mirror of
https://gitea.0xace.cc/ansible-galaxy/postgresql.git
synced 2025-06-29 02:13:06 +00:00
initial commit
This commit is contained in:
159
tasks/RedHat/cacert.yaml
Normal file
159
tasks/RedHat/cacert.yaml
Normal file
@ -0,0 +1,159 @@
|
||||
- name: Check if ssl dir exist
|
||||
file:
|
||||
name: "{{ postgresql_ssl_path }}"
|
||||
state: directory
|
||||
owner: postgres
|
||||
group: postgres
|
||||
when: postgresql_ssl
|
||||
|
||||
- name: Add predefined ssl cert for PostgreSQL
|
||||
copy:
|
||||
src: "{{ postgresql_cert_name }}"
|
||||
dest: "{{ postgresql_ssl_path }}/{{ postgresql_cert_name }}"
|
||||
owner: postgres
|
||||
group: postgres
|
||||
notify: Restart PostgreSQL
|
||||
when: postgresql_cert is defined
|
||||
|
||||
- name: Generate OpenSSL key and cert for PostgreSQL
|
||||
when: "inventory_hostname == groups.postgresql|first"
|
||||
block:
|
||||
- name: Generate an OpenSSL private CA key with the default values (4096 bits, RSA)
|
||||
community.crypto.openssl_privatekey:
|
||||
path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.key"
|
||||
owner: postgres
|
||||
group: postgres
|
||||
when: postgresql_cert is not defined
|
||||
register: postgresql_ca_key_gen
|
||||
|
||||
- name: Generate an OpenSSL Certificate Signing Request
|
||||
community.crypto.openssl_csr:
|
||||
path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.csr"
|
||||
privatekey_path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.key"
|
||||
use_common_name_for_san: false
|
||||
basic_constraints:
|
||||
- 'CA:TRUE'
|
||||
basic_constraints_critical: yes
|
||||
key_usage:
|
||||
- keyCertSign
|
||||
key_usage_critical: true
|
||||
common_name: "CA-{{ postgresql_self_signed_cert_name }}"
|
||||
owner: postgres
|
||||
group: postgres
|
||||
register: postgresql_ca_csr
|
||||
|
||||
- name: Generate a Self Signed OpenSSL CA certificate
|
||||
community.crypto.x509_certificate:
|
||||
path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.crt"
|
||||
csr_path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.csr"
|
||||
privatekey_path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.key"
|
||||
provider: selfsigned
|
||||
owner: postgres
|
||||
group: postgres
|
||||
when: postgresql_cert is not defined
|
||||
register: postgresql_ca_cert_gen
|
||||
|
||||
- name: Generate an OpenSSL private client key with the default values (4096 bits, RSA)
|
||||
community.crypto.openssl_privatekey:
|
||||
path: "{{ postgresql_ssl_path }}/{{ postgresql_self_signed_cert_name }}.key"
|
||||
owner: postgres
|
||||
group: postgres
|
||||
when: postgresql_cert is not defined
|
||||
register: postgresql_key_gen
|
||||
|
||||
- name: Generate an OpenSSL Certificate Signing Request for client
|
||||
community.crypto.openssl_csr:
|
||||
path: "{{ postgresql_ssl_path }}/{{ postgresql_self_signed_cert_name }}.csr"
|
||||
privatekey_path: "{{ postgresql_ssl_path }}/{{ postgresql_self_signed_cert_name }}.key"
|
||||
common_name: "{{ postgresql_self_signed_cert_name }}"
|
||||
subject_alt_name: "{{ groups.postgresql | map('regex_replace', '^', 'IP:') | list }}"
|
||||
owner: postgres
|
||||
group: postgres
|
||||
register: postgresql_csr
|
||||
|
||||
- name: Generate an OpenSSL certificate for client signed with your own CA certificate
|
||||
community.crypto.x509_certificate:
|
||||
path: "{{ postgresql_ssl_path }}/{{ postgresql_self_signed_cert_name }}.crt"
|
||||
csr_path: "{{ postgresql_ssl_path }}/{{ postgresql_self_signed_cert_name }}.csr"
|
||||
ownca_path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.crt"
|
||||
ownca_privatekey_path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.key"
|
||||
provider: ownca
|
||||
owner: postgres
|
||||
group: postgres
|
||||
register: postgresql_cert
|
||||
|
||||
- name: Get CA cert content
|
||||
slurp:
|
||||
src: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.crt"
|
||||
register: postgresql_ca_cert_b64
|
||||
|
||||
- name: Get CA key content
|
||||
slurp:
|
||||
src: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.key"
|
||||
register: postgresql_ca_key_b64
|
||||
|
||||
- name: Get client cert content
|
||||
slurp:
|
||||
src: "{{ postgresql_ssl_path }}/{{ postgresql_self_signed_cert_name }}.crt"
|
||||
register: postgresql_cert_b64
|
||||
|
||||
- name: Get client key content
|
||||
slurp:
|
||||
src: "{{ postgresql_ssl_path }}/{{ postgresql_self_signed_cert_name }}.key"
|
||||
register: postgresql_key_b64
|
||||
|
||||
- name: Set facts about key and cert
|
||||
set_fact:
|
||||
postgresql_ca_key: "{{ postgresql_ca_key_b64.content | b64decode }}"
|
||||
postgresql_ca_cert: "{{ postgresql_ca_cert_b64.content | b64decode }}"
|
||||
postgresql_key: "{{ postgresql_key_b64.content | b64decode }}"
|
||||
postgresql_cert: "{{ postgresql_cert_b64.content | b64decode }}"
|
||||
delegate_to: "{{ item }}"
|
||||
delegate_facts: true
|
||||
run_once: true
|
||||
loop: "{{ groups.postgresql }}"
|
||||
|
||||
- name: Put PostgreSQL CA OpenSSL key
|
||||
copy:
|
||||
content: "{{ postgresql_ca_key }}"
|
||||
dest: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.key"
|
||||
owner: postgres
|
||||
group: postgres
|
||||
mode: 0600
|
||||
notify: Restart PostgreSQL
|
||||
|
||||
- name: Put PostgreSQL CA OpenSSL cert
|
||||
copy:
|
||||
content: "{{ postgresql_ca_cert }}"
|
||||
dest: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.crt"
|
||||
owner: postgres
|
||||
group: postgres
|
||||
notify: Restart PostgreSQL
|
||||
|
||||
- name: Put PostgreSQL CA OpenSSL cert to PKI
|
||||
copy:
|
||||
content: "{{ postgresql_ca_cert }}"
|
||||
dest: "/etc/pki/ca-trust/source/anchors/CA-{{ postgresql_self_signed_cert_name }}.crt"
|
||||
register: ca_trust_anchors
|
||||
notify: Restart PostgreSQL
|
||||
|
||||
- name: Update CA trust
|
||||
shell: update-ca-trust extract
|
||||
when: ca_trust_anchors.changed
|
||||
|
||||
- name: Put PostgreSQL OpenSSL key
|
||||
copy:
|
||||
content: "{{ postgresql_key }}"
|
||||
dest: "{{ postgresql_ssl_path }}/{{ postgresql_self_signed_cert_name }}.key"
|
||||
owner: postgres
|
||||
group: postgres
|
||||
mode: 0600
|
||||
notify: Restart PostgreSQL
|
||||
|
||||
- name: Put PostgreSQL OpenSSL cert
|
||||
copy:
|
||||
content: "{{ postgresql_cert }}"
|
||||
dest: "{{ postgresql_ssl_path }}/{{ postgresql_self_signed_cert_name }}.crt"
|
||||
owner: postgres
|
||||
group: postgres
|
||||
notify: Restart PostgreSQL
|
||||
35
tasks/RedHat/main.yaml
Normal file
35
tasks/RedHat/main.yaml
Normal file
@ -0,0 +1,35 @@
|
||||
- name: Disable PostgreSQL module
|
||||
shell: dnf module disable -y postgresql
|
||||
register: disable_postgresql_module
|
||||
changed_when: "'Nothing to do' not in disable_postgresql_module.stdout"
|
||||
|
||||
- name: Add PostgreSQL repository
|
||||
dnf:
|
||||
name: "{{ postgresql_repo_package }}"
|
||||
disable_gpg_check: yes
|
||||
state: present
|
||||
|
||||
- name: "Install {{ postgresql_package_name }} {{ postgresql_version }}"
|
||||
dnf:
|
||||
name: "{{ postgresql_package }}"
|
||||
state: present
|
||||
disable_gpg_check: yes
|
||||
register: postgresql_setup
|
||||
|
||||
- name: Manage TLS/SSL certificates
|
||||
include_tasks: cacert.yaml
|
||||
when: postgresql_ssl
|
||||
|
||||
- name: PostgreSQL Initdb
|
||||
shell: "/usr/pgsql-{{ postgresql_major_version }}/bin/postgresql-{{ postgresql_major_version }}-setup initdb"
|
||||
register: initdb
|
||||
changed_when: "'Data directory is not empty!' not in initdb.stdout"
|
||||
failed_when: false
|
||||
|
||||
- name: Include WAL-G role
|
||||
ansible.builtin.include_role:
|
||||
name: wal-g
|
||||
vars:
|
||||
wal_g_pg: yes
|
||||
when: postgresql_wal_g_install
|
||||
|
||||
Reference in New Issue
Block a user