From d16f4441301a15e34f238e45335ad5ed98b3de68 Mon Sep 17 00:00:00 2001 From: Jeltz Date: Wed, 10 Mar 2021 15:59:21 +0100 Subject: [PATCH] Use a dict for HBA hosts --- host_vars/bdd-ovh.adm.auro.re.yml | 26 +++++- roles/postgresql_server/defaults/main.yml | 1 + .../templates/postgresql/pg_hba.conf.j2 | 91 +------------------ 3 files changed, 26 insertions(+), 92 deletions(-) diff --git a/host_vars/bdd-ovh.adm.auro.re.yml b/host_vars/bdd-ovh.adm.auro.re.yml index df77200..78aeff4 100644 --- a/host_vars/bdd-ovh.adm.auro.re.yml +++ b/host_vars/bdd-ovh.adm.auro.re.yml @@ -1,6 +1,22 @@ +--- postgresql: - version: 11 - hosts: # dbname, username, CIDR ip addr, auth method - - [ "etherpad", "etherpad", "10.128.0.150", "md5" ] - - [ "codimd", "codimd", "10.128.0.150", "md5" ] - - [ "synapse", "synapse", "10.128.0.56", "md5" ] + version: 13 + +postgresql_hosts: + - database: etherpad + user: etherpad + net: 10.128.0.150/32 + method: md5 + - database: codimd + user: codimd + net: 10.128.0.150/32 + method: md5 + - database: synapse + user: synapse + net: 10.128.0.56/32 + method: md5 + - database: codimd + user: codimd + net: 127.0.0.1/32 + method: md5 +... diff --git a/roles/postgresql_server/defaults/main.yml b/roles/postgresql_server/defaults/main.yml index 89733f0..8eb5639 100644 --- a/roles/postgresql_server/defaults/main.yml +++ b/roles/postgresql_server/defaults/main.yml @@ -1,4 +1,5 @@ --- +postgresql_hosts: [] postgresql_databases: [] postgresql_users: [] ... diff --git a/roles/postgresql_server/templates/postgresql/pg_hba.conf.j2 b/roles/postgresql_server/templates/postgresql/pg_hba.conf.j2 index c9321ec..3a56905 100644 --- a/roles/postgresql_server/templates/postgresql/pg_hba.conf.j2 +++ b/roles/postgresql_server/templates/postgresql/pg_hba.conf.j2 @@ -1,81 +1,6 @@ -# {{ ansible_managed }} - -# PostgreSQL Client Authentication Configuration File -# =================================================== -# -# Refer to the "Client Authentication" section in the PostgreSQL -# documentation for a complete description of this file. A short -# synopsis follows. -# -# This file controls: which hosts are allowed to connect, how clients -# are authenticated, which PostgreSQL user names they can use, which -# databases they can access. Records take one of these forms: -# -# local DATABASE USER METHOD [OPTIONS] -# host DATABASE USER ADDRESS METHOD [OPTIONS] -# hostssl DATABASE USER ADDRESS METHOD [OPTIONS] -# hostnossl DATABASE USER ADDRESS METHOD [OPTIONS] -# -# (The uppercase items must be replaced by actual values.) -# -# The first field is the connection type: "local" is a Unix-domain -# socket, "host" is either a plain or SSL-encrypted TCP/IP socket, -# "hostssl" is an SSL-encrypted TCP/IP socket, and "hostnossl" is a -# plain TCP/IP socket. -# -# DATABASE can be "all", "sameuser", "samerole", "replication", a -# database name, or a comma-separated list thereof. The "all" -# keyword does not match "replication". Access to replication -# must be enabled in a separate record (see example below). -# -# USER can be "all", a user name, a group name prefixed with "+", or a -# comma-separated list thereof. In both the DATABASE and USER fields -# you can also write a file name prefixed with "@" to include names -# from a separate file. -# -# ADDRESS specifies the set of hosts the record matches. It can be a -# host name, or it is made up of an IP address and a CIDR mask that is -# an integer (between 0 and 32 (IPv4) or 128 (IPv6) inclusive) that -# specifies the number of significant bits in the mask. A host name -# that starts with a dot (.) matches a suffix of the actual host name. -# Alternatively, you can write an IP address and netmask in separate -# columns to specify the set of hosts. Instead of a CIDR-address, you -# can write "samehost" to match any of the server's own IP addresses, -# or "samenet" to match any address in any subnet that the server is -# directly connected to. -# -# METHOD can be "trust", "reject", "md5", "password", "scram-sha-256", -# "gss", "sspi", "ident", "peer", "pam", "ldap", "radius" or "cert". -# Note that "password" sends passwords in clear text; "md5" or -# "scram-sha-256" are preferred since they send encrypted passwords. -# -# OPTIONS are a set of options for the authentication in the format -# NAME=VALUE. The available options depend on the different -# authentication methods -- refer to the "Client Authentication" -# section in the documentation for a list of which options are -# available for which authentication methods. -# -# Database and user names containing spaces, commas, quotes and other -# special characters must be quoted. Quoting one of the keywords -# "all", "sameuser", "samerole" or "replication" makes the name lose -# its special character, and just match a database or username with -# that name. -# -# This file is read on server startup and when the server receives a -# SIGHUP signal. If you edit the file on a running system, you have to -# SIGHUP the server for the changes to take effect, run "pg_ctl reload", -# or execute "SELECT pg_reload_conf()". -# -# Put your actual configuration here -# ---------------------------------- -# -# If you want to allow non-local connections, you need to add more -# "host" records. In that case you will also need to make PostgreSQL -# listen on a non-local interface via the listen_addresses -# configuration parameter, or via the -i or -h command line switches. - - +{{ ansible_managed | comment }} +# TYPE DATABASE USER ADDRESS METHOD # DO NOT DISABLE! # If you change this first entry you will need to make sure that the @@ -86,18 +11,10 @@ # Database administrative login by Unix domain socket local all postgres peer -# TYPE DATABASE USER ADDRESS METHOD # "local" is for Unix domain socket connections only local all all peer -{% for host in postgresql.hosts %} -host {{ host[0] }} {{ host[1] }} {{ host[2] }} {{ host[3] }} +{% for host in postgresql_hosts %} +host "{{ host.database }}" "{{ host.user }}" {{ host.net }} {{ host.method }} {% endfor %} - - -# Allow replication connections from localhost, by a user with the -# replication privilege. -local replication all peer -host replication all 127.0.0.1/32 md5 -host replication all ::1/128 md5