--- - name: postgresql-prometheus-exporter | Database role used by the exporter tags: ['postgresql', 'postgres', 'prometheus', 'postgres_exporter'] when: psql_prometheus_exporter_install block: - name: postgresql-prometheus-exporter | Create the database role {{ psql_prometheus_exporter_db_user }} become: true become_user: postgres community.postgresql.postgresql_user: name: '{{ psql_prometheus_exporter_db_user }}' password: "{{ omit if psql_prometheus_exporter_use_socket else psql_prometheus_exporter_db_pwd }}" role_attr_flags: 'LOGIN,NOSUPERUSER,NOCREATEDB,NOCREATEROLE' state: present no_log: "{{ not psql_prometheus_exporter_use_socket }}" # pg_monitor carries pg_read_all_settings, pg_read_all_stats and # pg_stat_scan_tables: everything the exporter reads, and nothing else. - name: postgresql-prometheus-exporter | Grant pg_monitor to {{ psql_prometheus_exporter_db_user }} become: true become_user: postgres community.postgresql.postgresql_membership: group: pg_monitor target_role: '{{ psql_prometheus_exporter_db_user }}' state: present # Peer authentication: the system user and the database role have the same # name, so no map is needed. Always written, the socket is also the way to # reach the cluster by hand. - name: postgresql-prometheus-exporter | Local peer access for {{ psql_prometheus_exporter_db_user }} community.postgresql.postgresql_pg_hba: dest: '{{ psql_conf_dir }}/pg_hba.conf' contype: local users: '{{ psql_prometheus_exporter_db_user }}' databases: all method: peer state: present owner: root group: postgres mode: "0640" when: psql_prometheus_exporter_use_socket notify: Reload postgresql - name: postgresql-prometheus-exporter | TCP access for {{ psql_prometheus_exporter_db_user }} community.postgresql.postgresql_pg_hba: dest: '{{ psql_conf_dir }}/pg_hba.conf' contype: '{% if psql_force_ssl_client_connection or psql_enable_ssl %}hostssl{% else %}host{% endif %}' users: '{{ psql_prometheus_exporter_db_user }}' address: '{{ psql_prometheus_exporter_db_host }}/32' databases: all method: scram-sha-256 state: present owner: root group: postgres mode: "0640" when: - not psql_prometheus_exporter_use_socket - psql_prometheus_exporter_manage_pg_hba notify: Reload postgresql - name: postgresql-prometheus-exporter | Flush handlers ansible.builtin.meta: flush_handlers - name: postgresql-prometheus-exporter | Manage pg_stat_statements tags: ['postgresql', 'postgres', 'prometheus', 'postgres_exporter', 'pg_stat_statements'] when: - psql_prometheus_exporter_install - psql_prometheus_exporter_stat_statements become: true become_user: postgres block: # Read it instead of writing a fixed value: another extension may already be # preloaded (auto_explain, pg_cron, ...) and overwriting the list would # silently unload it. - name: postgresql-prometheus-exporter | Read the current shared_preload_libraries community.postgresql.postgresql_query: db: postgres query: 'SHOW shared_preload_libraries' register: psql_current_preload_libraries changed_when: false - name: postgresql-prometheus-exporter | Preload the library {{ psql_prometheus_exporter_stat_statements_library }} vars: psql_preload_libraries: "{{ psql_current_preload_libraries.query_result[0]['shared_preload_libraries'] | split(',') | map('trim') | reject('equalto', '') | list }}" community.postgresql.postgresql_set: name: shared_preload_libraries value: "{{ (psql_preload_libraries + [psql_prometheus_exporter_stat_statements_library]) | unique | join(',') }}" when: psql_prometheus_exporter_stat_statements_library not in psql_preload_libraries notify: Restart postgresql # The library is only loaded at startup, and the parameters below do not # exist until it is. - name: postgresql-prometheus-exporter | Restart PostgreSQL so that the library is loaded ansible.builtin.meta: flush_handlers - name: postgresql-prometheus-exporter | Create the extension in {{ psql_prometheus_exporter_stat_statements_db }} community.postgresql.postgresql_ext: name: '{{ psql_prometheus_exporter_stat_statements_library }}' db: '{{ psql_prometheus_exporter_stat_statements_db }}' state: present - name: postgresql-prometheus-exporter | Set the pg_stat_statements parameters community.postgresql.postgresql_set: name: '{{ item.name }}' value: "{% if item.set | bool %}{{ item.value }}{% else %}default{% endif %}" loop: '{{ psql_prometheus_exporter_stat_statements_parameters }}' loop_control: label: '{{ item.name }}' notify: Restart postgresql - name: postgresql-prometheus-exporter | Flush handlers ansible.builtin.meta: flush_handlers - name: postgresql-prometheus-exporter | Install the exporter tags: ['postgresql', 'postgres', 'prometheus', 'postgres_exporter'] when: psql_prometheus_exporter_install block: - name: postgresql-prometheus-exporter | Create the system user {{ psql_prometheus_exporter_user }} ansible.builtin.user: name: '{{ psql_prometheus_exporter_user }}' home: '{{ psql_prometheus_exporter_home }}' createhome: false shell: /usr/sbin/nologin system: true - name: postgresql-prometheus-exporter | Create the exporter directories ansible.builtin.file: dest: '{{ item }}' state: directory owner: root group: root mode: "0755" loop: - '{{ psql_prometheus_exporter_home }}' - '{{ psql_prometheus_exporter_dist_dir }}' - name: postgresql-prometheus-exporter | Download postgres_exporter {{ psql_prometheus_exporter_version }} ansible.builtin.get_url: url: '{{ psql_prometheus_exporter_download_url }}' dest: '/srv/{{ psql_prometheus_exporter_file }}' owner: root group: root mode: "0644" - name: postgresql-prometheus-exporter | Unarchive the postgres_exporter distribution ansible.builtin.unarchive: src: '/srv/{{ psql_prometheus_exporter_file }}' dest: '{{ psql_prometheus_exporter_dist_dir }}' remote_src: true owner: root group: root creates: '{{ psql_prometheus_exporter_cmd }}' notify: Restart postgres exporter - name: postgresql-prometheus-exporter | Install the exporter environment file ansible.builtin.template: src: postgres_exporter-environment.j2 dest: '{{ psql_prometheus_exporter_env_file }}' owner: root group: '{{ psql_prometheus_exporter_user }}' mode: "0640" # The rendered file contains the database password when the exporter # connects over TCP diff: '{{ psql_prometheus_exporter_use_socket }}' notify: Restart postgres exporter - name: postgresql-prometheus-exporter | Install the exporter systemd unit ansible.builtin.template: src: postgres_exporter.service.j2 dest: /etc/systemd/system/postgres_exporter.service owner: root group: root mode: "0644" notify: - Reload systemd - Restart postgres exporter - name: postgresql-prometheus-exporter | Flush handlers ansible.builtin.meta: flush_handlers - name: postgresql-prometheus-exporter | Ensure that postgres_exporter is started and enabled ansible.builtin.service: name: postgres_exporter state: started enabled: true - name: postgresql-prometheus-exporter | Remove the exporter tags: ['postgresql', 'postgres', 'prometheus', 'postgres_exporter'] when: not psql_prometheus_exporter_install block: - name: postgresql-prometheus-exporter | Ensure that postgres_exporter is stopped and disabled ansible.builtin.service: name: postgres_exporter state: stopped enabled: false failed_when: false - name: postgresql-prometheus-exporter | Remove the exporter systemd unit ansible.builtin.file: dest: /etc/systemd/system/postgres_exporter.service state: absent notify: Reload systemd - name: postgresql-prometheus-exporter | Manage the exporter firewalld rules when: - psql_prometheus_exporter_install - ansible_distribution_file_variety == "RedHat" - firewalld_enabled is defined and firewalld_enabled | bool tags: ['postgresql', 'postgres', 'prometheus', 'postgres_exporter', 'firewall', 'firewalld'] block: - name: postgresql-prometheus-exporter | Open the exporter port {{ psql_prometheus_exporter_port }} ansible.posix.firewalld: port: '{{ psql_prometheus_exporter_port }}/tcp' zone: '{{ psql_prometheus_exporter_firewalld_zone }}' permanent: true state: enabled immediate: true