218 lines
9.0 KiB
YAML
218 lines
9.0 KiB
YAML
---
|
|
- name: postgresql-prometheus-exporter | Database role used by the exporter
|
|
tags: ['postgresql', 'postgres', 'prometheus', 'postgres_exporter']
|
|
when: psql_prometheus_exporter_install
|
|
block:
|
|
- name: postgresql-prometheus-exporter | Create the database role {{ psql_prometheus_exporter_db_user }}
|
|
become: true
|
|
become_user: postgres
|
|
community.postgresql.postgresql_user:
|
|
name: '{{ psql_prometheus_exporter_db_user }}'
|
|
password: "{{ omit if psql_prometheus_exporter_use_socket else psql_prometheus_exporter_db_pwd }}"
|
|
role_attr_flags: 'LOGIN,NOSUPERUSER,NOCREATEDB,NOCREATEROLE'
|
|
state: present
|
|
no_log: "{{ not psql_prometheus_exporter_use_socket }}"
|
|
|
|
# pg_monitor carries pg_read_all_settings, pg_read_all_stats and
|
|
# pg_stat_scan_tables: everything the exporter reads, and nothing else.
|
|
- name: postgresql-prometheus-exporter | Grant pg_monitor to {{ psql_prometheus_exporter_db_user }}
|
|
become: true
|
|
become_user: postgres
|
|
community.postgresql.postgresql_membership:
|
|
group: pg_monitor
|
|
target_role: '{{ psql_prometheus_exporter_db_user }}'
|
|
state: present
|
|
|
|
# Peer authentication: the system user and the database role have the same
|
|
# name, so no map is needed. Always written, the socket is also the way to
|
|
# reach the cluster by hand.
|
|
- name: postgresql-prometheus-exporter | Local peer access for {{ psql_prometheus_exporter_db_user }}
|
|
community.postgresql.postgresql_pg_hba:
|
|
dest: '{{ psql_conf_dir }}/pg_hba.conf'
|
|
contype: local
|
|
users: '{{ psql_prometheus_exporter_db_user }}'
|
|
databases: all
|
|
method: peer
|
|
state: present
|
|
owner: root
|
|
group: postgres
|
|
mode: "0640"
|
|
when: psql_prometheus_exporter_use_socket
|
|
notify: Reload postgresql
|
|
|
|
- name: postgresql-prometheus-exporter | TCP access for {{ psql_prometheus_exporter_db_user }}
|
|
community.postgresql.postgresql_pg_hba:
|
|
dest: '{{ psql_conf_dir }}/pg_hba.conf'
|
|
contype: '{% if psql_force_ssl_client_connection or psql_enable_ssl %}hostssl{% else %}host{% endif %}'
|
|
users: '{{ psql_prometheus_exporter_db_user }}'
|
|
address: '{{ psql_prometheus_exporter_db_host }}/32'
|
|
databases: all
|
|
method: scram-sha-256
|
|
state: present
|
|
owner: root
|
|
group: postgres
|
|
mode: "0640"
|
|
when:
|
|
- not psql_prometheus_exporter_use_socket
|
|
- psql_prometheus_exporter_manage_pg_hba
|
|
notify: Reload postgresql
|
|
|
|
- name: postgresql-prometheus-exporter | Flush handlers
|
|
ansible.builtin.meta: flush_handlers
|
|
|
|
- name: postgresql-prometheus-exporter | Manage pg_stat_statements
|
|
tags: ['postgresql', 'postgres', 'prometheus', 'postgres_exporter', 'pg_stat_statements']
|
|
when:
|
|
- psql_prometheus_exporter_install
|
|
- psql_prometheus_exporter_stat_statements
|
|
become: true
|
|
become_user: postgres
|
|
block:
|
|
# Read it instead of writing a fixed value: another extension may already be
|
|
# preloaded (auto_explain, pg_cron, ...) and overwriting the list would
|
|
# silently unload it.
|
|
- name: postgresql-prometheus-exporter | Read the current shared_preload_libraries
|
|
community.postgresql.postgresql_query:
|
|
db: postgres
|
|
query: 'SHOW shared_preload_libraries'
|
|
register: psql_current_preload_libraries
|
|
changed_when: false
|
|
|
|
- name: postgresql-prometheus-exporter | Preload the library {{ psql_prometheus_exporter_stat_statements_library }}
|
|
vars:
|
|
psql_preload_libraries: "{{ psql_current_preload_libraries.query_result[0]['shared_preload_libraries']
|
|
| split(',') | map('trim') | reject('equalto', '') | list }}"
|
|
community.postgresql.postgresql_set:
|
|
name: shared_preload_libraries
|
|
value: "{{ (psql_preload_libraries + [psql_prometheus_exporter_stat_statements_library]) | unique | join(',') }}"
|
|
when: psql_prometheus_exporter_stat_statements_library not in psql_preload_libraries
|
|
notify: Restart postgresql
|
|
|
|
# The library is only loaded at startup, and the parameters below do not
|
|
# exist until it is.
|
|
- name: postgresql-prometheus-exporter | Restart PostgreSQL so that the library is loaded
|
|
ansible.builtin.meta: flush_handlers
|
|
|
|
- name: postgresql-prometheus-exporter | Create the extension in {{ psql_prometheus_exporter_stat_statements_db }}
|
|
community.postgresql.postgresql_ext:
|
|
name: '{{ psql_prometheus_exporter_stat_statements_library }}'
|
|
db: '{{ psql_prometheus_exporter_stat_statements_db }}'
|
|
state: present
|
|
|
|
- name: postgresql-prometheus-exporter | Set the pg_stat_statements parameters
|
|
community.postgresql.postgresql_set:
|
|
name: '{{ item.name }}'
|
|
value: "{% if item.set | bool %}{{ item.value }}{% else %}default{% endif %}"
|
|
loop: '{{ psql_prometheus_exporter_stat_statements_parameters }}'
|
|
loop_control:
|
|
label: '{{ item.name }}'
|
|
notify: Restart postgresql
|
|
|
|
- name: postgresql-prometheus-exporter | Flush handlers
|
|
ansible.builtin.meta: flush_handlers
|
|
|
|
- name: postgresql-prometheus-exporter | Install the exporter
|
|
tags: ['postgresql', 'postgres', 'prometheus', 'postgres_exporter']
|
|
when: psql_prometheus_exporter_install
|
|
block:
|
|
- name: postgresql-prometheus-exporter | Create the system user {{ psql_prometheus_exporter_user }}
|
|
ansible.builtin.user:
|
|
name: '{{ psql_prometheus_exporter_user }}'
|
|
home: '{{ psql_prometheus_exporter_home }}'
|
|
createhome: false
|
|
shell: /usr/sbin/nologin
|
|
system: true
|
|
|
|
- name: postgresql-prometheus-exporter | Create the exporter directories
|
|
ansible.builtin.file:
|
|
dest: '{{ item }}'
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
loop:
|
|
- '{{ psql_prometheus_exporter_home }}'
|
|
- '{{ psql_prometheus_exporter_dist_dir }}'
|
|
|
|
- name: postgresql-prometheus-exporter | Download postgres_exporter {{ psql_prometheus_exporter_version }}
|
|
ansible.builtin.get_url:
|
|
url: '{{ psql_prometheus_exporter_download_url }}'
|
|
dest: '/srv/{{ psql_prometheus_exporter_file }}'
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
|
|
- name: postgresql-prometheus-exporter | Unarchive the postgres_exporter distribution
|
|
ansible.builtin.unarchive:
|
|
src: '/srv/{{ psql_prometheus_exporter_file }}'
|
|
dest: '{{ psql_prometheus_exporter_dist_dir }}'
|
|
remote_src: true
|
|
owner: root
|
|
group: root
|
|
creates: '{{ psql_prometheus_exporter_cmd }}'
|
|
notify: Restart postgres exporter
|
|
|
|
- name: postgresql-prometheus-exporter | Install the exporter environment file
|
|
ansible.builtin.template:
|
|
src: postgres_exporter-environment.j2
|
|
dest: '{{ psql_prometheus_exporter_env_file }}'
|
|
owner: root
|
|
group: '{{ psql_prometheus_exporter_user }}'
|
|
mode: "0640"
|
|
# The rendered file contains the database password when the exporter
|
|
# connects over TCP
|
|
diff: '{{ psql_prometheus_exporter_use_socket }}'
|
|
notify: Restart postgres exporter
|
|
|
|
- name: postgresql-prometheus-exporter | Install the exporter systemd unit
|
|
ansible.builtin.template:
|
|
src: postgres_exporter.service.j2
|
|
dest: /etc/systemd/system/postgres_exporter.service
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify:
|
|
- Reload systemd
|
|
- Restart postgres exporter
|
|
|
|
- name: postgresql-prometheus-exporter | Flush handlers
|
|
ansible.builtin.meta: flush_handlers
|
|
|
|
- name: postgresql-prometheus-exporter | Ensure that postgres_exporter is started and enabled
|
|
ansible.builtin.service:
|
|
name: postgres_exporter
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: postgresql-prometheus-exporter | Remove the exporter
|
|
tags: ['postgresql', 'postgres', 'prometheus', 'postgres_exporter']
|
|
when: not psql_prometheus_exporter_install
|
|
block:
|
|
- name: postgresql-prometheus-exporter | Ensure that postgres_exporter is stopped and disabled
|
|
ansible.builtin.service:
|
|
name: postgres_exporter
|
|
state: stopped
|
|
enabled: false
|
|
failed_when: false
|
|
|
|
- name: postgresql-prometheus-exporter | Remove the exporter systemd unit
|
|
ansible.builtin.file:
|
|
dest: /etc/systemd/system/postgres_exporter.service
|
|
state: absent
|
|
notify: Reload systemd
|
|
|
|
- name: postgresql-prometheus-exporter | Manage the exporter firewalld rules
|
|
when:
|
|
- psql_prometheus_exporter_install
|
|
- ansible_distribution_file_variety == "RedHat"
|
|
- firewalld_enabled is defined and firewalld_enabled | bool
|
|
tags: ['postgresql', 'postgres', 'prometheus', 'postgres_exporter', 'firewall', 'firewalld']
|
|
block:
|
|
- name: postgresql-prometheus-exporter | Open the exporter port {{ psql_prometheus_exporter_port }}
|
|
ansible.posix.firewalld:
|
|
port: '{{ psql_prometheus_exporter_port }}/tcp'
|
|
zone: '{{ psql_prometheus_exporter_firewalld_zone }}'
|
|
permanent: true
|
|
state: enabled
|
|
immediate: true
|