ansible-galaxy/postgresql
1
0
Fork 0
mirror of https://gitea.0xace.cc/ansible-galaxy/postgresql.git synced 2025-11-03 23:07:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

make possible to keep nonssl endpoint and remove hardcoded alg for auth

Browse Source
This commit is contained in:
ace
2023-02-15 16:16:09 +03:00
parent 916e75951e
commit 4f40c189f7
4 changed files with 35 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
defaults/main.yaml
View File

@@ -1,13 +1,14 @@
postgresql_version: "15.2" postgresql_version: "15.2"
# Options # Options
postgresql_group: "postgresql"
postgresql_superuser_db: "postgres" postgresql_superuser_db: "postgres"
postgresql_superuser_name: "postgres" postgresql_superuser_name: "postgres"
postgresql_superuser_password: "postgres" postgresql_superuser_password: "postgres"
# SSL options # SSL options
postgresql_ssl: true postgresql_ssl: true
postgresql_group: "postgresql" postgresql_ssl_keep_nonssl_endpoint: false
postgresql_self_signed_cert: true postgresql_self_signed_cert: true
postgresql_self_signed_cert_name: "cert" postgresql_self_signed_cert_name: "cert"

19
templates/13-pg_hba.conf.j2
View File

@@ -47,10 +47,10 @@
# or "samenet" to match any address in any subnet that the server is # or "samenet" to match any address in any subnet that the server is
# directly connected to. # directly connected to.
# #
# METHOD can be "trust", "reject", "md5", "password", "scram-sha-256", # METHOD can be "trust", "reject", "md5", "password", "{{ postgresql_password_encryption_algorithm }}",
# "gss", "sspi", "ident", "peer", "pam", "ldap", "radius" or "cert". # "gss", "sspi", "ident", "peer", "pam", "ldap", "radius" or "cert".
# Note that "password" sends passwords in clear text; "md5" or # Note that "password" sends passwords in clear text; "md5" or
# "scram-sha-256" are preferred since they send encrypted passwords. # "{{ postgresql_password_encryption_algorithm }}" are preferred since they send encrypted passwords.
# #
# OPTIONS are a set of options for the authentication in the format # OPTIONS are a set of options for the authentication in the format
# NAME=VALUE. The available options depend on the different # NAME=VALUE. The available options depend on the different
@@ -85,14 +85,17 @@ local all all trust
# "local" is for Unix domain socket connections only # "local" is for Unix domain socket connections only
local all all peer local all all peer
# IPv4 local connections: # IPv4 local connections:
host all all 127.0.0.1/32 scram-sha-256 host all all 127.0.0.1/32 {{ postgresql_password_encryption_algorithm }}
# IPv6 local connections: # IPv6 local connections:
host all all ::1/128 scram-sha-256 host all all ::1/128 {{ postgresql_password_encryption_algorithm }}
# Allow replication connections from localhost, by a user with the # Allow replication connections from localhost, by a user with the
# replication privilege. # replication privilege.
local replication all peer local replication all peer
host replication all 127.0.0.1/32 scram-sha-256 host replication all 127.0.0.1/32 {{ postgresql_password_encryption_algorithm }}
host replication all ::1/128 scram-sha-256 host replication all ::1/128 {{ postgresql_password_encryption_algorithm }}
{% if postgresql_ssl|bool %} {% if not postgresql_ssl|bool or postgresql_ssl_keep_nonssl_endpoint|bool %}
hostssl all all 0.0.0.0/0 scram-sha-256 host all all 0.0.0.0/0 {{ postgresql_password_encryption_algorithm }}
{% endif %}
{% if postgresql_ssl|bool %}
hostssl all all 0.0.0.0/0 {{ postgresql_password_encryption_algorithm }}
{% endif %} {% endif %}

19
templates/14-pg_hba.conf.j2
View File

@@ -47,10 +47,10 @@
# or "samenet" to match any address in any subnet that the server is # or "samenet" to match any address in any subnet that the server is
# directly connected to. # directly connected to.
# #
# METHOD can be "trust", "reject", "md5", "password", "scram-sha-256", # METHOD can be "trust", "reject", "md5", "password", "{{ postgresql_password_encryption_algorithm }}",
# "gss", "sspi", "ident", "peer", "pam", "ldap", "radius" or "cert". # "gss", "sspi", "ident", "peer", "pam", "ldap", "radius" or "cert".
# Note that "password" sends passwords in clear text; "md5" or # Note that "password" sends passwords in clear text; "md5" or
# "scram-sha-256" are preferred since they send encrypted passwords. # "{{ postgresql_password_encryption_algorithm }}" are preferred since they send encrypted passwords.
# #
# OPTIONS are a set of options for the authentication in the format # OPTIONS are a set of options for the authentication in the format
# NAME=VALUE. The available options depend on the different # NAME=VALUE. The available options depend on the different
@@ -85,14 +85,17 @@ local all all trust
# "local" is for Unix domain socket connections only # "local" is for Unix domain socket connections only
local all all peer local all all peer
# IPv4 local connections: # IPv4 local connections:
host all all 127.0.0.1/32 scram-sha-256 host all all 127.0.0.1/32 {{ postgresql_password_encryption_algorithm }}
# IPv6 local connections: # IPv6 local connections:
host all all ::1/128 scram-sha-256 host all all ::1/128 {{ postgresql_password_encryption_algorithm }}
# Allow replication connections from localhost, by a user with the # Allow replication connections from localhost, by a user with the
# replication privilege. # replication privilege.
local replication all peer local replication all peer
host replication all 127.0.0.1/32 scram-sha-256 host replication all 127.0.0.1/32 {{ postgresql_password_encryption_algorithm }}
host replication all ::1/128 scram-sha-256 host replication all ::1/128 {{ postgresql_password_encryption_algorithm }}
{% if postgresql_ssl|bool %} {% if not postgresql_ssl|bool or postgresql_ssl_keep_nonssl_endpoint|bool %}
hostssl all all 0.0.0.0/0 scram-sha-256 host all all 0.0.0.0/0 {{ postgresql_password_encryption_algorithm }}
{% endif %}
{% if postgresql_ssl|bool %}
hostssl all all 0.0.0.0/0 {{ postgresql_password_encryption_algorithm }}
{% endif %} {% endif %}

19
templates/15-pg_hba.conf.j2
View File

@@ -47,10 +47,10 @@
# or "samenet" to match any address in any subnet that the server is # or "samenet" to match any address in any subnet that the server is
# directly connected to. # directly connected to.
# #
# METHOD can be "trust", "reject", "md5", "password", "scram-sha-256", # METHOD can be "trust", "reject", "md5", "password", "{{ postgresql_password_encryption_algorithm }}",
# "gss", "sspi", "ident", "peer", "pam", "ldap", "radius" or "cert". # "gss", "sspi", "ident", "peer", "pam", "ldap", "radius" or "cert".
# Note that "password" sends passwords in clear text; "md5" or # Note that "password" sends passwords in clear text; "md5" or
# "scram-sha-256" are preferred since they send encrypted passwords. # "{{ postgresql_password_encryption_algorithm }}" are preferred since they send encrypted passwords.
# #
# OPTIONS are a set of options for the authentication in the format # OPTIONS are a set of options for the authentication in the format
# NAME=VALUE. The available options depend on the different # NAME=VALUE. The available options depend on the different
@@ -85,14 +85,17 @@ local all all trust
# "local" is for Unix domain socket connections only # "local" is for Unix domain socket connections only
local all all peer local all all peer
# IPv4 local connections: # IPv4 local connections:
host all all 127.0.0.1/32 scram-sha-256 host all all 127.0.0.1/32 {{ postgresql_password_encryption_algorithm }}
# IPv6 local connections: # IPv6 local connections:
host all all ::1/128 scram-sha-256 host all all ::1/128 {{ postgresql_password_encryption_algorithm }}
# Allow replication connections from localhost, by a user with the # Allow replication connections from localhost, by a user with the
# replication privilege. # replication privilege.
local replication all peer local replication all peer
host replication all 127.0.0.1/32 scram-sha-256 host replication all 127.0.0.1/32 {{ postgresql_password_encryption_algorithm }}
host replication all ::1/128 scram-sha-256 host replication all ::1/128 {{ postgresql_password_encryption_algorithm }}
{% if postgresql_ssl|bool %} {% if not postgresql_ssl|bool or postgresql_ssl_keep_nonssl_endpoint|bool %}
hostssl all all 0.0.0.0/0 scram-sha-256 host all all 0.0.0.0/0 {{ postgresql_password_encryption_algorithm }}
{% endif %}
{% if postgresql_ssl|bool %}
hostssl all all 0.0.0.0/0 {{ postgresql_password_encryption_algorithm }}
{% endif %} {% endif %}