From ecc56cf778d9c9f007c5f1b4334f7587c675fe33 Mon Sep 17 00:00:00 2001 From: Sam Al-Sapti Date: Sun, 26 Nov 2023 17:37:17 +0100 Subject: [PATCH] Add database creation steps --- group_vars/production/vars.yml | 7 ++-- group_vars/shared/vars.yml | 1 + group_vars/staging/vars.yml | 7 ++-- roles/apps/tasks/main.yml | 3 +- .../templates/compose-files/nextcloud.yml.j2 | 4 +-- roles/postgresql/tasks/database.yml | 35 +++++++++++++++++++ roles/postgresql/tasks/main.yml | 8 +++++ roles/virt-common/tasks/firewall.yml | 20 +++-------- 8 files changed, 61 insertions(+), 24 deletions(-) create mode 100644 roles/postgresql/tasks/database.yml diff --git a/group_vars/production/vars.yml b/group_vars/production/vars.yml index d5bdd5b..52c0c16 100644 --- a/group_vars/production/vars.yml +++ b/group_vars/production/vars.yml @@ -1,7 +1,10 @@ # vim: ft=yaml.ansible # code: language=ansible --- +internal_subnet: 10.2.16.0/24 postgresql_version: 14 -db_passwords: - nextcloud: "{{ vault_db_passwords.nextcloud }}" +databases: + nextcloud: + username: nextcloud + password: "{{ vault_db_passwords.nextcloud }}" diff --git a/group_vars/shared/vars.yml b/group_vars/shared/vars.yml index 492a298..25ac29e 100644 --- a/group_vars/shared/vars.yml +++ b/group_vars/shared/vars.yml @@ -1,5 +1,6 @@ # vim: ft=yaml.ansible # code: language=ansible --- +internal_subnet: 10.2.18.0/24 tls_email: "{{ vault_tls_email }}" njalla_api_token: "{{ vault_njalla_api_token }}" diff --git a/group_vars/staging/vars.yml b/group_vars/staging/vars.yml index d5bdd5b..dcb97a4 100644 --- a/group_vars/staging/vars.yml +++ b/group_vars/staging/vars.yml @@ -1,7 +1,10 @@ # vim: ft=yaml.ansible # code: language=ansible --- +internal_subnet: 10.2.19.0/24 postgresql_version: 14 -db_passwords: - nextcloud: "{{ vault_db_passwords.nextcloud }}" +databases: + nextcloud: + username: nextcloud + password: "{{ vault_db_passwords.nextcloud }}" diff --git a/roles/apps/tasks/main.yml b/roles/apps/tasks/main.yml index 80b7c52..3fb7c1a 100644 --- a/roles/apps/tasks/main.yml +++ b/roles/apps/tasks/main.yml @@ -24,8 +24,7 @@ state: directory - name: Configure apps - ansible.builtin.include_tasks: - file: configure_app.yml + ansible.builtin.include_tasks: configure_app.yml vars: app_name: "{{ item }}" app_vars: "{{ apps_vars[item] }}" diff --git a/roles/apps/templates/compose-files/nextcloud.yml.j2 b/roles/apps/templates/compose-files/nextcloud.yml.j2 index 2397c51..78a7bfd 100644 --- a/roles/apps/templates/compose-files/nextcloud.yml.j2 +++ b/roles/apps/templates/compose-files/nextcloud.yml.j2 @@ -15,8 +15,8 @@ services: environment: POSTGRES_HOST: "{{ db_host }}" POSTGRES_DB: nextcloud - POSTGRES_USER: nextcloud - POSTGRES_PASSWORD: {{ db_passwords.nextcloud }} + POSTGRES_USER: "{{ databases.nextcloud.username }}" + POSTGRES_PASSWORD: {{ databases.nextcloud.password }} REDIS_HOST: redis REDIS_HOST_PASSWORD: {{ redis_passwords.nextcloud }} MAIL_FROM_ADDRESS: noreply diff --git a/roles/postgresql/tasks/database.yml b/roles/postgresql/tasks/database.yml new file mode 100644 index 0000000..28bdb8b --- /dev/null +++ b/roles/postgresql/tasks/database.yml @@ -0,0 +1,35 @@ +# vim: ft=yaml.ansible +# code: language=ansible +--- +- name: Create database user '{{ db_vars.username }}' + community.postgresql.postgresql_user: + name: "{{ db_vars.username }}" + password: "{{ db_vars.password }}" + state: present + environment: + PGOPTIONS: '-c password_encryption=scram-sha-256' + +- name: Create database '{{ db_name }}' + community.postgresql.postgresql_db: + name: "{{ db_name }}" + owner: "{{ db_vars.username }}" + template: template0 + encoding: UTF-8 + state: present + +- name: Grant all priviliges to owner on database '{{ db_name }}' + community.postgresql.postgresql_privs: + database: "{{ db_name }}" + roles: "{{ db_vars.username }}" + privs: ALL + state: present + +- name: Allow connections to database '{{ db_name }}' + community.postgresql.postgresql_pg_hba: + dest: "{{ postgresql_pgdata }}/pg_hba.conf" + contype: host + users: "{{ db_vars.username }}" + databases: "{{ db_name }}" + source: "{{ internal_subnet }}" + method: scram-sha-256 + state: present diff --git a/roles/postgresql/tasks/main.yml b/roles/postgresql/tasks/main.yml index 2a9e4f8..43ded3d 100644 --- a/roles/postgresql/tasks/main.yml +++ b/roles/postgresql/tasks/main.yml @@ -21,6 +21,7 @@ name: - postgresql{{ postgresql_version }}-server - python{{ ansible_python.version.major }}-psycopg2 + - python{{ ansible_python.version.major }}-ipaddress state: present - name: Create PostgreSQL service override folder @@ -58,3 +59,10 @@ name: "{{ postgresql_service }}" enabled: true state: started + +- name: Set up databases + ansible.builtin.include_tasks: database.yml + vars: + db_name: "{{ item.key }}" + db_vars: "{{ item.value }}" + loop: "{{ databases | dict2items }}" diff --git a/roles/virt-common/tasks/firewall.yml b/roles/virt-common/tasks/firewall.yml index d0f791b..722b814 100644 --- a/roles/virt-common/tasks/firewall.yml +++ b/roles/virt-common/tasks/firewall.yml @@ -68,29 +68,17 @@ # state: enabled # loop: "{{ groups['control_infra'] }}" -- name: Firewall rules for DB servers - when: hostname in groups['production'] or hostname in groups['staging'] +- name: Firewall rules for database servers + when: hostname in groups['dbservers'] notify: Reload firewalld block: - - name: Production | Allow incoming connections from app servers to PostgreSQL port in zone 'internal' + - name: Allow incoming connections from internal subnet to PostgreSQL port in zone 'internal' ansible.posix.firewalld: zone: internal - source: "{{ hostvars[item].internal_ipv4 }}" + source: "{{ internal_subnet }}" service: postgresql permanent: true state: enabled - loop: "{{ groups['app_prod'] }}" - when: hostname in groups['db_prod'] - - - name: Staging | Allow incoming connections from app servers to PostgreSQL port in zone 'internal' - ansible.posix.firewalld: - zone: internal - source: "{{ hostvars[item].internal_ipv4 }}" - service: postgresql - permanent: true - state: enabled - loop: "{{ groups['app_stage'] }}" - when: hostname in groups['db_stage'] - name: Firewall rules for proxy servers when: hostname in group['proxyservers']