ansible-role-postgresql/tasks/configure-access.yml

85 lines
4.0 KiB
YAML
Raw Normal View History

2020-06-03 19:53:13 +02:00
---
2020-07-30 14:14:39 +02:00
- name: Configure accesses on Deb/Ubuntu
block:
- name: Give access to the remote postgresql client
lineinfile: name={{ psql_conf_dir }}/pg_hba.conf regexp="^host.* {{ item.0.name }} {{ item.0.user }} {{ item.1 }}.*$" line="host {{ item.0.name }} {{ item.0.user }} {{ item.1 }} md5" owner=root group=postgres mode='0440'
2020-07-30 14:14:39 +02:00
with_subelements:
- '{{ psql_db_data | default([]) }}'
- allowed_hosts
when:
2020-10-18 20:15:02 +02:00
- psql_listen_on_ext_int
2020-07-30 14:14:39 +02:00
- psql_db_data is defined
- item.1 is defined
2020-10-18 20:15:02 +02:00
- not psql_force_ssl_client_connection
2020-07-30 14:14:39 +02:00
notify: Reload postgresql
tags: [ 'postgresql', 'postgres', 'pg_hba', 'pg_db' ]
- name: Give access to the remote postgresql client, force ssl
lineinfile: name={{ psql_conf_dir }}/pg_hba.conf regexp="^host.* {{ item.0.name }} {{ item.0.user }} {{ item.1 }}.*$" line="hostssl {{ item.0.name }} {{ item.0.user }} {{ item.1 }} md5" owner=root group=postgres mode='0440'
2020-07-30 14:14:39 +02:00
with_subelements:
- '{{ psql_db_data | default([]) }}'
- allowed_hosts
when:
2020-10-18 20:15:02 +02:00
- psql_listen_on_ext_int
2020-07-30 14:14:39 +02:00
- psql_db_data is defined
- item.1 is defined
2020-10-18 20:15:02 +02:00
- psql_force_ssl_client_connection
2020-07-30 14:14:39 +02:00
notify: Reload postgresql
tags: [ 'postgresql', 'postgres', 'pg_hba', 'pg_db' ]
# No conditionals, it is needed to perform base backups when the WAL archive is active
- name: Give local access with replication privileges to the postgres user
lineinfile: name={{ psql_conf_dir }}/pg_hba.conf regexp="^local replication postgres peer" line="local replication postgres peer" owner=root group=postgres mode='0440'
2020-07-30 14:14:39 +02:00
notify: Reload postgresql
tags: [ 'postgresql', 'postgres', 'pg_hba', 'pg_db' ]
when: ansible_distribution_file_variety == "Debian"
- name: Configure accesses on EL
block:
- name: Open the postgresql service to a specific zone.
firewalld: service=postgresql zone={{ postgresql_firewalld_zone }} permanent=True state=enabled immediate=True
when:
2020-10-18 20:15:02 +02:00
- psql_listen_on_ext_int
- firewalld_enabled
tags: [ 'postgresql', 'postgres', 'pg_hba', 'pg_db', 'firewall', 'iptables_rules' ]
2020-07-30 14:14:39 +02:00
- name: Give access to the remote postgresql client
lineinfile: name={{ psql_el_conf_dir }}/pg_hba.conf regexp="^host.* {{ item.0.name }} {{ item.0.user }} {{ item.1 }}.*$" line="host {{ item.0.name }} {{ item.0.user }} {{ item.1 }} md5" owner=root group=postgres mode='0440'
2020-07-30 14:14:39 +02:00
with_subelements:
- '{{ psql_db_data | default([]) }}'
- allowed_hosts
when:
2020-10-18 20:15:02 +02:00
- psql_listen_on_ext_int
2020-07-30 14:14:39 +02:00
- psql_db_data is defined
- item.1 is defined
2020-10-18 20:15:02 +02:00
- not psql_force_ssl_client_connection
2020-07-30 14:14:39 +02:00
notify: Reload postgresql
tags: [ 'postgresql', 'postgres', 'pg_hba', 'pg_db' ]
- name: Give access to the remote postgresql client, force ssl
lineinfile: name={{ psql_el_conf_dir }}/pg_hba.conf regexp="^host.* {{ item.0.name }} {{ item.0.user }} {{ item.1 }}.*$" line="hostssl {{ item.0.name }} {{ item.0.user }} {{ item.1 }} md5" owner=root group=postgres mode='0440'
2020-07-30 14:14:39 +02:00
with_subelements:
- '{{ psql_db_data | default([]) }}'
- allowed_hosts
when:
2020-10-18 20:15:02 +02:00
- psql_listen_on_ext_int
2020-07-30 14:14:39 +02:00
- psql_db_data is defined
- item.1 is defined
2020-10-18 20:15:02 +02:00
- psql_force_ssl_client_connection
2020-07-30 14:14:39 +02:00
notify: Reload postgresql
tags: [ 'postgresql', 'postgres', 'pg_hba', 'pg_db' ]
# No conditionals, it is needed to perform base backups when the WAL archive is active
2020-07-31 13:08:43 +02:00
- name: Remove the ident authentication for the local connections
lineinfile: name={{ psql_el_conf_dir }}/pg_hba.conf regexp="^local.*?all.*?ident$" state=absent owner=root group=postgres mode='0440'
2020-07-31 13:08:43 +02:00
notify: Reload postgresql
tags: [ 'postgresql', 'postgres', 'pg_hba', 'pg_db' ]
2020-07-30 14:14:39 +02:00
- name: Give local access with replication privileges to the postgres user
lineinfile: name={{ psql_el_conf_dir }}/pg_hba.conf regexp="^local replication postgres peer" line="local replication postgres peer" owner=root group=postgres mode='0440'
2020-07-30 14:14:39 +02:00
notify: Reload postgresql
tags: [ 'postgresql', 'postgres', 'pg_hba', 'pg_db' ]
when: ansible_distribution_file_variety == "RedHat"