feat: initial commit — Ansible roles storage-01/gpu-01 opérationnels

ansible/roles/postgresql/defaults/main.yml

@@ -0,0 +1,24 @@
+---
+postgresql_version: 16
+postgresql_port: 5432
+postgresql_data_dir: /srv/data/postgres
+
+# Écoute sur localhost + LAN cluster (pour les services k8s futurs)
+postgresql_listen_addresses: "localhost, 192.168.10.1"
+
+postgresql_max_connections: 100
+postgresql_shared_buffers: "256MB"
+
+# Bases et utilisateurs à créer
+# Mots de passe dans le vault : vault_pg_hermes_password, vault_pg_litellm_password
+postgresql_databases:
+  - name: hermes
+  - name: litellm
+
+postgresql_users:
+  - name: hermes
+    password: "{{ vault_pg_hermes_password }}"
+    db: hermes
+  - name: litellm
+    password: "{{ vault_pg_litellm_password }}"
+    db: litellm

ansible/roles/postgresql/handlers/main.yml

@@ -0,0 +1,10 @@
+---
+- name: Restart postgresql
+  ansible.builtin.systemd:
+    name: "postgresql-{{ postgresql_version }}"
+    state: restarted
+
+- name: Reload postgresql
+  ansible.builtin.systemd:
+    name: "postgresql-{{ postgresql_version }}"
+    state: reloaded

ansible/roles/postgresql/tasks/main.yml

@@ -0,0 +1,142 @@
+---
+# --- Dépôt officiel PostgreSQL ---
+
+- name: Install PostgreSQL repo
+  ansible.builtin.dnf:
+    name: "https://download.postgresql.org/pub/repos/yum/reporpms/EL-9-x86_64/pgdg-redhat-repo-latest.noarch.rpm"
+    state: present
+    disable_gpg_check: true
+
+- name: Disable built-in postgresql module
+  ansible.builtin.command:
+    cmd: dnf -qy module disable postgresql
+  changed_when: false
+
+# --- Installation ---
+
+- name: Install PostgreSQL {{ postgresql_version }}
+  ansible.builtin.dnf:
+    name:
+      - "postgresql{{ postgresql_version }}-server"
+      - "postgresql{{ postgresql_version }}"
+      - python3-psycopg2
+    state: present
+
+# --- Répertoire données sur RAID5 ---
+
+- name: Create PostgreSQL data directory on RAID5
+  ansible.builtin.file:
+    path: "{{ postgresql_data_dir }}"
+    state: directory
+    owner: postgres
+    group: postgres
+    mode: '0700'
+
+# --- Service override pour PGDATA custom ---
+
+- name: Create systemd override directory
+  ansible.builtin.file:
+    path: "/etc/systemd/system/postgresql-{{ postgresql_version }}.service.d"
+    state: directory
+    mode: '0755'
+
+- name: Deploy PGDATA override
+  ansible.builtin.copy:
+    dest: "/etc/systemd/system/postgresql-{{ postgresql_version }}.service.d/pgdata.conf"
+    content: |
+      [Service]
+      Environment=PGDATA={{ postgresql_data_dir }}
+    mode: '0644'
+  notify: Restart postgresql
+
+# --- Initialisation (une seule fois) ---
+
+- name: Check if database cluster is initialized
+  ansible.builtin.stat:
+    path: "{{ postgresql_data_dir }}/PG_VERSION"
+  register: pg_initialized
+
+- name: Initialize database cluster
+  ansible.builtin.command:
+    cmd: "/usr/pgsql-{{ postgresql_version }}/bin/initdb -D {{ postgresql_data_dir }} --auth-local=peer --auth-host=scram-sha-256"
+  become: true
+  become_user: postgres
+  environment:
+    PGDATA: "{{ postgresql_data_dir }}"
+  when: not pg_initialized.stat.exists
+
+# --- Configuration ---
+
+- name: Deploy pg_hba.conf
+  ansible.builtin.template:
+    src: pg_hba.conf.j2
+    dest: "{{ postgresql_data_dir }}/pg_hba.conf"
+    owner: postgres
+    group: postgres
+    mode: '0600'
+  notify: Reload postgresql
+
+- name: Configure listen_addresses
+  ansible.builtin.lineinfile:
+    path: "{{ postgresql_data_dir }}/postgresql.conf"
+    regexp: "^#?listen_addresses"
+    line: "listen_addresses = '{{ postgresql_listen_addresses }}'"
+  notify: Reload postgresql
+
+- name: Configure port
+  ansible.builtin.lineinfile:
+    path: "{{ postgresql_data_dir }}/postgresql.conf"
+    regexp: "^#?port"
+    line: "port = {{ postgresql_port }}"
+  notify: Reload postgresql
+
+- name: Configure shared_buffers
+  ansible.builtin.lineinfile:
+    path: "{{ postgresql_data_dir }}/postgresql.conf"
+    regexp: "^#?shared_buffers"
+    line: "shared_buffers = {{ postgresql_shared_buffers }}"
+  notify: Reload postgresql
+
+# --- Démarrage ---
+
+- name: Enable and start PostgreSQL
+  ansible.builtin.systemd:
+    name: "postgresql-{{ postgresql_version }}"
+    enabled: true
+    daemon_reload: true
+    state: started
+
+# --- Bases de données et utilisateurs ---
+
+- name: Create databases
+  community.postgresql.postgresql_db:
+    name: "{{ item.name }}"
+    encoding: UTF8
+    state: present
+  become: true
+  become_user: postgres
+  loop: "{{ postgresql_databases }}"
+
+- name: Create users
+  community.postgresql.postgresql_user:
+    name: "{{ item.name }}"
+    password: "{{ item.password }}"
+    state: present
+  become: true
+  become_user: postgres
+  loop: "{{ postgresql_users }}"
+  no_log: true
+
+- name: Grant user privileges on their database
+  community.postgresql.postgresql_privs:
+    db: "{{ item.db }}"
+    privs: ALL
+    type: database
+    role: "{{ item.name }}"
+    state: present
+  become: true
+  become_user: postgres
+  loop: "{{ postgresql_users }}"
+
+# Firewall géré centralement par le rôle gateway (nftables)
+# Port 5432 ouvert pour cluster_network dans nftables.conf.j2

ansible/roles/postgresql/templates/pg_hba.conf.j2

@@ -0,0 +1,9 @@
+# TYPE  DATABASE        USER            ADDRESS                 METHOD
+# Accès local superuser
+local   all             postgres                                peer
+# Accès local apps — scram-sha-256
+local   all             all                                     scram-sha-256
+host    all             all             127.0.0.1/32            scram-sha-256
+host    all             all             ::1/128                 scram-sha-256
+# Accès depuis le LAN cluster (services k8s futurs)
+host    all             all             {{ cluster_network }}   scram-sha-256