252 lines
14 KiB
YAML
252 lines
14 KiB
YAML
---
|
|
psql_enabled: true
|
|
# I prefer to use the postgresql.org repositories
|
|
#
|
|
# See the features matrix here: http://www.postgresql.org/about/featurematrix/
|
|
#
|
|
pg_use_postgresql_org_repo: true
|
|
postgresql_deb_repo_key_url: "https://www.postgresql.org/media/keys/ACCC4CF8.asc"
|
|
postgresql_deb_repo_key: /etc/apt/keyrings/postgresql.asc
|
|
postgresql_deb_repository_url: "http://apt.postgresql.org/pub/repos/apt/"
|
|
postgresql_deb_repository_rel: "{{ ansible_lsb.codename }}-pgdg"
|
|
psql_postgresql_install: true
|
|
postgresql_client_only: false
|
|
psql_pkg_state: present
|
|
postgresql_enabled: true
|
|
psql_version: 16
|
|
psql_db_host: localhost
|
|
psql_db_port: 5432
|
|
psql_db_size_w: 150000000
|
|
psql_db_size_c: 170000000
|
|
psql_max_connections: 1024
|
|
psql_listen_on_ext_int: false
|
|
# Only used when psql_listen_on_ext_int is true. '*' is every interface; a
|
|
# comma separated list of addresses restricts the cluster to some of them, for
|
|
# example 'localhost,192.168.0.5' when the server has a management interface
|
|
# that must not carry database traffic
|
|
psql_listen_addresses: '*'
|
|
psql_use_alternate_data_dir: false
|
|
# Deb/Ubuntu
|
|
psql_data_root_dir: '/var/lib/postgresql/{{ psql_version }}'
|
|
psql_data_dir: '{{ psql_data_root_dir }}/main'
|
|
psql_conf_dir: '{% if ansible_distribution_file_variety == "Debian" %}/etc/postgresql/{{ psql_version }}/main{% elif ansible_distribution_file_variety == "RedHat" %}{{ psql_el_data_dir }}{% endif %}'
|
|
psql_log_dir: /var/log/postgresql
|
|
postgresql_install_client_only: false
|
|
|
|
# Debian/Ubuntu
|
|
postgresql_pkgs:
|
|
- 'postgresql-{{ psql_version }}'
|
|
- 'postgresql-contrib-{{ psql_version }}'
|
|
- 'postgresql-client-{{ psql_version }}'
|
|
- pgtop
|
|
- "{% if ansible_distribution_version is version_compare('20.04', '>=') %}python3-psycopg2{% else %}python-psycopg2{% endif %}"
|
|
|
|
psql_el_install_scl_version: false
|
|
psql_el_install_from_pgdg_repo: true
|
|
psql_el_pgdg_repo_url: "https://download.postgresql.org/pub/repos/yum/reporpms/EL-{{ ansible_distribution_major_version }}-x86_64/pgdg-redhat-repo-latest.noarch.rpm"
|
|
psql_scl_base_dir: '/var/opt/rh/rh-postgresql{{ psql_version }}/lib/pgsql'
|
|
psql_el_base_dir: '/var/lib/pgsql/{{ psql_version }}'
|
|
psql_el_data_dir: '{{ psql_el_base_dir }}/data'
|
|
psql_el_conf_dir: '{{ psql_el_data_dir }}'
|
|
|
|
psql_el_pgdg_packages:
|
|
- 'postgresql{{ psql_version }}-server'
|
|
- 'postgresql{{ psql_version }}-contrib'
|
|
- pg_top
|
|
- pgcluu
|
|
- python-psycopg2
|
|
|
|
psql_el_scl_packages:
|
|
- 'rh-postgresql{{ psql_version }}-runtime'
|
|
- 'rh-postgresql{{ psql_version }}-postgresql'
|
|
- 'rh-postgresql{{ psql_version }}-postgresql-server'
|
|
- 'rh-postgresql{{ psql_version }}-postgresql-contrib'
|
|
- python-psycopg2
|
|
|
|
psql_conf_parameters:
|
|
- { name: 'max_connections', value: '{{ psql_max_connections }}', set: 'true' }
|
|
- { name: 'shared_buffers', value: '{{ (ansible_memtotal_mb / 4) | int }}MB', set: 'true' }
|
|
- { name: 'work_mem', value: '{{ ((ansible_memtotal_mb * 1024) / (400 * ansible_processor_vcpus)) | int }}kB', set: 'true' }
|
|
- { name: 'maintenance_work_mem', value: '{{ (ansible_memtotal_mb / 8) | int }}MB', set: 'true' }
|
|
- { name: 'temp_buffers', value: '{{ ansible_memtotal_mb }}kB', set: 'true' }
|
|
- { name: 'wal_buffers', value: '{{ (ansible_memtotal_mb / 1024 * 2) | int }}MB', set: 'true' }
|
|
- { name: 'min_wal_size', value: '{{ (ansible_memtotal_mb / 16) | int }}MB', set: 'true' }
|
|
- { name: 'max_wal_size', value: '{{ (ansible_memtotal_mb / 8) | int }}MB', set: 'true' }
|
|
- { name: 'effective_cache_size', value: '{{ (ansible_memtotal_mb / 1.3) | int }}MB', set: 'true' }
|
|
- { name: 'max_stack_depth', value: '2MB', set: 'false' }
|
|
- { name: 'max_files_per_process', value: '8192', set: 'false' }
|
|
|
|
# Custom parameters. Default empty
|
|
psql_conf_custom_parameters: []
|
|
|
|
# logging configuration. Important: the parameters that need a restart must be listed in psql_conf_parameters
|
|
psql_log_configuration:
|
|
- { name: 'log_destination', value: 'stderr', set: 'true' }
|
|
- { name: 'logging_collector', value: 'off', set: 'false' }
|
|
- { name: 'log_directory', value: '{{ psql_log_dir }}', set: 'true' }
|
|
- { name: 'log_rotation_age', value: '1d', set: 'true' }
|
|
- { name: 'log_rotation_size', value: '10MB', set: 'true' }
|
|
- { name: 'client_min_messages', value: 'notice', set: 'true' }
|
|
- { name: 'log_min_messages', value: 'warning', set: 'true' }
|
|
- { name: 'log_min_error_statement', value: 'error', set: 'true' }
|
|
- { name: 'log_min_duration_statement', value: '-1', set: 'true' }
|
|
- { name: 'log_checkpoints', value: 'off', set: 'true' }
|
|
- { name: 'log_duration', value: 'off', set: 'true' }
|
|
- { name: 'log_error_verbosity', value: 'default', set: 'true' }
|
|
|
|
# Treat vacuum separately. Important: the parameters that need a restart must be listed in psql_conf_parameters
|
|
psql_autovacuum_configuration:
|
|
- { name: 'track_counts', value: 'on', set: 'true' }
|
|
- { name: 'autovacuum', value: 'on', set: 'true' }
|
|
- { name: 'log_autovacuum_min_duration', value: '-1', set: 'true' }
|
|
- { name: 'autovacuum_vacuum_threshold', value: '50', set: 'true' }
|
|
- { name: 'autovacuum_analyze_threshold', value: '50', set: 'true' }
|
|
- { name: 'autovacuum_vacuum_scale_factor', value: '0.2', set: 'true' }
|
|
- { name: 'autovacuum_vacuum_cost_limit', value: '1000', set: 'true' }
|
|
- { name: 'autovacuum_max_workers', value: '10', set: 'true' }
|
|
- { name: 'autovacuum_naptime', value: '10', set: 'true' }
|
|
|
|
# Streaming replication settings
|
|
postgresql_streaming_replication: false
|
|
postgresql_streaming_replication_primary_node: 'localhost'
|
|
psql_streaming_replication_hosts:
|
|
- 'localhost'
|
|
psql_streaming_replication_user: psql_replica
|
|
#psql_streaming_replication_pwd: 'use a vault'
|
|
psql_streaming_replication_config:
|
|
- { name: 'wal_level', value: 'replica', set: 'true' }
|
|
- { name: 'max_wal_senders', value: '10', set: 'true' }
|
|
- { name: 'wal_keep_size', value: '0', set: 'true' }
|
|
- { name: 'max_slot_wal_keep_size', value: '50MB', set: 'true' }
|
|
- { name: 'wal_compression', value: 'on', set: 'true' }
|
|
- { name: 'wal_log_hints', value: 'on', set: 'true' }
|
|
- { name: 'hot_standby', value: 'on', set: 'true' }
|
|
- { name: 'archive_mode', value: 'always', set: 'true' }
|
|
- { name: 'archive_command', value: "cp %p {{ psql_wal_archiving_log_dir }}/%f", set: 'true' }
|
|
- { name: 'restore_command', value: "cp {{ psql_wal_archiving_log_dir }}/%f %p", set: 'true' }
|
|
- { name: 'archive_cleanup_command', value: "pg_archivecleanup {{ psql_wal_archiving_log_dir }} %r", set: 'true' }
|
|
|
|
# SSL as a special case
|
|
psql_enable_ssl: false
|
|
psql_force_ssl_client_connection: false
|
|
postgresql_letsencrypt_managed: '{% if letsencrypt_acme_install is defined and letsencrypt_acme_install %}true{% else %}false{% endif %} | bool'
|
|
psql_ssl_privkey_global_file: '{% if postgresql_letsencrypt_managed %}{{ letsencrypt_acme_sh_certificates_install_path }}/privkey{% else %}{{ pki_dir }}/keys/{{ ansible_fqdn}}-key.pem{% endif %}'
|
|
psql_ssl_privkey_file: /etc/pki/postgresql/postgresql.key
|
|
psql_ssl_cert_file: '{% if postgresql_letsencrypt_managed %}{{ letsencrypt_acme_sh_certificates_install_path }}/fullchain{% else %}{{ pki_dir }}/certs/{{ ansible_fqdn}}.pem{% endif %}'
|
|
psql_ssl_ca_file: '{% if ansible_distribution_file_variety == "Debian" %}/etc/ssl/certs/ca-certificates.crt{% elif ansible_distribution_file_variety == "RedHat" %}/etc/pki/tls/cert.pem{% endif %}'
|
|
psql_conf_ssl_parameters:
|
|
- { name: 'ssl', value: 'true', set: 'true' }
|
|
- { name: 'ssl_cert_file', value: '{{ psql_ssl_cert_file }}', set: 'true' }
|
|
- { name: 'ssl_key_file', value: '{{ psql_ssl_privkey_file }}', set: 'true' }
|
|
- { name: 'ssl_ca_file', value: '{{ psql_ssl_ca_file }}', set: 'true' }
|
|
|
|
psql_conf_disable_ssl_parameters:
|
|
- { name: 'ssl', value: 'false', set: 'true' }
|
|
|
|
psql_set_shared_memory: false
|
|
psql_sysctl_file: 30-postgresql-shm.conf
|
|
psql_sysctl_kernel_sharedmem_parameters:
|
|
- { name: 'kernel.shmmax', value: '33554432' }
|
|
- { name: 'kernel.shmall', value: '2097152' }
|
|
|
|
psql_db_name: db_name
|
|
psql_db_user: db_user
|
|
psql_db_pwd: "We cannot save the password into the repository. Use another variable and change pgpass.j2 accordingly. Encrypt the file that contains the variable with ansible-vault"
|
|
|
|
#psql_db_data:
|
|
# Example of line needed to create a db, create the user that owns the db, manage the db accesses (used by iptables too). All the fields are mandatory.
|
|
#- { name: '{{ psql_db_name }}', encoding: 'UTF8', user: '{{ psql_db_user }}', pwd: '{{ psql_db_pwd }}', roles: 'NOCREATEDB,NOSUPERUSER', extensions: [ 'postgis', 'pgpool_regclass', 'pgpool_recovery' ], allowed_hosts: [ 'xxx.xxx.xxx.xxx/32', 'yyy.yyy.yyy.yyy/32' ], managedb: true }
|
|
# Example of line needed to manage the db accesses (used by iptables too), without creating the db and the user. Useful, for example, to give someone access to the postgresql db
|
|
#- { name: '{{ psql_db_name }}', user: '{{ psql_db_user }}', allowed_hosts: [ 'xxx.xxx.xxx.xxx/32', 'yyy.yyy.yyy.yyy/32' ], managedb: false }
|
|
# Example of line needed to remove a db, create the user that owns the db, manage the db accesses (used by iptables too). All the fields are mandatory.
|
|
#- { name: '{{ psql_db_name }}', encoding: 'UTF8', user: '{{ psql_db_user }}', pwd: '{{ psql_db_pwd }}', managedb: true, roles: 'NOCREATEDB,NOSUPERUSER', extensions: [ 'postgis', 'pgpool_regclass', 'pgpool_recovery' ], allowed_hosts: [ 'xxx.xxx.xxx.xxx/32', 'yyy.yyy.yyy.yyy/32' ], state=absent }
|
|
|
|
# postgis
|
|
postgres_install_gis_extensions: false
|
|
postgres_gis_version: 3
|
|
postgres_gis_shortver: 3
|
|
postgres_gis_pkgs:
|
|
- 'postgresql-{{ psql_version }}-postgis-{{ postgres_gis_version }}'
|
|
|
|
postgres_el_gis_pkgs:
|
|
- 'postgis{{ postgres_gis_shortver }}-{{ psql_version }}'
|
|
- 'postgis{{ postgres_gis_shortver }}-{{ psql_version }}-client'
|
|
|
|
# Local backup
|
|
pg_backup_enabled: true
|
|
pg_el_backup_conf_dir: /etc/sysconfig
|
|
pg_backup_conf_dir: /etc/default
|
|
pg_backup_bin: /usr/local/sbin/postgresql-backup
|
|
pg_backup_pgdump_bin: /usr/bin/pg_dump
|
|
pg_backup_retain_copies: 2
|
|
pg_backup_build_db_list: "yes"
|
|
psql_wal_files_archiving_enabled: false
|
|
psql_wal_archiving_log_dir: '{{ psql_data_dir }}/archive_log'
|
|
psql_base_backup_dir: '{{ pg_backup_base_dir }}/base_backup'
|
|
# Dynamically created from psql_db_data if pg_backup_db_list is not set
|
|
#pg_backup_db_list: '{{ psql_db_name}}'
|
|
pg_backup_base_dir: /var/lib/pgsql
|
|
pg_backup_destdir: '{{ pg_backup_base_dir }}/backups'
|
|
pg_backup_logdir: /var/log/postgresql
|
|
pg_backup_logfile: '{{ pg_backup_logdir }}/postgresql-backup.log'
|
|
pg_backup_use_auth: "no"
|
|
pg_backup_pass_file: /root/.pgpass
|
|
pg_backup_use_nagios: "yes"
|
|
|
|
# Prometheus exporter: https://github.com/prometheus-community/postgres_exporter
|
|
# It must run on the database host, so it is installed here and not by a
|
|
# separate role.
|
|
psql_prometheus_exporter_install: false
|
|
psql_prometheus_exporter_version: "0.20.1"
|
|
psql_prometheus_exporter_releases_url: 'https://github.com/prometheus-community/postgres_exporter/releases/download'
|
|
psql_prometheus_exporter_download_url: '{{ psql_prometheus_exporter_releases_url }}/v{{ psql_prometheus_exporter_version }}/{{ psql_prometheus_exporter_file }}'
|
|
psql_prometheus_exporter_port: 9187
|
|
psql_prometheus_exporter_listen_address: '0.0.0.0'
|
|
psql_prometheus_exporter_metrics_path: /metrics
|
|
psql_prometheus_exporter_db_user: postgres_exporter
|
|
# The database the exporter connects to. The cluster wide metrics do not depend
|
|
# on it; per database metrics need psql_prometheus_exporter_auto_discover_dbs
|
|
psql_prometheus_exporter_db_name: postgres
|
|
# Default connection: unix socket with peer authentication. The exporter runs
|
|
# as its own system user, whose name is the same as the database role, so
|
|
# there is no password anywhere. Set to false to connect over TCP instead, and
|
|
# then psql_prometheus_exporter_db_pwd becomes mandatory.
|
|
psql_prometheus_exporter_use_socket: true
|
|
psql_prometheus_exporter_db_socket_dir: /var/run/postgresql
|
|
psql_prometheus_exporter_db_host: 127.0.0.1
|
|
psql_prometheus_exporter_db_port: '{{ psql_db_port }}'
|
|
psql_prometheus_exporter_db_sslmode: require
|
|
psql_prometheus_exporter_db_pwd: ''
|
|
# Scrape every database of the cluster, not only the one connected to. The
|
|
# exporter role needs CONNECT on all of them (granted to PUBLIC by default)
|
|
psql_prometheus_exporter_auto_discover_dbs: false
|
|
psql_prometheus_exporter_exclude_dbs:
|
|
- template0
|
|
- template1
|
|
# pg_stat_statements: slow queries, call counts and I/O per normalised
|
|
# statement. Off by default because switching it on adds the library to
|
|
# shared_preload_libraries, which needs a RESTART of the cluster: enable it
|
|
# before a server goes into production, or plan the restart.
|
|
# The exporter needs no extra privilege for it, pg_monitor already carries
|
|
# pg_read_all_stats, which is what lets a non superuser see the queries of
|
|
# every user instead of only its own.
|
|
psql_prometheus_exporter_stat_statements: false
|
|
psql_prometheus_exporter_stat_statements_library: pg_stat_statements
|
|
# The database the extension is created in. It must be the one the exporter
|
|
# connects to: the counters are cluster wide, but the view that reads them
|
|
# exists only where the extension was created
|
|
psql_prometheus_exporter_stat_statements_db: '{{ psql_prometheus_exporter_db_name }}'
|
|
# Applied only after the restart, since the parameters do not exist until the
|
|
# library is loaded. Empty means the PostgreSQL defaults (max 5000, track top).
|
|
# Example: [{ name: 'pg_stat_statements.track', value: 'all', set: 'true' }]
|
|
psql_prometheus_exporter_stat_statements_parameters: []
|
|
# Appended verbatim to the command line, one entry per flag
|
|
psql_prometheus_exporter_extra_opts: []
|
|
# Managed only when the exporter connects over TCP: the socket case is covered
|
|
# by the 'local' peer entry, which is always written
|
|
psql_prometheus_exporter_manage_pg_hba: true
|
|
|
|
# Used to configure firewalld
|
|
postgresql_firewalld_zone: '{{ firewalld_default_zone }}'
|
|
psql_prometheus_exporter_firewalld_zone: '{{ postgresql_firewalld_zone }}'
|