# PostgreSQL server of the S2I2S project

One VM, `m1.large` (RAM 8 - VCPUs 4), Ubuntu 24.04, 20 GB of root disk, with
**two interfaces**:

| Interface | Address | Use |
|---|---|---|
| main private network | `10.10.0.162` | administration: ansible, monitoring, backups |
| `postgresql-srv-net` (created here) | `192.168.0.5` | the only address the database listens on |

and **two SSD volumes of 100 GB** (`CephSSD`): `/dev/vdb` for the data
directory, `/dev/vdc` for the write ahead log.

The dedicated network is `192.168.0.0/22`, no gateway, DHCP pool
`192.168.0.100 - 192.168.3.254`. The addresses match what the ansible playbooks
already expect (`postgresql_production_host` and
`shared_postgresql_server_public` in `group_vars/openstack_s2i2s` of
`infrastructure-playbooks`).

Two security groups are created:

* `access_to_the_postgresql_service` — on the server port: ingress on 5432 and
  ICMP from `192.168.0.0/22` only;
* `vm_access_to_the_postgresql_service` — to be put on the port that **every
  client** has in the dedicated network: egress to `192.168.0.5/32:5432` plus
  ICMP and DHCP. Its ID is an output of this workspace, used for instance by
  `s2i2s/keycloak`.

The resources, the sizing and the dedicated network are in
[`../../modules/postgresql`](../../modules/postgresql), as defaults of
`postgresql_data`: override them in the module call to change them. The only
thing this workspace decides is the address on the main private network, which
comes from the address plan in [`../variables`](../variables)
(`basic_services_ip.postgresql`).

## Order of the applies

```
main_net_dns_router  ->  project-setup  ->  postgresql
```

This workspace reads the state of the first two.

```bash
tofu init
tofu plan -out=postgresql.plan
tofu apply postgresql.plan
```

After the apply, regenerate the ansible inventory in
`infrastructure-playbooks`, which reads this state:

```bash
ansible-playbook tofu-inventory.yml --diff
```