postgres.yml (2103B)
1 --- 2 # regional-currency assumes package postgres under systemd. 3 4 - name: Fix SSL key access for postgres in containers 5 ansible.builtin.shell: | 6 set -e 7 if [ -d /etc/ssl/private ]; then 8 chown root:ssl-cert /etc/ssl/private 9 chmod 710 /etc/ssl/private 10 fi 11 if [ -f /etc/ssl/private/ssl-cert-snakeoil.key ]; then 12 chown root:ssl-cert /etc/ssl/private/ssl-cert-snakeoil.key 13 chmod 640 /etc/ssl/private/ssl-cert-snakeoil.key 14 fi 15 usermod -aG ssl-cert postgres 2>/dev/null || true 16 args: 17 executable: /bin/bash 18 changed_when: true 19 20 - name: Make postgresql cluster conf readable for peer-auth taler users 21 ansible.builtin.shell: | 22 set -e 23 for d in /etc/postgresql/*/*/ ; do 24 [ -d "$d" ] || continue 25 chmod 755 /etc/postgresql "$(dirname "$d")" "$d" 2>/dev/null || true 26 chmod 644 "$d"/*.conf 2>/dev/null || true 27 done 28 for u in taler-exchange-httpd taler-exchange-wire taler-exchange-aggregator \ 29 taler-exchange-closer taler-exchange-expire taler-exchange-offline \ 30 taler-exchange-secmod-rsa; do 31 id "$u" >/dev/null 2>&1 && usermod -aG postgres "$u" || true 32 done 33 args: 34 executable: /bin/bash 35 changed_when: true 36 37 # Meta unit postgresql.service is oneshot; real work is postgresql@VER-main 38 - name: Ensure PostgreSQL meta unit enabled 39 ansible.builtin.systemd: 40 name: postgresql 41 enabled: true 42 daemon_reload: true 43 44 - name: Discover postgres cluster unit 45 ansible.builtin.shell: | 46 set -e 47 if command -v pg_lsclusters >/dev/null; then 48 pg_lsclusters --no-header | awk '{print "postgresql@" $1 "-" $2 ".service"; exit}' 49 else 50 echo "postgresql@17-main.service" 51 fi 52 args: 53 executable: /bin/bash 54 register: pg_unit 55 changed_when: false 56 57 - name: Start postgres cluster unit 58 ansible.builtin.systemd: 59 name: "{{ pg_unit.stdout | trim }}" 60 state: started 61 enabled: true 62 63 - name: Wait until postgres accepts connections 64 ansible.builtin.command: pg_isready 65 register: pg_ready 66 retries: 15 67 delay: 1 68 until: pg_ready.rc == 0 69 changed_when: false