Funk-lab/ansible/roles/postgresql/tasks/main.yml

---
# --- Dépôt officiel PostgreSQL ---

- name: Install PostgreSQL repo
  ansible.builtin.dnf:
    name: "https://download.postgresql.org/pub/repos/yum/reporpms/EL-9-x86_64/pgdg-redhat-repo-latest.noarch.rpm"
    state: present
    disable_gpg_check: true

- name: Disable built-in postgresql module
  ansible.builtin.command:
    cmd: dnf -qy module disable postgresql
  changed_when: false

# --- Installation ---

- name: Install PostgreSQL {{ postgresql_version }}
  ansible.builtin.dnf:
    name:
      - "postgresql{{ postgresql_version }}-server"
      - "postgresql{{ postgresql_version }}"
      - python3-psycopg2
    state: present

# --- Répertoire données sur RAID5 ---

- name: Create PostgreSQL data directory on RAID5
  ansible.builtin.file:
    path: "{{ postgresql_data_dir }}"
    state: directory
    owner: postgres
    group: postgres
    mode: '0700'

# --- Service override pour PGDATA custom ---

- name: Create systemd override directory
  ansible.builtin.file:
    path: "/etc/systemd/system/postgresql-{{ postgresql_version }}.service.d"
    state: directory
    mode: '0755'

- name: Deploy PGDATA override
  ansible.builtin.copy:
    dest: "/etc/systemd/system/postgresql-{{ postgresql_version }}.service.d/pgdata.conf"
    content: |
      [Service]
      Environment=PGDATA={{ postgresql_data_dir }}
    mode: '0644'
  notify: Restart postgresql

# --- Initialisation (une seule fois) ---

- name: Check if database cluster is initialized
  ansible.builtin.stat:
    path: "{{ postgresql_data_dir }}/PG_VERSION"
  register: pg_initialized

- name: Initialize database cluster
  ansible.builtin.command:
    cmd: "/usr/pgsql-{{ postgresql_version }}/bin/initdb -D {{ postgresql_data_dir }} --auth-local=peer --auth-host=scram-sha-256"
  become: true
  become_user: postgres
  environment:
    PGDATA: "{{ postgresql_data_dir }}"
  when: not pg_initialized.stat.exists

# --- Configuration ---

- name: Deploy pg_hba.conf
  ansible.builtin.template:
    src: pg_hba.conf.j2
    dest: "{{ postgresql_data_dir }}/pg_hba.conf"
    owner: postgres
    group: postgres
    mode: '0600'
  notify: Reload postgresql

- name: Configure listen_addresses
  ansible.builtin.lineinfile:
    path: "{{ postgresql_data_dir }}/postgresql.conf"
    regexp: "^#?listen_addresses"
    line: "listen_addresses = '{{ postgresql_listen_addresses }}'"
  notify: Reload postgresql

- name: Configure port
  ansible.builtin.lineinfile:
    path: "{{ postgresql_data_dir }}/postgresql.conf"
    regexp: "^#?port"
    line: "port = {{ postgresql_port }}"
  notify: Reload postgresql

- name: Configure shared_buffers
  ansible.builtin.lineinfile:
    path: "{{ postgresql_data_dir }}/postgresql.conf"
    regexp: "^#?shared_buffers"
    line: "shared_buffers = {{ postgresql_shared_buffers }}"
  notify: Reload postgresql

# --- Démarrage ---

- name: Enable and start PostgreSQL
  ansible.builtin.systemd:
    name: "postgresql-{{ postgresql_version }}"
    enabled: true
    daemon_reload: true
    state: started

# --- Bases de données et utilisateurs ---

- name: Create databases
  community.postgresql.postgresql_db:
    name: "{{ item.name }}"
    encoding: UTF8
    state: present
  become: true
  become_user: postgres
  loop: "{{ postgresql_databases }}"

- name: Create users
  community.postgresql.postgresql_user:
    name: "{{ item.name }}"
    password: "{{ item.password }}"
    state: present
  become: true
  become_user: postgres
  loop: "{{ postgresql_users }}"
  no_log: true

- name: Grant user privileges on their database
  community.postgresql.postgresql_privs:
    database: "{{ item.db }}"
    privs: ALL
    type: database
    role: "{{ item.name }}"
    state: present
  become: true
  become_user: postgres
  loop: "{{ postgresql_users }}"
  no_log: true

# PostgreSQL 15+ révoque CREATE ON SCHEMA public par défaut
- name: Grant schema public to users (PostgreSQL 15+)
  community.postgresql.postgresql_privs:
    database: "{{ item.db }}"
    privs: ALL
    type: schema
    objs: public
    role: "{{ item.name }}"
    state: present
  become: true
  become_user: postgres
  loop: "{{ postgresql_users }}"
  no_log: true

# Firewall géré centralement par le rôle gateway (nftables)
# Port 5432 ouvert pour cluster_network dans nftables.conf.j2