309 lines
10 KiB
YAML
309 lines
10 KiB
YAML
---
|
|
# ============================================
|
|
# PostgreSQL Installation (vm-postgres uniquement)
|
|
# ============================================
|
|
- name: Installation et configuration de PostgreSQL
|
|
hosts: bdd-redis-prod
|
|
become: true
|
|
gather_facts: true
|
|
|
|
tasks:
|
|
# ============================================================
|
|
# Dépendances requises
|
|
# ============================================================
|
|
- name: Installer les dépendances pour le dépôt APT
|
|
ansible.builtin.apt:
|
|
name:
|
|
- gnupg2
|
|
- curl
|
|
- ca-certificates
|
|
- lsb-release
|
|
- python3-psycopg2
|
|
- acl
|
|
state: present
|
|
update_cache: yes
|
|
|
|
# ============================================================
|
|
# Ajout du dépôt officiel PostgreSQL
|
|
# ============================================================
|
|
- name: Ajouter la clé GPG du dépôt PostgreSQL
|
|
ansible.builtin.apt_key:
|
|
url: https://www.postgresql.org/media/keys/ACCC4CF8.asc
|
|
state: present
|
|
|
|
- name: Ajouter le dépôt PostgreSQL 16
|
|
ansible.builtin.apt_repository:
|
|
repo: "deb http://apt.postgresql.org/pub/repos/apt {{ ansible_distribution_release }}-pgdg main"
|
|
state: present
|
|
filename: pgdg
|
|
|
|
# ============================================================
|
|
# Installation PostgreSQL 16
|
|
# ============================================================
|
|
- name: Installer PostgreSQL 16
|
|
ansible.builtin.apt:
|
|
name:
|
|
- "postgresql-{{ pg_version }}"
|
|
- "postgresql-client-{{ pg_version }}"
|
|
- "postgresql-contrib-{{ pg_version }}"
|
|
state: present
|
|
update_cache: yes
|
|
|
|
- name: Démarrer et activer PostgreSQL
|
|
ansible.builtin.systemd:
|
|
name: postgresql
|
|
state: started
|
|
enabled: yes
|
|
|
|
# ============================================================
|
|
# Configuration PostgreSQL
|
|
# ============================================================
|
|
- name: Configurer l'écoute sur localhost
|
|
ansible.builtin.lineinfile:
|
|
path: "/etc/postgresql/{{ pg_version }}/main/postgresql.conf"
|
|
regexp: "^#?listen_addresses"
|
|
line: "listen_addresses = 'localhost'"
|
|
notify: Restart postgresql
|
|
|
|
- name: Configurer le port
|
|
ansible.builtin.lineinfile:
|
|
path: "/etc/postgresql/{{ pg_version }}/main/postgresql.conf"
|
|
regexp: "^#?port"
|
|
line: "port = {{ db_port }}"
|
|
notify: Restart postgresql
|
|
|
|
# ============================================================
|
|
# Locale requise
|
|
# ============================================================
|
|
- name: Générer la locale fr_FR.UTF-8
|
|
ansible.builtin.command: locale-gen fr_FR.UTF-8
|
|
register: locale_gen
|
|
changed_when: "'Generation complete' in locale_gen.stdout"
|
|
|
|
- name: Mettre à jour les locales
|
|
ansible.builtin.command: update-locale
|
|
when: locale_gen.changed
|
|
|
|
# ============================================================
|
|
# Création de la base de données et configuration utilisateur
|
|
# ============================================================
|
|
- name: Définir le mot de passe de l'utilisateur postgres
|
|
become_user: postgres
|
|
ansible.builtin.postgresql_user:
|
|
name: "{{ db_user }}"
|
|
password: "{{ db_password }}"
|
|
state: present
|
|
|
|
- name: Vérifier si la base de données existe
|
|
become_user: postgres
|
|
ansible.builtin.command: psql -tAc "SELECT 1 FROM pg_database WHERE datname='{{ db_name }}'"
|
|
register: db_exists
|
|
changed_when: false
|
|
|
|
- name: Créer la base de données avec ICU
|
|
become_user: postgres
|
|
ansible.builtin.command: >
|
|
psql -c "CREATE DATABASE {{ db_name }}
|
|
OWNER {{ db_user }}
|
|
ENCODING 'UTF8'
|
|
LOCALE_PROVIDER icu
|
|
ICU_LOCALE 'fr-FR'
|
|
TEMPLATE template0"
|
|
when: db_exists.stdout != "1"
|
|
|
|
- name: Accorder tous les privilèges sur la base
|
|
become_user: postgres
|
|
ansible.builtin.postgresql_privs:
|
|
db: "{{ db_name }}"
|
|
role: "{{ db_user }}"
|
|
type: database
|
|
privs: ALL
|
|
state: present
|
|
|
|
# ============================================================
|
|
# Authentification pg_hba.conf
|
|
# ============================================================
|
|
- name: Configurer l'authentification md5 pour les connexions locales
|
|
ansible.builtin.postgresql_pg_hba:
|
|
dest: "/etc/postgresql/{{ pg_version }}/main/pg_hba.conf"
|
|
contype: host
|
|
databases: "{{ db_name }}"
|
|
users: "{{ db_user }}"
|
|
source: "127.0.0.1/32"
|
|
method: md5
|
|
notify: Restart postgresql
|
|
|
|
- name: Configurer l'authentification md5 pour IPv6 local
|
|
ansible.builtin.postgresql_pg_hba:
|
|
dest: "/etc/postgresql/{{ pg_version }}/main/pg_hba.conf"
|
|
contype: host
|
|
databases: "{{ db_name }}"
|
|
users: "{{ db_user }}"
|
|
source: "::1/128"
|
|
method: md5
|
|
notify: Restart postgresql
|
|
|
|
# ============================================================
|
|
# Vérification
|
|
# ============================================================
|
|
- name: Vérifier la version de PostgreSQL
|
|
become_user: postgres
|
|
ansible.builtin.command: psql --version
|
|
register: pg_version_check
|
|
changed_when: false
|
|
|
|
- name: Afficher la version
|
|
ansible.builtin.debug:
|
|
msg: "{{ pg_version_check.stdout }}"
|
|
|
|
- name: Vérifier que la base existe
|
|
become_user: postgres
|
|
ansible.builtin.command: psql -lqt
|
|
register: pg_databases
|
|
changed_when: false
|
|
|
|
- name: Afficher les bases de données
|
|
ansible.builtin.debug:
|
|
msg: "{{ pg_databases.stdout_lines }}"
|
|
|
|
handlers:
|
|
- name: Restart postgresql
|
|
ansible.builtin.systemd:
|
|
name: postgresql
|
|
state: restarted
|
|
|
|
# ============================================
|
|
# Redis Installation (vm-redis uniquement)
|
|
# ============================================
|
|
- name: Installation et configuration de Redis
|
|
hosts: bdd-redis-prod
|
|
become: true
|
|
gather_facts: true
|
|
|
|
tasks:
|
|
- name: Installer Redis
|
|
apt:
|
|
name:
|
|
- redis-server
|
|
- python3-redis
|
|
state: present
|
|
update_cache: yes
|
|
|
|
- name: Créer le répertoire de backup Redis
|
|
file:
|
|
path: /var/lib/redis/backup
|
|
state: directory
|
|
owner: redis
|
|
group: redis
|
|
mode: "0755"
|
|
|
|
- name: Configurer Redis - bind address (accepter connexions réseau)
|
|
lineinfile:
|
|
path: /etc/redis/redis.conf
|
|
regexp: "^bind"
|
|
line: "bind 127.0.0.1 {{ vpn_ip }}"
|
|
state: present
|
|
notify: Redémarrer Redis
|
|
|
|
- name: Configurer Redis - port
|
|
lineinfile:
|
|
path: /etc/redis/redis.conf
|
|
regexp: "^port"
|
|
line: "port {{ redis_port }}"
|
|
state: present
|
|
notify: Redémarrer Redis
|
|
|
|
- name: Configurer Redis - maxmemory
|
|
lineinfile:
|
|
path: /etc/redis/redis.conf
|
|
regexp: "^# ?maxmemory"
|
|
line: "maxmemory {{ redis_maxmemory }}"
|
|
state: present
|
|
notify: Redémarrer Redis
|
|
|
|
- name: Configurer Redis - maxmemory-policy
|
|
lineinfile:
|
|
path: /etc/redis/redis.conf
|
|
regexp: "^# ?maxmemory-policy"
|
|
line: "maxmemory-policy {{ redis_maxmemory_policy }}"
|
|
state: present
|
|
notify: Redémarrer Redis
|
|
|
|
- name: Configurer Redis - requirepass
|
|
lineinfile:
|
|
path: /etc/redis/redis.conf
|
|
regexp: "^# ?requirepass"
|
|
line: "requirepass {{ redis_password }}"
|
|
state: present
|
|
notify: Redémarrer Redis
|
|
|
|
- name: Activer AOF (Append Only File) pour Redis
|
|
lineinfile:
|
|
path: /etc/redis/redis.conf
|
|
regexp: "^appendonly"
|
|
line: "appendonly yes"
|
|
state: present
|
|
notify: Redémarrer Redis
|
|
|
|
- name: Configurer la fréquence de sync AOF
|
|
lineinfile:
|
|
path: /etc/redis/redis.conf
|
|
regexp: "^# ?appendfsync"
|
|
line: "appendfsync everysec"
|
|
state: present
|
|
notify: Redémarrer Redis
|
|
|
|
- name: Activer la persistance RDB (snapshots)
|
|
blockinfile:
|
|
path: /etc/redis/redis.conf
|
|
block: |
|
|
save 900 1
|
|
save 300 10
|
|
save 60 10000
|
|
marker: "# {mark} ANSIBLE MANAGED RDB PERSISTENCE"
|
|
notify: Redémarrer Redis
|
|
|
|
- name: Configurer le nom du fichier AOF
|
|
lineinfile:
|
|
path: /etc/redis/redis.conf
|
|
regexp: "^appendfilename"
|
|
line: 'appendfilename "appendonly.aof"'
|
|
state: present
|
|
notify: Redémarrer Redis
|
|
|
|
- name: Désactiver le mode protégé Redis
|
|
lineinfile:
|
|
path: /etc/redis/redis.conf
|
|
regexp: "^protected-mode"
|
|
line: "protected-mode no"
|
|
state: present
|
|
notify: Redémarrer Redis
|
|
|
|
- name: Configurer le répertoire de travail Redis
|
|
lineinfile:
|
|
path: /etc/redis/redis.conf
|
|
regexp: "^dir"
|
|
line: "dir /var/lib/redis"
|
|
state: present
|
|
notify: Redémarrer Redis
|
|
|
|
- name: Définir le niveau de log
|
|
lineinfile:
|
|
path: /etc/redis/redis.conf
|
|
regexp: "^loglevel"
|
|
line: "loglevel notice"
|
|
state: present
|
|
notify: Redémarrer Redis
|
|
|
|
- name: S'assurer que Redis est démarré
|
|
systemd:
|
|
name: redis-server
|
|
state: started
|
|
enabled: yes
|
|
|
|
handlers:
|
|
- name: Redémarrer Redis
|
|
systemd:
|
|
name: redis-server
|
|
state: restarted
|