signed_cert_name }}.crt"
|
||||
register: patroni_ca_cert_b64
|
||||
|
||||
- name: Get CA key content
|
||||
slurp:
|
||||
src: "{{ patroni_ssl_path }}/CA-{{ patroni_self_signed_cert_name }}.key"
|
||||
register: patroni_ca_key_b64
|
||||
|
||||
- name: Get client cert content
|
||||
slurp:
|
||||
src: "{{ patroni_ssl_path }}/{{ patroni_self_signed_cert_name }}.crt"
|
||||
register: patroni_cert_b64
|
||||
|
||||
- name: Get client key content
|
||||
slurp:
|
||||
src: "{{ patroni_ssl_path }}/{{ patroni_self_signed_cert_name }}.key"
|
||||
register: patroni_key_b64
|
||||
|
||||
- name: Set facts about key and cert
|
||||
set_fact:
|
||||
patroni_ca_key: "{{ patroni_ca_key_b64.content | b64decode }}"
|
||||
patroni_ca_cert: "{{ patroni_ca_cert_b64.content | b64decode }}"
|
||||
patroni_key: "{{ patroni_key_b64.content | b64decode }}"
|
||||
patroni_cert: "{{ patroni_cert_b64.content | b64decode }}"
|
||||
delegate_to: "{{ item }}"
|
||||
delegate_facts: true
|
||||
run_once: true
|
||||
loop: "{{ groups.patroni }}"
|
||||
|
||||
- name: Put Patroni CA OpenSSL key
|
||||
copy:
|
||||
content: "{{ patroni_ca_key }}"
|
||||
dest: "{{ patroni_ssl_path }}/CA-{{ patroni_self_signed_cert_name }}.key"
|
||||
owner: postgres
|
||||
group: postgres
|
||||
mode: 0600
|
||||
notify: Restart Patroni
|
||||
|
||||
- name: Put Patroni CA OpenSSL cert
|
||||
copy:
|
||||
content: "{{ patroni_ca_cert }}"
|
||||
dest: "{{ patroni_ssl_path }}/CA-{{ patroni_self_signed_cert_name }}.crt"
|
||||
owner: postgres
|
||||
group: postgres
|
||||
notify: Restart Patroni
|
||||
|
||||
- name: Put Patroni CA OpenSSL cert to PKI
|
||||
copy:
|
||||
content: "{{ patroni_ca_cert }}"
|
||||
dest: "/etc/pki/ca-trust/source/anchors/CA-{{ patroni_self_signed_cert_name }}.crt"
|
||||
register: ca_trust_anchors
|
||||
notify: Restart Patroni
|
||||
|
||||
- name: Update CA trust
|
||||
shell: update-ca-trust extract
|
||||
when: ca_trust_anchors.changed
|
||||
|
||||
- name: Put Patroni OpenSSL key
|
||||
copy:
|
||||
content: "{{ patroni_key }}"
|
||||
dest: "{{ patroni_ssl_path }}/{{ patroni_self_signed_cert_name }}.key"
|
||||
owner: postgres
|
||||
group: postgres
|
||||
mode: 0600
|
||||
notify: Restart Patroni
|
||||
|
||||
- name: Put Patroni OpenSSL cert
|
||||
copy:
|
||||
content: "{{ patroni_cert }}"
|
||||
dest: "{{ patroni_ssl_path }}/{{ patroni_self_signed_cert_name }}.crt"
|
||||
owner: postgres
|
||||
group: postgres
|
||||
notify: Restart Patroni
|
||||
45
tasks/RedHat/install.yaml
Normal file
45
tasks/RedHat/install.yaml
Normal file
@ -0,0 +1,45 @@
|
||||
- name: Install Patroni {{ patroni_version }} with Python 3.6
|
||||
when: "patroni_use_python39 is not defined or not patroni_use_python39"
|
||||
block:
|
||||
- name: Add Patroni repository
|
||||
dnf:
|
||||
name: "{{ patroni_repo_package }}"
|
||||
state: present
|
||||
disable_gpg_check: yes
|
||||
|
||||
- name: "Install Patroni {{ patroni_version }} with Python 3.6"
|
||||
dnf:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
disable_gpg_check: yes
|
||||
update_cache: yes
|
||||
loop:
|
||||
- "{{ patroni_default_packages }}"
|
||||
register: patroni_setup
|
||||
|
||||
- name: Install Patroni {{ patroni_version }} with Python 3.9
|
||||
when:
|
||||
- patroni_use_python39 is defined
|
||||
- patroni_use_python39
|
||||
block:
|
||||
- name: Enable Python 3.9 module
|
||||
shell: dnf module enable -y python39
|
||||
register: enable_python39_module
|
||||
changed_when: "'Nothing to do' not in enable_python39_module.stdout"
|
||||
|
||||
- name: Install Python 3.9
|
||||
dnf:
|
||||
name: python39
|
||||
state: present
|
||||
|
||||
- name: Set python3.9 as python
|
||||
shell: alternatives --set python /usr/bin/python3.9
|
||||
register: set_python39_as_python
|
||||
changed_when: false
|
||||
failed_when: set_python39_as_python.stdout != ''
|
||||
|
||||
- name: "Install Patroni {{ patroni_version }} with Python 3.9"
|
||||
dnf:
|
||||
name: "{{ patroni_python39_packages }}"
|
||||
disablerepo: pgdg*
|
||||
state: latest
|
||||
44
tasks/RedHat/main.yaml
Normal file
44
tasks/RedHat/main.yaml
Normal file
@ -0,0 +1,44 @@
|
||||
- name: Disable PostgreSQL module
|
||||
shell: dnf module disable -y postgresql
|
||||
register: disable_postgresql_module
|
||||
changed_when: "'Nothing to do' not in disable_postgresql_module.stdout"
|
||||
|
||||
- name: "Install EPEL"
|
||||
dnf:
|
||||
name: "epel-release"
|
||||
state: present
|
||||
|
||||
- name: Add PostgreSQL repository
|
||||
dnf:
|
||||
name: "{{ patroni_postgresql_repo_package }}"
|
||||
state: present
|
||||
disable_gpg_check: yes
|
||||
when: patroni_postgresql_install_repo
|
||||
|
||||
- name: "Install PostgreSQL {{ patroni_postgresql_version }}"
|
||||
dnf:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
disable_gpg_check: yes
|
||||
loop:
|
||||
- "{{ patroni_postgresql_packages }}"
|
||||
register: patroni_postgresql_setup
|
||||
|
||||
- name: Manage TLS/SSL certificates
|
||||
include_tasks: cacert.yaml
|
||||
when: patroni_ssl
|
||||
|
||||
- name: Add WAL-G to patroni_create_replica_methods
|
||||
set_fact:
|
||||
patroni_create_replica_methods: "{{ patroni_create_replica_methods + [ 'wal_g' ] }}"
|
||||
when: patroni_wal_g_install
|
||||
|
||||
- name: Include WAL-G role
|
||||
ansible.builtin.include_role:
|
||||
name: wal-g
|
||||
vars:
|
||||
wal_g_pg: yes
|
||||
when: patroni_wal_g_install
|
||||
|
||||
- name: Include Patroni {{ patroni_version }} install
|
||||
include_tasks: install.yaml
|
||||
15
tasks/RedHat/python36.yaml
Normal file
15
tasks/RedHat/python36.yaml
Normal file
@ -0,0 +1,15 @@
|
||||
- name: Add Patroni repository
|
||||
dnf:
|
||||
name: "{{ patroni_repo_package }}"
|
||||
state: present
|
||||
disable_gpg_check: yes
|
||||
|
||||
- name: "Install Patroni {{ patroni_version }} with Python 3.6"
|
||||
dnf:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
disable_gpg_check: yes
|
||||
update_cache: yes
|
||||
loop:
|
||||
- "{{ patroni_default_packages }}"
|
||||
register: patroni_setup
|
||||
21
tasks/RedHat/python39.yaml
Normal file
21
tasks/RedHat/python39.yaml
Normal file
@ -0,0 +1,21 @@
|
||||
- name: Enable Python 3.9 module
|
||||
shell: dnf module enable -y python39
|
||||
register: enable_python39_module
|
||||
changed_when: "'Nothing to do' not in enable_python39_module.stdout"
|
||||
|
||||
- name: Install Python 3.9
|
||||
dnf:
|
||||
name: python39
|
||||
state: present
|
||||
|
||||
- name: Set python3.9 as python
|
||||
shell: alternatives --set python /usr/bin/python3.9
|
||||
register: set_python39_as_python
|
||||
changed_when: false
|
||||
failed_when: set_python39_as_python.stdout != ''
|
||||
|
||||
- name: "Install Patroni {{ patroni_version }} with Python 3.9"
|
||||
dnf:
|
||||
name: "{{ patroni_python39_packages }}"
|
||||
disablerepo: pgdg*
|
||||
state: latest
|
||||
Reference in New Issue
Block a user