diff --git a/defaults/main.yml b/defaults/main.yml index 53b180e..37fdc3c 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -1,9 +1,10 @@ --- psql_db_port: 5432 -psql_version: 11 +psql_version: 16 psql_conf_base_dir: '/etc/postgresql' psql_conf_default_dir: '{{ psql_conf_base_dir }}/{{ psql_version }}/main' -psql_force_ssl_client_connection: False +psql_conf_dir: "{{ psql_conf_default_dir }}" +psql_force_ssl_client_connection: false #psql_db_data: # Example of line needed to create a db, create the user that owns the db, manage the db accesses (used by iptables too). All the fields are mandatory. diff --git a/tasks/configure-access.yml b/tasks/configure-access.yml index 4385f89..0c78cc3 100644 --- a/tasks/configure-access.yml +++ b/tasks/configure-access.yml @@ -1,39 +1,29 @@ --- -- name: Manage the pg_hba.conf file - block: - - name: Give access to the remote postgresql client - lineinfile: name={{ psql_conf_base_dir }}/{{ item.0.pgsql_version }}/main/pg_hba.conf regexp="^host.* {{ item.0.name }} {{ item.0.user }} {{ item.1 }}.*$" line="host {{ item.0.name }} {{ item.0.user }} {{ item.1 }} md5" - with_subelements: - - '{{ psql_db_data | default([]) }}' - - allowed_hosts - when: - - psql_db_data is defined - - item.1 is defined - - not psql_force_ssl_client_connection - notify: Reload postgresql - - - name: Give access to the remote postgresql client, enforce ssl - lineinfile: name={{ psql_conf_base_dir }}/{{ item.0.pgsql_version }}/main/pg_hba.conf regexp="^host.* {{ item.0.name }} {{ item.0.user }} {{ item.1 }}.*$" line="hostssl {{ item.0.name }} {{ item.0.user }} {{ item.1 }} md5" - with_subelements: - - '{{ psql_db_data | default([]) }}' - - allowed_hosts - when: - - psql_db_data is defined - - item.1 is defined - - psql_force_ssl_client_connection - notify: Reload postgresql - +- name: configure-access | Manage the pg_hba.conf file delegate_to: "{{ item.0.db_host }}" when: item.0.db_host is defined - tags: [ 'postgresql', 'postgres', 'pg_hba', 'pg_db' ] - -- name: Manage the permissions of the pg_hba.conf file + tags: ['postgresql', 'postgres', 'pg_hba', 'pg_db'] block: - - name: Set the correct permissions to the pg_hba.conf file - file: dest={{ psql_conf_base_dir }}/{{ item.pgsql_version }}/main/pg_hba.conf owner=root group=postgres mode=0640 - with_items: '{{ psql_db_data | default([]) }}' + - name: configure-access | Give access to the remote postgresql client + community.postgresql.postgresql_pg_hba: + dest: '{{ psql_conf_dir }}/pg_hba.conf' + contype: '{% if psql_force_ssl_client_connection %}hostssl{% else %}host{% endif %}' + users: '{{ item.0.user }}' + address: '{{ item.1 }}' + databases: '{{ item.0.name }}' + # method: 'scram-sha-256' + method: 'md5' + owner: root + group: postgres + mode: "0640" + state: "{{ item.0.state | default('present') }}" + with_subelements: + - '{{ psql_db_data | default([]) }}' + - allowed_hosts + when: + - psql_db_data is defined + - item.1 is defined + notify: Reload postgresql - delegate_to: "{{ item.db_host }}" - when: item.db_host is defined - run_once: True - tags: [ 'postgresql', 'postgres', 'pg_hba', 'pg_conf', 'pg_db' ] + - name: configure-access | Flush handlers + ansible.builtin.meta: flush_handlers