--- # ============================================ # PostgreSQL Installation (vm-postgres uniquement) # ============================================ - name: Installation et configuration de PostgreSQL hosts: bdd-redis-prod become: true gather_facts: true tasks: # ============================================================ # Dépendances requises # ============================================================ - name: Installer les dépendances pour le dépôt APT ansible.builtin.apt: name: - gnupg2 - curl - ca-certificates - lsb-release - python3-psycopg2 - acl state: present update_cache: yes # ============================================================ # Ajout du dépôt officiel PostgreSQL # ============================================================ - name: Ajouter la clé GPG du dépôt PostgreSQL ansible.builtin.apt_key: url: https://www.postgresql.org/media/keys/ACCC4CF8.asc state: present - name: Ajouter le dépôt PostgreSQL 16 ansible.builtin.apt_repository: repo: "deb http://apt.postgresql.org/pub/repos/apt {{ ansible_distribution_release }}-pgdg main" state: present filename: pgdg # ============================================================ # Installation PostgreSQL 16 # ============================================================ - name: Installer PostgreSQL 16 ansible.builtin.apt: name: - "postgresql-{{ pg_version }}" - "postgresql-client-{{ pg_version }}" - "postgresql-contrib-{{ pg_version }}" state: present update_cache: yes - name: Démarrer et activer PostgreSQL ansible.builtin.systemd: name: postgresql state: started enabled: yes # ============================================================ # Configuration PostgreSQL # ============================================================ - name: Configurer l'écoute sur localhost ansible.builtin.lineinfile: path: "/etc/postgresql/{{ pg_version }}/main/postgresql.conf" regexp: "^#?listen_addresses" line: "listen_addresses = 'localhost'" notify: Restart postgresql - name: Configurer le port ansible.builtin.lineinfile: path: "/etc/postgresql/{{ pg_version }}/main/postgresql.conf" regexp: "^#?port" line: "port = {{ db_port }}" notify: Restart postgresql # ============================================================ # Locale requise # ============================================================ - name: Générer la locale fr_FR.UTF-8 ansible.builtin.command: locale-gen fr_FR.UTF-8 register: locale_gen changed_when: "'Generation complete' in locale_gen.stdout" - name: Mettre à jour les locales ansible.builtin.command: update-locale when: locale_gen.changed # ============================================================ # Création de la base de données et configuration utilisateur # ============================================================ - name: Définir le mot de passe de l'utilisateur postgres become_user: postgres ansible.builtin.postgresql_user: name: "{{ db_user }}" password: "{{ db_password }}" state: present - name: Vérifier si la base de données existe become_user: postgres ansible.builtin.command: psql -tAc "SELECT 1 FROM pg_database WHERE datname='{{ db_name }}'" register: db_exists changed_when: false - name: Créer la base de données avec ICU become_user: postgres ansible.builtin.command: > psql -c "CREATE DATABASE {{ db_name }} OWNER {{ db_user }} ENCODING 'UTF8' LOCALE_PROVIDER icu ICU_LOCALE 'fr-FR' TEMPLATE template0" when: db_exists.stdout != "1" - name: Accorder tous les privilèges sur la base become_user: postgres ansible.builtin.postgresql_privs: db: "{{ db_name }}" role: "{{ db_user }}" type: database privs: ALL state: present # ============================================================ # Authentification pg_hba.conf # ============================================================ - name: Configurer l'authentification md5 pour les connexions locales ansible.builtin.postgresql_pg_hba: dest: "/etc/postgresql/{{ pg_version }}/main/pg_hba.conf" contype: host databases: "{{ db_name }}" users: "{{ db_user }}" source: "127.0.0.1/32" method: md5 notify: Restart postgresql - name: Configurer l'authentification md5 pour IPv6 local ansible.builtin.postgresql_pg_hba: dest: "/etc/postgresql/{{ pg_version }}/main/pg_hba.conf" contype: host databases: "{{ db_name }}" users: "{{ db_user }}" source: "::1/128" method: md5 notify: Restart postgresql # ============================================================ # Vérification # ============================================================ - name: Vérifier la version de PostgreSQL become_user: postgres ansible.builtin.command: psql --version register: pg_version_check changed_when: false - name: Afficher la version ansible.builtin.debug: msg: "{{ pg_version_check.stdout }}" - name: Vérifier que la base existe become_user: postgres ansible.builtin.command: psql -lqt register: pg_databases changed_when: false - name: Afficher les bases de données ansible.builtin.debug: msg: "{{ pg_databases.stdout_lines }}" handlers: - name: Restart postgresql ansible.builtin.systemd: name: postgresql state: restarted # ============================================ # Redis Installation (vm-redis uniquement) # ============================================ - name: Installation et configuration de Redis hosts: bdd-redis-prod become: true gather_facts: true tasks: - name: Installer Redis apt: name: - redis-server - python3-redis state: present update_cache: yes - name: Créer le répertoire de backup Redis file: path: /var/lib/redis/backup state: directory owner: redis group: redis mode: "0755" - name: Configurer Redis - bind address (accepter connexions réseau) lineinfile: path: /etc/redis/redis.conf regexp: "^bind" line: "bind 127.0.0.1 {{ vpn_ip }}" state: present notify: Redémarrer Redis - name: Configurer Redis - port lineinfile: path: /etc/redis/redis.conf regexp: "^port" line: "port {{ redis_port }}" state: present notify: Redémarrer Redis - name: Configurer Redis - maxmemory lineinfile: path: /etc/redis/redis.conf regexp: "^# ?maxmemory" line: "maxmemory {{ redis_maxmemory }}" state: present notify: Redémarrer Redis - name: Configurer Redis - maxmemory-policy lineinfile: path: /etc/redis/redis.conf regexp: "^# ?maxmemory-policy" line: "maxmemory-policy {{ redis_maxmemory_policy }}" state: present notify: Redémarrer Redis - name: Configurer Redis - requirepass lineinfile: path: /etc/redis/redis.conf regexp: "^# ?requirepass" line: "requirepass {{ redis_password }}" state: present notify: Redémarrer Redis - name: Activer AOF (Append Only File) pour Redis lineinfile: path: /etc/redis/redis.conf regexp: "^appendonly" line: "appendonly yes" state: present notify: Redémarrer Redis - name: Configurer la fréquence de sync AOF lineinfile: path: /etc/redis/redis.conf regexp: "^# ?appendfsync" line: "appendfsync everysec" state: present notify: Redémarrer Redis - name: Activer la persistance RDB (snapshots) blockinfile: path: /etc/redis/redis.conf block: | save 900 1 save 300 10 save 60 10000 marker: "# {mark} ANSIBLE MANAGED RDB PERSISTENCE" notify: Redémarrer Redis - name: Configurer le nom du fichier AOF lineinfile: path: /etc/redis/redis.conf regexp: "^appendfilename" line: 'appendfilename "appendonly.aof"' state: present notify: Redémarrer Redis - name: Désactiver le mode protégé Redis lineinfile: path: /etc/redis/redis.conf regexp: "^protected-mode" line: "protected-mode no" state: present notify: Redémarrer Redis - name: Configurer le répertoire de travail Redis lineinfile: path: /etc/redis/redis.conf regexp: "^dir" line: "dir /var/lib/redis" state: present notify: Redémarrer Redis - name: Définir le niveau de log lineinfile: path: /etc/redis/redis.conf regexp: "^loglevel" line: "loglevel notice" state: present notify: Redémarrer Redis - name: S'assurer que Redis est démarré systemd: name: redis-server state: started enabled: yes handlers: - name: Redémarrer Redis systemd: name: redis-server state: restarted