83 lines
3.4 KiB
YAML
83 lines
3.4 KiB
YAML
---
|
|
#--------------------------------------------------------------#
|
|
# check pg private key existence [pg_cert_private]
|
|
#--------------------------------------------------------------#
|
|
- name: create pg private key
|
|
tags: pg_cert_private
|
|
become: false
|
|
connection: local
|
|
vars:
|
|
ansible_python_interpreter: "{{ ansible_playbook_python }}"
|
|
block:
|
|
|
|
# check pg sever private key on primary instance
|
|
#- name: check if pg private key exists
|
|
# stat: path=files/pki/pgsql/{{ pg_cluster }}.key
|
|
# register: pg_key_exists
|
|
# try to fetch private key from primary instance
|
|
#- name: check if pg private key exists on primary
|
|
# when: not pg_key_exists.stat.exists|bool
|
|
# stat: path="/pg/cert/server.key"
|
|
# register: pg_key_primary_exists
|
|
#- name: fetch pg private key from primary
|
|
# when: not pg_key_exists.stat.exists|bool and pg_key_primary_exists.stat.exists|bool
|
|
# fetch: src=/pg/cert/server.key dest=files/pki/pgsql/{{ pg_cluster }}.key flat=yes
|
|
|
|
# generate pg private key if not exists on local instance
|
|
- name: generate pg private key
|
|
connection: local
|
|
openssl_privatekey: path=files/pki/pgsql/{{ pg_cluster }}.key mode=0600
|
|
|
|
|
|
#--------------------------------------------------------------#
|
|
# Signing server certs [pg_cert_issue]
|
|
#--------------------------------------------------------------#
|
|
- name: signing cert for postgres
|
|
tags: pg_cert_issue
|
|
become: false
|
|
connection: local
|
|
vars:
|
|
ansible_python_interpreter: "{{ ansible_playbook_python }}"
|
|
block:
|
|
|
|
# generate csr for each member
|
|
- name: generate pg server signing request
|
|
connection: local
|
|
openssl_csr:
|
|
path: "files/pki/csr/{{ pg_cluster }}-{{ pg_seq }}.csr"
|
|
privatekey_path: "files/pki/pgsql/{{ pg_cluster }}.key"
|
|
common_name: "{{ pg_cluster }}-{{ pg_seq }}"
|
|
organization_name: pigsty
|
|
organizational_unit_name: postgres
|
|
subject_alt_name:
|
|
- "DNS:localhost"
|
|
- "DNS:{{ pg_cluster }}"
|
|
- "DNS:{{ pg_cluster }}-{{ pg_seq }}"
|
|
- "IP:127.0.0.1"
|
|
- "IP:{{ inventory_hostname }}"
|
|
|
|
- name: issue pg server certificate
|
|
connection: local
|
|
openssl_certificate:
|
|
path: "files/pki/pgsql/{{ pg_cluster }}-{{ pg_seq }}.crt"
|
|
csr_path: "files/pki/csr/{{ pg_cluster }}-{{ pg_seq }}.csr"
|
|
provider: ownca
|
|
ownca_path: files/pki/ca/ca.crt
|
|
ownca_privatekey_path: files/pki/ca/ca.key
|
|
ownca_not_after: "+{{ cert_validity }}"
|
|
mode: 0644
|
|
|
|
|
|
#--------------------------------------------------------------#
|
|
# copy postgres key & certs [pg_cert_copy]
|
|
#--------------------------------------------------------------#
|
|
- name: copy pg server certificates
|
|
tags: pg_cert_copy
|
|
any_errors_fatal: true
|
|
copy: src={{ item.src }} dest={{ item.dest }} owner={{ item.owner }} group={{ item.group|default(item.owner) }} mode={{ item.mode }}
|
|
with_items:
|
|
- { src: "files/pki/ca/ca.crt" ,dest: "/pg/cert/ca.crt" ,owner: "{{ pg_dbsu }}" ,mode: "0644" }
|
|
- { src: "files/pki/pgsql/{{ pg_cluster }}-{{ pg_seq }}.crt" ,dest: "/pg/cert/server.crt" ,owner: "{{ pg_dbsu }}", group: "postgres" ,mode: "0644" }
|
|
- { src: "files/pki/pgsql/{{ pg_cluster }}.key" ,dest: "/pg/cert/server.key" ,owner: "{{ pg_dbsu }}", group: "postgres" ,mode: "0600" }
|
|
...
|