openstack-infrastructure-terraform/s2i2s/postgresql/README.md

PostgreSQL server of the S2I2S project

One VM, m1.large (RAM 8 - VCPUs 4), Ubuntu 24.04, 20 GB of root disk, with two interfaces:

Interface	Address	Use
main private network	10.10.0.162	administration: ansible, monitoring, backups
postgresql-srv-net (created here)	192.168.0.5	the only address the database listens on

and two SSD volumes of 100 GB (CephSSD): /dev/vdb for the data directory, /dev/vdc for the write ahead log.

The dedicated network is 192.168.0.0/22, no gateway, DHCP pool 192.168.0.100 - 192.168.3.254. The addresses match what the ansible playbooks already expect (postgresql_production_host and shared_postgresql_server_public in group_vars/openstack_s2i2s of infrastructure-playbooks).

Two security groups are created:

• access_to_the_postgresql_service — on the server port: ingress on 5432 and ICMP from 192.168.0.0/22 only;
• vm_access_to_the_postgresql_service — to be put on the port that every client has in the dedicated network: egress to 192.168.0.5/32:5432 plus ICMP and DHCP. Its ID is an output of this workspace, used for instance by s2i2s/keycloak.

The resources, the sizing and the dedicated network are in ../../modules/postgresql, as defaults of postgresql_data: override them in the module call to change them. The only thing this workspace decides is the address on the main private network, which comes from the address plan in ../variables (basic_services_ip.postgresql).

Order of the applies

main_net_dns_router  ->  project-setup  ->  postgresql

This workspace reads the state of the first two.

tofu init
tofu plan -out=postgresql.plan
tofu apply postgresql.plan

After the apply, regenerate the ansible inventory in infrastructure-playbooks, which reads this state:

ansible-playbook tofu-inventory.yml --diff