initial commit

tasks/Debian/main.yaml

@@ -0,0 +1,37 @@
+- name: Add gpg package
+  apt:
+    name: gpg
+
+- name: Add gpg keys for postgresql
+  ansible.builtin.apt_key:
+    url: "{{ item.url }}"
+    keyring: "{{ item.keyring }}"
+  loop: "{{ postgresql_apt_key }}"
+
+- name: Add Hashicorp repository
+  apt_repository:
+    repo: "{{ item.repo }}"
+    state: present
+    filename: "{{ item.filename }}"
+    update_cache: yes
+  loop: "{{ postgresql_apt_repository }}" 
+
+- name: Check if Patroni is installed
+  ansible.builtin.shell: dpkg-query -l {{ postgresql_package_name }} 2>&1 | grep {{ postgresql_version }}
+  ignore_errors: True
+  register: is_postgresql
+  changed_when: is_postgresql.rc != 0
+  failed_when: False
+
+- name: Mask Patroni before install
+  ansible.builtin.systemd:
+    name: "{{ postgresql_package_name }}"
+    masked: yes
+  when: is_postgresql.rc != 0
+
+- name: "Install {{ postgresql_package_name }} {{ postgresql_version }}"
+  apt:
+    name: "{{ postgresql_package }}"
+    update_cache: yes
+  register: postgresql_setup
+  when: is_postgresql.rc != 0

tasks/RedHat/cacert.yaml

@@ -0,0 +1,159 @@
+- name: Check if ssl dir exist
+  file: 
+    name: "{{ postgresql_ssl_path }}"
+    state: directory
+    owner: postgres
+    group: postgres
+  when: postgresql_ssl
+
+- name: Add predefined ssl cert for PostgreSQL
+  copy:
+    src: "{{ postgresql_cert_name }}"
+    dest: "{{ postgresql_ssl_path }}/{{ postgresql_cert_name }}"
+    owner: postgres
+    group: postgres
+  notify: Restart PostgreSQL
+  when: postgresql_cert is defined
+
+- name: Generate OpenSSL key and cert for PostgreSQL
+  when: "inventory_hostname == groups.postgresql|first"
+  block:
+    - name: Generate an OpenSSL private CA key with the default values (4096 bits, RSA)
+      community.crypto.openssl_privatekey:
+        path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.key"
+        owner: postgres
+        group: postgres
+      when: postgresql_cert is not defined
+      register: postgresql_ca_key_gen
+
+    - name: Generate an OpenSSL Certificate Signing Request
+      community.crypto.openssl_csr:
+        path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.csr"
+        privatekey_path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.key"
+        use_common_name_for_san: false
+        basic_constraints:
+          - 'CA:TRUE'
+        basic_constraints_critical: yes
+        key_usage:
+          - keyCertSign
+        key_usage_critical: true
+        common_name: "CA-{{ postgresql_self_signed_cert_name }}"
+        owner: postgres
+        group: postgres
+      register: postgresql_ca_csr
+    
+    - name: Generate a Self Signed OpenSSL CA certificate
+      community.crypto.x509_certificate:
+        path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.crt"
+        csr_path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.csr"
+        privatekey_path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.key"
+        provider: selfsigned
+        owner: postgres
+        group: postgres
+      when: postgresql_cert is not defined
+      register: postgresql_ca_cert_gen
+
+    - name: Generate an OpenSSL private client key with the default values (4096 bits, RSA)
+      community.crypto.openssl_privatekey:
+        path: "{{ postgresql_ssl_path }}/{{ postgresql_self_signed_cert_name }}.key"
+        owner: postgres
+        group: postgres
+      when: postgresql_cert is not defined
+      register: postgresql_key_gen
+
+    - name: Generate an OpenSSL Certificate Signing Request for client
+      community.crypto.openssl_csr:
+        path: "{{ postgresql_ssl_path }}/{{ postgresql_self_signed_cert_name }}.csr"
+        privatekey_path: "{{ postgresql_ssl_path }}/{{ postgresql_self_signed_cert_name }}.key"
+        common_name: "{{ postgresql_self_signed_cert_name }}"
+        subject_alt_name: "{{ groups.postgresql | map('regex_replace', '^', 'IP:') | list }}"
+        owner: postgres
+        group: postgres
+      register: postgresql_csr
+
+    - name: Generate an OpenSSL certificate for client signed with your own CA certificate
+      community.crypto.x509_certificate:
+        path: "{{ postgresql_ssl_path }}/{{ postgresql_self_signed_cert_name }}.crt"
+        csr_path: "{{ postgresql_ssl_path }}/{{ postgresql_self_signed_cert_name }}.csr"
+        ownca_path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.crt"
+        ownca_privatekey_path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.key"
+        provider: ownca
+        owner: postgres
+        group: postgres
+      register: postgresql_cert
+
+    - name: Get CA cert content
+      slurp:
+        src: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.crt"
+      register: postgresql_ca_cert_b64
+
+    - name: Get CA key content
+      slurp:
+        src: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.key"
+      register: postgresql_ca_key_b64
+
+    - name: Get client cert content
+      slurp:
+        src: "{{ postgresql_ssl_path }}/{{ postgresql_self_signed_cert_name }}.crt"
+      register: postgresql_cert_b64
+
+    - name: Get client key content
+      slurp:
+        src: "{{ postgresql_ssl_path }}/{{ postgresql_self_signed_cert_name }}.key"
+      register: postgresql_key_b64
+
+    - name: Set facts about key and cert
+      set_fact:
+        postgresql_ca_key: "{{ postgresql_ca_key_b64.content | b64decode }}"
+        postgresql_ca_cert: "{{ postgresql_ca_cert_b64.content | b64decode }}"
+        postgresql_key: "{{ postgresql_key_b64.content | b64decode }}"
+        postgresql_cert: "{{ postgresql_cert_b64.content | b64decode }}"
+      delegate_to: "{{ item }}"
+      delegate_facts: true
+      run_once: true
+      loop: "{{ groups.postgresql }}"
+
+- name: Put PostgreSQL CA OpenSSL key
+  copy:
+    content: "{{ postgresql_ca_key }}"
+    dest: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.key"
+    owner: postgres
+    group: postgres
+    mode: 0600
+  notify: Restart PostgreSQL
+
+- name: Put PostgreSQL CA OpenSSL cert
+  copy:
+    content: "{{ postgresql_ca_cert }}"
+    dest: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.crt"
+    owner: postgres
+    group: postgres
+  notify: Restart PostgreSQL
+
+- name: Put PostgreSQL CA OpenSSL cert to PKI
+  copy:
+    content: "{{ postgresql_ca_cert }}"
+    dest: "/etc/pki/ca-trust/source/anchors/CA-{{ postgresql_self_signed_cert_name }}.crt"
+  register: ca_trust_anchors
+  notify: Restart PostgreSQL
+
+- name: Update CA trust
+  shell: update-ca-trust extract
+  when: ca_trust_anchors.changed
+
+- name: Put PostgreSQL OpenSSL key
+  copy:
+    content: "{{ postgresql_key }}"
+    dest: "{{ postgresql_ssl_path }}/{{ postgresql_self_signed_cert_name }}.key"
+    owner: postgres
+    group: postgres
+    mode: 0600
+  notify: Restart PostgreSQL
+
+- name: Put PostgreSQL OpenSSL cert
+  copy:
+    content: "{{ postgresql_cert }}"
+    dest: "{{ postgresql_ssl_path }}/{{ postgresql_self_signed_cert_name }}.crt"
+    owner: postgres
+    group: postgres
+  notify: Restart PostgreSQL

tasks/RedHat/main.yaml

@@ -0,0 +1,35 @@
+- name: Disable PostgreSQL module
+  shell: dnf module disable -y postgresql
+  register: disable_postgresql_module
+  changed_when: "'Nothing to do' not in disable_postgresql_module.stdout"
+
+- name: Add PostgreSQL repository
+  dnf: 
+    name: "{{ postgresql_repo_package }}"
+    disable_gpg_check: yes
+    state: present     
+
+- name: "Install {{ postgresql_package_name }} {{ postgresql_version }}"
+  dnf:
+    name: "{{ postgresql_package }}"
+    state: present
+    disable_gpg_check: yes
+  register: postgresql_setup
+
+- name: Manage TLS/SSL certificates
+  include_tasks: cacert.yaml
+  when: postgresql_ssl
+
+- name: PostgreSQL Initdb
+  shell: "/usr/pgsql-{{ postgresql_major_version }}/bin/postgresql-{{ postgresql_major_version }}-setup initdb"
+  register: initdb
+  changed_when: "'Data directory is not empty!' not in initdb.stdout"
+  failed_when: false
+
+- name: Include WAL-G role
+  ansible.builtin.include_role:
+    name: wal-g
+  vars:
+    wal_g_pg: yes
+  when: postgresql_wal_g_install
+

tasks/config.yaml

@@ -0,0 +1,40 @@
+---
+- name: Merge user options for PostgreSQL config
+  set_fact:
+    postgresql_combined_parameters: "{{ postgresql_default_parameters | combine(postgresql_custom_parameters|default({}), recursive=true) }}"
+
+- name: Merge backup options for PostgreSQL config
+  set_fact:
+    postgresql_combined_parameters: "{{ postgresql_combined_parameters | combine(postgresql_backup_parameters|default({}), recursive=true) }}"
+  when:
+
+- name: Propagate PostgreSQL configs
+  block:
+    - name: Template PostgreSQL pg_hba configuration
+      template:
+        src: "{{ postgresql_major_version }}-pg_hba.conf.j2"
+        dest: "/var/lib/pgsql/{{ postgresql_major_version }}/data/pg_hba.conf"
+        mode: 0600
+        owner: postgres
+        group: postgres
+      register: pg_hba_config_file
+      notify: Restart PostgreSQL
+    - name: Template PostgreSQL configuration
+      template:
+        src: "{{ postgresql_major_version }}-postgresql.conf.j2"
+        dest: "/var/lib/pgsql/{{ postgresql_major_version }}/data/postgresql.conf"
+        mode: 0600
+        owner: postgres
+        group: postgres
+      register: postgresql_config_file
+      notify: Restart PostgreSQL
+    - name: Template PostgreSQL SSL configuration
+      template:
+        src: "{{ postgresql_major_version }}-postgresql.ssl.conf.j2"
+        dest: "/var/lib/pgsql/{{ postgresql_major_version }}/data/postgresql.ssl.conf"
+        mode: 0600
+        owner: postgres
+        group: postgres
+      register: postgresql_ssl_config_file
+      notify: Restart PostgreSQL
+      when: postgresql_ssl

tasks/main.yaml

@@ -0,0 +1,35 @@
+- name: Make sure handlers are flushed immediately
+  meta: flush_handlers
+
+- name: Load a variable file based on the OS type
+  include_vars: "{{ lookup('first_found', params) }}"
+  vars:
+    params:
+      files:
+        - "{{ ansible_facts['distribution'] }}.yaml"
+        - "{{ ansible_facts['os_family'] }}.yaml"
+      paths:
+        - "vars"
+  tags: postgresql_vars
+
+- name: "Install PostgreSQL for {{ ansible_facts['os_family'] }}"
+  include_tasks: "{{ ansible_facts['os_family'] }}/main.yaml"
+  tags: postgresql_setup
+
+- name: "Configure PostgreSQL"
+  include_tasks: config.yaml
+  tags: postgresql_configuration
+
+- name: Enable and start PostgreSQL
+  systemd:
+    daemon_reload: true
+    name: "postgresql-{{ postgresql_major_version }}"
+    enabled: true
+    state: started
+    masked: no
+  register: postgresql_enable_and_start
+  tags: postgresql, postgresql_start
+
+- name: "Configure PostgreSQL"
+  include_tasks: user.yaml
+  tags: postgresql_postgres_user

tasks/user.yaml

@@ -0,0 +1,17 @@
+- name: Ensure Python 3.9 and psycopg2 installed
+  dnf:
+    name:
+      - python39
+      - python39-psycopg2
+    state: present
+
+- name: Set initial PostgreSQL user
+  become: true
+  become_user: postgres
+  vars:
+    ansible_python_interpreter: '/usr/bin/env python3'
+  community.postgresql.postgresql_user:
+    db: "postgres"
+    name: "postgres"
+    password: "{{ postgresql_superuser_password }}"
+    state: present