add rhel 9 and debian 11 support

tasks/RedHat/cacert.yaml

@@ -1,159 +0,0 @@
-- name: Check if ssl dir exist
-  file: 
-    name: "{{ postgresql_ssl_path }}"
-    state: directory
-    owner: postgres
-    group: postgres
-  when: postgresql_ssl
-
-- name: Add predefined ssl cert for PostgreSQL
-  copy:
-    src: "{{ postgresql_cert_name }}"
-    dest: "{{ postgresql_ssl_path }}/{{ postgresql_cert_name }}"
-    owner: postgres
-    group: postgres
-  notify: Restart PostgreSQL
-  when: postgresql_cert is defined
-
-- name: Generate OpenSSL key and cert for PostgreSQL
-  when: "inventory_hostname == groups.postgresql|first"
-  block:
-    - name: Generate an OpenSSL private CA key with the default values (4096 bits, RSA)
-      community.crypto.openssl_privatekey:
-        path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.key"
-        owner: postgres
-        group: postgres
-      when: postgresql_cert is not defined
-      register: postgresql_ca_key_gen
-
-    - name: Generate an OpenSSL Certificate Signing Request
-      community.crypto.openssl_csr:
-        path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.csr"
-        privatekey_path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.key"
-        use_common_name_for_san: false
-        basic_constraints:
-          - 'CA:TRUE'
-        basic_constraints_critical: yes
-        key_usage:
-          - keyCertSign
-        key_usage_critical: true
-        common_name: "CA-{{ postgresql_self_signed_cert_name }}"
-        owner: postgres
-        group: postgres
-      register: postgresql_ca_csr
-    
-    - name: Generate a Self Signed OpenSSL CA certificate
-      community.crypto.x509_certificate:
-        path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.crt"
-        csr_path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.csr"
-        privatekey_path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.key"
-        provider: selfsigned
-        owner: postgres
-        group: postgres
-      when: postgresql_cert is not defined
-      register: postgresql_ca_cert_gen
-
-    - name: Generate an OpenSSL private client key with the default values (4096 bits, RSA)
-      community.crypto.openssl_privatekey:
-        path: "{{ postgresql_ssl_path }}/{{ postgresql_self_signed_cert_name }}.key"
-        owner: postgres
-        group: postgres
-      when: postgresql_cert is not defined
-      register: postgresql_key_gen
-
-    - name: Generate an OpenSSL Certificate Signing Request for client
-      community.crypto.openssl_csr:
-        path: "{{ postgresql_ssl_path }}/{{ postgresql_self_signed_cert_name }}.csr"
-        privatekey_path: "{{ postgresql_ssl_path }}/{{ postgresql_self_signed_cert_name }}.key"
-        common_name: "{{ postgresql_self_signed_cert_name }}"
-        subject_alt_name: "{{ groups.postgresql | map('regex_replace', '^', 'IP:') | list }}"
-        owner: postgres
-        group: postgres
-      register: postgresql_csr
-
-    - name: Generate an OpenSSL certificate for client signed with your own CA certificate
-      community.crypto.x509_certificate:
-        path: "{{ postgresql_ssl_path }}/{{ postgresql_self_signed_cert_name }}.crt"
-        csr_path: "{{ postgresql_ssl_path }}/{{ postgresql_self_signed_cert_name }}.csr"
-        ownca_path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.crt"
-        ownca_privatekey_path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.key"
-        provider: ownca
-        owner: postgres
-        group: postgres
-      register: postgresql_cert
-
-    - name: Get CA cert content
-      slurp:
-        src: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.crt"
-      register: postgresql_ca_cert_b64
-
-    - name: Get CA key content
-      slurp:
-        src: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.key"
-      register: postgresql_ca_key_b64
-
-    - name: Get client cert content
-      slurp:
-        src: "{{ postgresql_ssl_path }}/{{ postgresql_self_signed_cert_name }}.crt"
-      register: postgresql_cert_b64
-
-    - name: Get client key content
-      slurp:
-        src: "{{ postgresql_ssl_path }}/{{ postgresql_self_signed_cert_name }}.key"
-      register: postgresql_key_b64
-
-    - name: Set facts about key and cert
-      set_fact:
-        postgresql_ca_key: "{{ postgresql_ca_key_b64.content | b64decode }}"
-        postgresql_ca_cert: "{{ postgresql_ca_cert_b64.content | b64decode }}"
-        postgresql_key: "{{ postgresql_key_b64.content | b64decode }}"
-        postgresql_cert: "{{ postgresql_cert_b64.content | b64decode }}"
-      delegate_to: "{{ item }}"
-      delegate_facts: true
-      run_once: true
-      loop: "{{ groups.postgresql }}"
-
-- name: Put PostgreSQL CA OpenSSL key
-  copy:
-    content: "{{ postgresql_ca_key }}"
-    dest: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.key"
-    owner: postgres
-    group: postgres
-    mode: 0600
-  notify: Restart PostgreSQL
-
-- name: Put PostgreSQL CA OpenSSL cert
-  copy:
-    content: "{{ postgresql_ca_cert }}"
-    dest: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.crt"
-    owner: postgres
-    group: postgres
-  notify: Restart PostgreSQL
-
-- name: Put PostgreSQL CA OpenSSL cert to PKI
-  copy:
-    content: "{{ postgresql_ca_cert }}"
-    dest: "/etc/pki/ca-trust/source/anchors/CA-{{ postgresql_self_signed_cert_name }}.crt"
-  register: ca_trust_anchors
-  notify: Restart PostgreSQL
-
-- name: Update CA trust
-  shell: update-ca-trust extract
-  when: ca_trust_anchors.changed
-
-- name: Put PostgreSQL OpenSSL key
-  copy:
-    content: "{{ postgresql_key }}"
-    dest: "{{ postgresql_ssl_path }}/{{ postgresql_self_signed_cert_name }}.key"
-    owner: postgres
-    group: postgres
-    mode: 0600
-  notify: Restart PostgreSQL
-
-- name: Put PostgreSQL OpenSSL cert
-  copy:
-    content: "{{ postgresql_cert }}"
-    dest: "{{ postgresql_ssl_path }}/{{ postgresql_self_signed_cert_name }}.crt"
-    owner: postgres
-    group: postgres
-  notify: Restart PostgreSQL

tasks/RedHat/config.yaml

@@ -0,0 +1,40 @@
+---
+- name: Merge user options for PostgreSQL config
+  set_fact:
+    postgresql_combined_parameters: "{{ postgresql_default_parameters | combine(postgresql_custom_parameters|default({}), recursive=true) }}"
+
+- name: Merge backup options for PostgreSQL config
+  set_fact:
+    postgresql_combined_parameters: "{{ postgresql_combined_parameters | combine(postgresql_backup_parameters|default({}), recursive=true) }}"
+  when:
+
+- name: Propagate PostgreSQL configs
+  block:
+    - name: Template PostgreSQL pg_hba configuration
+      template:
+        src: "{{ postgresql_major_version }}-pg_hba.conf.j2"
+        dest: "{{ postgresql_data_dir }}/pg_hba.conf"
+        mode: 0600
+        owner: postgres
+        group: postgres
+      register: pg_hba_config_file
+      notify: Restart PostgreSQL
+    - name: Template PostgreSQL configuration
+      template:
+        src: "{{ postgresql_major_version }}-postgresql.conf.j2"
+        dest: "{{ postgresql_data_dir }}/postgresql.conf"
+        mode: 0600
+        owner: postgres
+        group: postgres
+      register: postgresql_config_file
+      notify: Restart PostgreSQL
+    - name: Template PostgreSQL SSL configuration
+      template:
+        src: "{{ postgresql_major_version }}-postgresql.ssl.conf.j2"
+        dest: "{{ postgresql_data_dir }}/postgresql.ssl.conf"
+        mode: 0600
+        owner: postgres
+        group: postgres
+      register: postgresql_ssl_config_file
+      notify: Restart PostgreSQL
+      when: postgresql_ssl

tasks/RedHat/main.yaml

@@ -1,7 +1,14 @@
+- name: Install deps packages
+  dnf:
+    name: "{{ postgresql_deps_packages }}"
+    state: present
+
 - name: Disable PostgreSQL module
   shell: dnf module disable -y postgresql
   register: disable_postgresql_module
   changed_when: "'Nothing to do' not in disable_postgresql_module.stdout"
+  when:
+    - ansible_facts['distribution_major_version'] == '8'
 
 - name: Add PostgreSQL repository
   dnf: 
@@ -16,16 +23,16 @@
     disable_gpg_check: yes
   register: postgresql_setup
 
-- name: Manage TLS/SSL certificates
-  include_tasks: cacert.yaml
-  when: postgresql_ssl
-
 - name: PostgreSQL Initdb
   shell: "/usr/pgsql-{{ postgresql_major_version }}/bin/postgresql-{{ postgresql_major_version }}-setup initdb"
   register: initdb
   changed_when: "'Data directory is not empty!' not in initdb.stdout"
   failed_when: false
 
+- name: "Configure PostgreSQL"
+  include_tasks: config.yaml
+  tags: postgresql_configuration
+
 - name: Include WAL-G role
   ansible.builtin.include_role:
     name: wal-g