ansible-galaxy/postgresql
1
0
Fork 0
mirror of https://gitea.0xace.cc/ansible-galaxy/postgresql.git synced 2025-06-28 18:03:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

rewrite ssl cert generation

Browse Source
This commit is contained in:
ace
2024-03-19 14:05:41 +03:00
parent 7b924b24dd
commit 5fe171c8b0
25 changed files with 396 additions and 266 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
tasks/Debian/config.yaml
View File

@ -2,15 +2,15 @@
- name: Create data directory
file:
path: "{{ postgresql_data_dir }}"
owner: "postgres"
group: "postgres"
owner: "{{ postgresql_user }}"
group: "{{ postgresql_group }}"
state: directory
- name: Create configuration directory
file:
path: "{{ postgresql_config_dir }}/{{ postgresql_major_version }}/{{ postgresql_cluster_name }}"
owner: "postgres"
group: "postgres"
owner: "{{ postgresql_user }}"
group: "{{ postgresql_group }}"
state: directory
- name: Merge user options for PostgreSQL config
@ -29,33 +29,33 @@
block:
- name: Template PostgreSQL pg_hba configuration
template:
src: "{{ postgresql_major_version }}-pg_hba.conf.j2"
src: "pg_hba.conf.j2"
dest: "{{ postgresql_config_dir }}/{{ postgresql_major_version }}/{{ postgresql_cluster_name }}/pg_hba.conf"
mode: 0600
owner: postgres
group: postgres
owner: "{{ postgresql_user }}"
group: "{{ postgresql_group }}"
register: pg_hba_config_file
notify:
- Reload PostgreSQL
- Restart PostgreSQL
- name: Template PostgreSQL configuration
template:
src: "{{ postgresql_major_version }}-postgresql.conf.j2"
src: "postgresql.conf.j2"
dest: "{{ postgresql_config_dir }}/{{ postgresql_major_version }}/{{ postgresql_cluster_name }}/postgresql.conf"
mode: 0600
owner: postgres
group: postgres
owner: "{{ postgresql_user }}"
group: "{{ postgresql_group }}"
register: postgresql_config_file
notify:
- Reload PostgreSQL
- Restart PostgreSQL
- name: Template PostgreSQL SSL configuration
template:
src: "{{ postgresql_major_version }}-postgresql.ssl.conf.j2"
src: "postgresql.ssl.conf.j2"
dest: "{{ postgresql_config_dir }}/{{ postgresql_major_version }}/{{ postgresql_cluster_name }}/postgresql.ssl.conf"
mode: 0600
owner: postgres
group: postgres
owner: "{{ postgresql_user }}"
group: "{{ postgresql_group }}"
register: postgresql_ssl_config_file
notify:
- Reload PostgreSQL

3
tasks/Debian/main.yaml
View File

@ -7,7 +7,8 @@
tags: postgresql_configuration
- name: "Manage TLS/SSL certificates"
include_tasks: cacert.yaml
#include_tasks: cacert.yaml
include_tasks: ssl/main.yaml
when: postgresql_ssl
- name: Include WAL-G role

18
tasks/RedHat/config.yaml
View File

@ -15,33 +15,33 @@
block:
- name: Template PostgreSQL pg_hba configuration
template:
src: "{{ postgresql_major_version }}-pg_hba.conf.j2"
src: "pg_hba.conf.j2"
dest: "{{ postgresql_data_dir }}/pg_hba.conf"
mode: 0600
owner: postgres
group: postgres
owner: "{{ postgresql_user }}"
group: "{{ postgresql_group }}"
register: pg_hba_config_file
notify:
- Reload PostgreSQL
- Restart PostgreSQL
- name: Template PostgreSQL configuration
template:
src: "{{ postgresql_major_version }}-postgresql.conf.j2"
src: "postgresql.conf.j2"
dest: "{{ postgresql_data_dir }}/postgresql.conf"
mode: 0600
owner: postgres
group: postgres
owner: "{{ postgresql_user }}"
group: "{{ postgresql_group }}"
register: postgresql_config_file
notify:
- Reload PostgreSQL
- Restart PostgreSQL
- name: Template PostgreSQL SSL configuration
template:
src: "{{ postgresql_major_version }}-postgresql.ssl.conf.j2"
src: "postgresql.ssl.conf.j2"
dest: "{{ postgresql_data_dir }}/postgresql.ssl.conf"
mode: 0600
owner: postgres
group: postgres
owner: "{{ postgresql_user }}"
group: "{{ postgresql_group }}"
register: postgresql_ssl_config_file
notify:
- Reload PostgreSQL

3
tasks/RedHat/main.yaml
View File

@ -28,7 +28,8 @@
include_tasks: data_dir.yaml
- name: "Manage TLS/SSL certificates"
include_tasks: cacert.yaml
#include_tasks: cacert.yaml
include_tasks: ssl/main.yaml
when: postgresql_ssl
- name: Include WAL-G role

4
tasks/main.yaml
View File

@ -27,10 +27,6 @@
include_tasks: "{{ ansible_facts['os_family'] }}/main.yaml"
tags: postgresql_setup
#- name: "Manage TLS/SSL certificates"
# include_tasks: cacert.yaml
# when: postgresql_ssl
- name: Enable and start PostgreSQL
systemd:
daemon_reload: true

142
tasks/ssl/ca.yaml Normal file
View File

@ -0,0 +1,142 @@
- name: Create CA
when: inventory_hostname in groups[postgresql_cacert_ca_host_group]
block:
- name: CA and certs | Install cryptography library
package:
name: python3-cryptography
state: present
- name: CA and certs | Check if ssl gen dir exist
file:
name: "{{ postgresql_ssl_path }}"
state: directory
- name: Generate an OpenSSL private CA key with the default values (4096 bits, RSA)
community.crypto.openssl_privatekey:
path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.key"
register: postgresql_cacert_ca_key_gen
- name: Generate an OpenSSL Certificate Signing Request
community.crypto.openssl_csr:
path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.csr"
privatekey_path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.key"
use_common_name_for_san: false
basic_constraints:
- 'CA:TRUE'
basic_constraints_critical: yes
key_usage:
- keyCertSign
key_usage_critical: true
common_name: "CA-{{ postgresql_self_signed_cert_name }}"
register: postgresql_cacert_ca_csr
- name: Generate a Self Signed OpenSSL CA certificate
community.crypto.x509_certificate:
path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.crt"
csr_path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.csr"
privatekey_path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.key"
provider: selfsigned
register: postgresql_cacert_ca_cert_gen
- name: Get CA cert content
slurp:
src: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.crt"
register: postgresql_cacert_ca_cert_b64
- name: Get CA csr content
slurp:
src: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.csr"
register: postgresql_cacert_ca_csr_b64
- name: Get CA key content
slurp:
src: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.key"
register: postgresql_cacert_ca_key_b64
- name: Set facts about key and cert
set_fact:
postgresql_cacert_ca_key: "{{ postgresql_cacert_ca_key_b64.content | b64decode }}"
postgresql_cacert_ca_csr: "{{ postgresql_cacert_ca_csr_b64.content | b64decode }}"
postgresql_cacert_ca_cert: "{{ postgresql_cacert_ca_cert_b64.content | b64decode }}"
delegate_to: "{{ fact_item }}"
delegate_facts: true
with_items:
- "{{ groups[postgresql_cacert_ca_host_group] | default([]) }}"
- "{{ groups[postgresql_cacert_clients_group] | default([]) }}"
loop_control:
loop_var: fact_item
- name: Distribute CA certificates
become: true
block:
- name: CA and cert | Check if dest dir exist on remote host
file:
name: "{{ postgresql_ssl_path }}"
state: directory
loop:
- "{{ groups[postgresql_cacert_ca_host_group] | default([]) }}"
- "{{ groups[postgresql_cacert_clients_group] | default([]) }}"
loop_control:
loop_var: host_item
- name: Put CA key
copy:
content: "{{ postgresql_cacert_ca_key }}"
dest: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.key"
mode: 0600
owner: "{{ postgresql_user }}"
group: "{{ postgresql_group }}"
loop:
- "{{ groups[postgresql_cacert_ca_host_group] | default([]) }}"
- "{{ groups[postgresql_cacert_clients_group] | default([]) }}"
loop_control:
loop_var: host_item
- name: Put CA csr
copy:
content: "{{ postgresql_cacert_ca_csr }}"
dest: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.csr"
mode: 0644
owner: "{{ postgresql_user }}"
group: "{{ postgresql_group }}"
loop:
- "{{ groups[postgresql_cacert_ca_host_group] | default([]) }}"
- "{{ groups[postgresql_cacert_clients_group] | default([]) }}"
loop_control:
loop_var: host_item
- name: Put CA cert
copy:
content: "{{ postgresql_cacert_ca_cert }}"
dest: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.crt"
mode: 0644
owner: "{{ postgresql_user }}"
group: "{{ postgresql_group }}"
loop:
- "{{ groups[postgresql_cacert_ca_host_group] | default([]) }}"
- "{{ groups[postgresql_cacert_clients_group] | default([]) }}"
loop_control:
loop_var: host_item
- name: Put CA OpenSSL cert to PKI
copy:
content: "{{ postgresql_cacert_ca_cert }}"
dest: "{{ postgresql_cacert_ca_trust_dir }}/CA-{{ postgresql_self_signed_cert_name }}.crt"
mode: 0644
loop:
- "{{ groups[postgresql_cacert_ca_host_group] | default([]) }}"
- "{{ groups[postgresql_cacert_clients_group] | default([]) }}"
loop_control:
loop_var: host_item
register: postgresql_ca_trust_anchors
- name: Update CA trust
shell: "{{ postgresql_cacert_update_ca_trust_command }}"
loop:
- "{{ groups[postgresql_cacert_ca_host_group] | default([]) }}"
- "{{ groups[postgresql_cacert_clients_group] | default([]) }}"
loop_control:
loop_var: host_item
when:
- postgresql_ca_trust_anchors.changed
- postgresql_cacert_ca_trust_anchors_update

181
tasks/ssl/certs.yaml Normal file
View File

@ -0,0 +1,181 @@
- name: CA and certs | Generate CN certs and keys
when: inventory_hostname in groups[postgresql_cacert_ca_host_group]
block:
- name: Generate an OpenSSL private client key {{ item }} with the default values (4096 bits, RSA)
community.crypto.openssl_privatekey:
path: "{{ postgresql_ssl_path }}/{{ item }}.key"
register: postgresql_cacert_client_key_gen
- name: Generate PostgreSQL subject_alt_ips from ansible_host
set_fact:
postgresql_server_subject_alt_ips_from_ansible_host: "{{ hostvars[item]['ansible_host'] | regex_replace('^', 'IP:') }}"
when: hostvars[item]['ansible_host'] is defined
- name: Generate PostgreSQL subject_alt_ips from default ipv4 address
set_fact:
postgresql_server_subject_alt_ips: "{{ hostvars[item]['ansible_default_ipv4']['address'] | regex_replace('^', 'IP:') }}"
when:
- hostvars[item]['ansible_default_ipv4']['address'] is defined
- not postgresql_cacert_multiple_default_gw_workaround
- name: Generate PostgreSQL subject_alt_names from inventory_hostname
set_fact:
postgresql_server_subject_alt_names: "{{ item | regex_replace('^', 'DNS:') }}"
- name: Generate PostgreSQL subject_alt_ips from ansible_all_ipv4_addresses
set_fact:
postgresql_server_subject_alt_ips_all_ipv4: "{{ hostvars[item]['ansible_all_ipv4_addresses'] | map('regex_replace', '^', 'IP:') | join(',') }}"
when: hostvars[item]['ansible_all_ipv4_addresses'] is defined
- name: Generate PostgreSQL subject_alt_ips from postgresql_cacert_force_append_ips
set_fact:
postgresql_server_subject_alt_ips_force_append: "{{ postgresql_cacert_force_append_ips | map('regex_replace', '^', 'IP:') | join(',') }}"
when:
- postgresql_cacert_force_append_ips is defined
- postgresql_cacert_force_append_ips | length > 0
- name: Generate PostgreSQL subject_alt_names from postgresql_cacert_force_append_names
set_fact:
postgresql_server_subject_alt_names_force_append: "{{ postgresql_cacert_force_append_names | map('regex_replace', '^', 'DNS:') | join(',') }}"
when:
- postgresql_cacert_force_append_names is defined
- postgresql_cacert_force_append_names | length > 0
- name: Construct base subject_alt_name
set_fact:
subject_alt_name:
- "{{ postgresql_server_subject_alt_names }}"
- "{{ postgresql_server_subject_alt_ips_from_ansible_host }}"
- "{{ postgresql_server_subject_alt_ips_all_ipv4 }}"
- name: Construct subject_alt_name with postgresql_server_subject_alt_ips
set_fact:
subject_alt_name:
- "{{ subject_alt_name | join(',') }}"
- "{{ postgresql_server_subject_alt_ips }}"
when: postgresql_server_subject_alt_ips is defined
- name: Construct subject_alt_name with postgresql_server_subject_alt_ips_force_append
set_fact:
subject_alt_name:
- "{{ subject_alt_name | join(',') }}"
- "{{ postgresql_server_subject_alt_ips_force_append }}"
when: postgresql_server_subject_alt_ips_force_append is defined
- name: Construct subject_alt_name with postgresql_server_subject_alt_names_force_append
set_fact:
subject_alt_name:
- "{{ subject_alt_name | join(',') }}"
- "{{ postgresql_server_subject_alt_names_force_append }}"
when: postgresql_server_subject_alt_names_force_append is defined
- debug:
msg: "{{ subject_alt_name }}"
- name: Generate an OpenSSL Certificate Signing Request for client
community.crypto.openssl_csr:
path: "{{ postgresql_ssl_path }}/{{ item }}.csr"
privatekey_path: "{{ postgresql_ssl_path }}/{{ item }}.key"
common_name: "{{ item }}"
subject_alt_name: "{{ subject_alt_name | join(',') }}"
owner: "{{ postgresql_user }}"
group: "{{ postgresql_group }}"
register: postgresql_csr
- name: Generate an OpenSSL certificate for client signed with your own CA certificate
community.crypto.x509_certificate:
path: "{{ postgresql_ssl_path }}/{{ item }}.crt"
csr_path: "{{ postgresql_ssl_path }}/{{ item }}.csr"
ownca_path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.crt"
ownca_privatekey_path: "{{ postgresql_ssl_path }}/CA-{{ postgresql_self_signed_cert_name }}.key"
provider: ownca
owner: "{{ postgresql_user }}"
group: "{{ postgresql_group }}"
register: postgresql_cert
- name: Get {{ item }} OpenSSL crt and key content
ansible.builtin.shell: |
cat {{ postgresql_ssl_path }}/{{ item }}.crt {{ postgresql_ssl_path }}/{{ item }}.key
register: concated_crt_key
changed_when: false
- name: Concatenate and save {{ item }} OpenSSL crt and key to single file
copy:
content: "{{ concated_crt_key.stdout }}"
dest: "{{ postgresql_ssl_path }}/{{ item }}.pem"
- name: Get CN key {{ item }} content
slurp:
src: "{{ postgresql_ssl_path }}/{{ item }}.key"
register: postgresql_cacert_cn_certs_key_b64
- name: Get CN csr {{ item }} content
slurp:
src: "{{ postgresql_ssl_path }}/{{ item }}.csr"
register: postgresql_cacert_cn_certs_csr_b64
- name: Get CN cert {{ item }} content
slurp:
src: "{{ postgresql_ssl_path }}/{{ item }}.crt"
register: postgresql_cacert_cn_certs_cert_b64
- name: Get CN cert and key concat {{ item }} content
slurp:
src: "{{ postgresql_ssl_path }}/{{ item }}.pem"
register: postgresql_cacert_cn_certs_concat_b64
- name: Set facts about {{ item }} key and cert and delegate
set_fact:
postgresql_cacert_cn_certs_key: "{{ postgresql_cacert_cn_certs_key_b64.content | b64decode }}"
postgresql_cacert_cn_certs_csr: "{{ postgresql_cacert_cn_certs_csr_b64.content | b64decode }}"
postgresql_cacert_cn_certs_cert: "{{ postgresql_cacert_cn_certs_cert_b64.content | b64decode }}"
postgresql_cacert_cn_certs_concat: "{{ postgresql_cacert_cn_certs_concat_b64.content | b64decode }}"
delegate_to: "{{ fact_item }}"
delegate_facts: true
with_items:
- "{{ groups[postgresql_cacert_ca_host_group] | default([]) }}"
- "{{ groups[postgresql_cacert_clients_group] | default([]) }}"
loop_control:
loop_var: fact_item
- name: Distribute CN certificates
become: true
when:
- inventory_hostname in groups[postgresql_cacert_clients_group]
block:
- name: CA and cert | Check if dest dir exist on remote host
file:
name: "{{ postgresql_ssl_path }}"
state: directory
- name: Put CN key
copy:
content: "{{ postgresql_cacert_cn_certs_key }}"
dest: "{{ postgresql_ssl_path }}/{{ item }}.key"
mode: 0600
owner: "{{ postgresql_user }}"
group: "{{ postgresql_group }}"
- name: Put CN csr
copy:
content: "{{ postgresql_cacert_cn_certs_csr }}"
dest: "{{ postgresql_ssl_path }}/{{ item }}.csr"
mode: 0644
owner: "{{ postgresql_user }}"
group: "{{ postgresql_group }}"
- name: Put CN cert
copy:
content: "{{ postgresql_cacert_cn_certs_cert }}"
dest: "{{ postgresql_ssl_path }}/{{ item }}.crt"
mode: 0644
owner: "{{ postgresql_user }}"
group: "{{ postgresql_group }}"
- name: Put CN key and cert concat
copy:
content: "{{ postgresql_cacert_cn_certs_concat }}"
dest: "{{ postgresql_ssl_path }}/{{ item }}.pem"
mode: 0644
owner: "{{ postgresql_user }}"
group: "{{ postgresql_group }}"

26
tasks/ssl/main.yaml Normal file
View File

@ -0,0 +1,26 @@
- name: Add host to {{ postgresql_cacert_ca_host_group }}
add_host:
groups: "{{ postgresql_cacert_ca_host_group }}"
hostname: "{{ hostvars[item]['ansible_hostname'] }}"
ansible_host: "{{ hostvars[item]['ansible_host'] }}"
with_items:
- "{{ ansible_play_hosts[0] }}"
changed_when: false
when: groups[postgresql_cacert_ca_host_group] is not defined
- name: Add all hosts to {{ postgresql_cacert_clients_group }}
add_host:
groups: "{{ postgresql_cacert_clients_group }}"
hostname: "{{ hostvars[item]['ansible_hostname'] }}"
ansible_host: "{{ hostvars[item]['ansible_host'] }}"
with_items:
- "{{ ansible_play_hosts }}"
changed_when: false
when: groups[postgresql_cacert_clients_group] is not defined
- name: CA and certs | Include CA
include_tasks: ca.yaml
- name: CA and certs | Include Certificates
include_tasks: certs.yaml
loop: "{{ groups[postgresql_cacert_clients_group] }}"