Add postgres role

Or rather rip it out of netbox. Improve DB password handling.
This commit is contained in:
Timotej Lazar 2024-06-05 12:54:55 +02:00
parent af9e30eb3e
commit 22f363d06a
4 changed files with 81 additions and 63 deletions

View file

@ -1,55 +0,0 @@
- name: Install packages
package:
name:
- postgresql
- py3-psycopg2
- redis
- name: Enable services
service:
name: '{{ item }}'
enabled: true
state: started
loop:
- postgresql
- redis
- name: Create .pgpass
copy:
dest: '{{ user_info.home }}/.pgpass'
content: |
localhost:5432:{{ database }}:{{ user }}:{{ db_password }}
force: no
mode: 0600
owner: '{{ user_info.uid }}'
group: '{{ user_info.group }}'
- become: yes
become_method: su
become_user: postgres
block:
- name: Create database
postgresql_db:
name: '{{ database }}'
- name: Create database user
postgresql_user:
db: '{{ database }}'
name: '{{ user }}'
password: '{{ db_password }}'
no_password_changes: yes
- name: Set schema owner
postgresql_owner:
db: '{{ database }}'
new_owner: '{{ user }}'
obj_name: public
obj_type: schema
- name: Grant database privileges
postgresql_privs:
db: '{{ database }}'
role: '{{ user }}'
privs: CREATE
type: database

View file

@ -1,8 +1,12 @@
- name: Set variables - name: Install redis
set_fact: package:
user: '{{ user | default("netbox") }}' name: redis
database: '{{ database | default("netbox") }}'
db_password: '{{ lookup("password", "/dev/null", chars=["ascii_letters", "digits"]) }}' - name: Enable redis service
service:
name: redis
enabled: true
state: started
- name: Create group for web service - name: Create group for web service
group: group:
@ -18,8 +22,5 @@
system: yes system: yes
register: user_info register: user_info
- name: Set up database
import_tasks: db.yml
- name: Set up app - name: Set up app
import_tasks: app.yml import_tasks: app.yml

View file

@ -0,0 +1,69 @@
- name: Install packages
package:
name:
- postgresql
- py3-psycopg2
- name: Enable services
service:
name: postgresql
enabled: true
state: started
- name: Check for existing database password
become: yes
become_user: '{{ user }}'
become_method: su
slurp:
path: '~/.pgpass'
register: pgpass
failed_when: false
- name: Get database password
when: '"content" in pgpass'
set_fact: db_password='{{ pgpass.content | b64decode | split(":") | last }}'
- name: Create database password
when: '"content" not in pgpass'
set_fact: db_password='{{ lookup("password", "/dev/null", chars=["ascii_letters", "digits"]) }}'
- name: Create .pgpass
become: yes
become_user: '{{ user }}'
become_method: su
copy:
dest: '~/.pgpass'
content: |
localhost:5432:{{ user }}:{{ user }}:{{ db_password }}
force: no
mode: 0600
- become: yes
become_method: su
become_user: postgres
block:
- name: Create database
postgresql_db:
name: '{{ database | default(user) }}'
- name: Create database user
postgresql_user:
db: '{{ database | default(user) }}'
name: '{{ user }}'
password: '{{ db_password }}'
no_password_changes: '{{ "content" in pgpass }}'
- name: Set schema owner
postgresql_owner:
db: '{{ database | default(user) }}'
new_owner: '{{ user }}'
obj_name: public
obj_type: schema
- name: Grant database privileges
postgresql_privs:
db: '{{ database | default(user) }}'
role: '{{ user }}'
privs: CREATE
type: database

View file

@ -24,8 +24,11 @@
- hosts: netbox - hosts: netbox
roles: roles:
- alpine - alpine
- postgres
- nginx - nginx
- netbox - netbox
vars:
user: netbox
- hosts: samba - hosts: samba
roles: roles: