ansible/playbooks/prod_db.yml

#!/usr/bin/env ansible-playbook
# vim:ft=ansible:
# Database servers
---
- hosts: vm-general-1.ashburn.mgmt.desu.ltd
  tasks:
    - name: assure prometheus psql exporter
      ansible.builtin.docker_container:
        name: prometheus-psql-exporter
        image: quay.io/prometheuscommunity/postgres-exporter
        env:
          DATA_SOURCE_URI: "10.0.0.2:5432/postgres"
          DATA_SOURCE_USER: "nagios"
          DATA_SOURCE_PASS: "{{ secret_postgresql_monitoring_password }}"
        ports:
          - 9102:9187/tcp
      tags: [ db, psql, prometheus, monitoring, docker ]
  roles:
    - role: geerlingguy.postgresql
      vars:
        postgresql_global_config_options:
          - option: listen_addresses
            value: 10.0.0.2,127.0.0.1
          - option: max_connections
            value: 240
          - option: shared_buffers
            value: 128MB
          - option: log_directory
            value: 'log'
        postgresql_hba_entries:
          - { type: local, database: all, user: postgres, auth_method: trust }
          - { type: local, database: all, user: all, auth_method: md5 }
          - { type: host, database: all, user: all, address: '127.0.0.1/32', auth_method: md5 }
          - { type: host, database: all, user: all, address: '::1/128', auth_method: md5 }
            # Used for internal access from other nodes
          - { type: host, database: all, user: all, address: '10.0.0.0/8', auth_method: md5 }
            # Used for internal access from Docker
          - { type: host, database: all, user: all, address: '172.16.0.0/12', auth_method: md5 }
        postgresql_users:
          - name: gitea-desultd
            password: "{{ secret_gitea_db_pass }}"
          - name: nagios
            password: "{{ secret_postgresql_monitoring_password }}"
          - name: netbox-desultd
            password: "{{ secret_netbox_db_pass }}"
          - name: nextcloud-desultd
            password: "{{ secret_nextcloud_db_pass }}"
          - name: synapse-desultd
            password: "{{ secret_synapse_db_pass }}"
        postgresql_databases:
          - name: gitea-desultd
            owner: gitea-desultd
          - name: netbox-desultd
            owner: netbox-desultd
          - name: nextcloud-desultd
            owner: nextcloud-desultd
          - name: synapse-desultd
            lc_collate: C
            lc_ctype: C
            owner: synapse-desultd
      tags: [ db, psql ]