Graham McIntire
6f0d308fea
- Remove forgejo role, play, group, host_vars, and DNS references - Replace hardcoded /Users/graham/.ssh/ paths with env var lookup - Remove broken setup-user Makefile target - Add community.mysql collection to requirements.yml - Add .ansible/ to .gitignore - git rm --cached .DS_Store files and .vscode/settings.json - Update CLAUDE.md and README.md to reflect actual state - Add findings.md with audit results
141 lines
3.3 KiB
YAML
141 lines
3.3 KiB
YAML
---
|
|
ansible_user: graham
|
|
ansible_host: 10.0.15.22
|
|
ansible_python_interpreter: /usr/bin/python3
|
|
ansible_ssh_common_args: '-o StrictHostKeyChecking=accept-new'
|
|
|
|
firewall_enabled: false
|
|
|
|
# Override role defaults - LXC container with default Debian paths
|
|
postgresql_version: "17"
|
|
postgresql_storage_setup_enabled: false
|
|
postgresql_data_directory: /var/lib/postgresql/17/main
|
|
postgresql_wal_directory: /var/lib/postgresql/17/main/pg_wal
|
|
postgresql_config_directory: /etc/postgresql/17/main
|
|
postgresql_backup_enabled: false
|
|
|
|
# PostgreSQL base config (postgresql.conf)
|
|
postgresql_config:
|
|
# Connection
|
|
listen_addresses: "'*'"
|
|
max_connections: 100
|
|
port: 5432
|
|
|
|
# Memory (tuned for 8GB RAM, Intel N100 2 vCPU)
|
|
shared_buffers: 2GB
|
|
effective_cache_size: 6GB
|
|
work_mem: 16MB
|
|
maintenance_work_mem: 512MB
|
|
huge_pages: try
|
|
|
|
# NVMe SSD tuning
|
|
random_page_cost: 1.1
|
|
effective_io_concurrency: 200
|
|
maintenance_io_concurrency: 200
|
|
|
|
# WAL & Checkpoints (write-heavy APRS workload)
|
|
wal_buffers: 64MB
|
|
max_wal_size: 2GB
|
|
min_wal_size: 512MB
|
|
wal_compression: zstd
|
|
checkpoint_completion_target: 0.9
|
|
checkpoint_timeout: 10min
|
|
synchronous_commit: off
|
|
|
|
# Parallelism (constrained by 2 vCPUs)
|
|
max_worker_processes: 4
|
|
max_parallel_workers: 2
|
|
max_parallel_workers_per_gather: 1
|
|
max_parallel_maintenance_workers: 1
|
|
|
|
# Autovacuum (aggressive for high-churn packets table)
|
|
autovacuum_vacuum_scale_factor: 0.05
|
|
autovacuum_analyze_scale_factor: 0.02
|
|
autovacuum_vacuum_cost_limit: 1000
|
|
autovacuum_naptime: 30s
|
|
|
|
# Query planner
|
|
default_statistics_target: 200
|
|
|
|
# Monitoring & Logging
|
|
shared_preload_libraries: "'pg_stat_statements'"
|
|
pg_stat_statements.track: top
|
|
track_io_timing: on
|
|
log_min_duration_statement: 500
|
|
log_lock_waits: on
|
|
log_temp_files: 0
|
|
log_autovacuum_min_duration: 250
|
|
log_line_prefix: "'%m [%p] %q%u@%d '"
|
|
log_timezone: "'Etc/UTC'"
|
|
cluster_name: "'17/main'"
|
|
|
|
# Locale
|
|
datestyle: "'iso, mdy'"
|
|
timezone: "'Etc/UTC'"
|
|
lc_messages: "'C'"
|
|
lc_monetary: "'C'"
|
|
lc_numeric: "'C'"
|
|
lc_time: "'C'"
|
|
default_text_search_config: "'pg_catalog.english'"
|
|
|
|
# SSL (snakeoil certs)
|
|
ssl: on
|
|
ssl_cert_file: "'/etc/ssl/certs/ssl-cert-snakeoil.pem'"
|
|
ssl_key_file: "'/etc/ssl/private/ssl-cert-snakeoil.key'"
|
|
|
|
# pg_hba.conf entries
|
|
postgresql_hba_entries:
|
|
- type: local
|
|
database: all
|
|
user: postgres
|
|
auth_method: peer
|
|
- type: local
|
|
database: all
|
|
user: all
|
|
auth_method: md5
|
|
- type: host
|
|
database: all
|
|
user: all
|
|
address: 127.0.0.1/32
|
|
auth_method: scram-sha-256
|
|
- type: host
|
|
database: all
|
|
user: all
|
|
address: 0.0.0.0/0
|
|
auth_method: md5
|
|
- type: host
|
|
database: all
|
|
user: all
|
|
address: "::1/128"
|
|
auth_method: scram-sha-256
|
|
- type: local
|
|
database: replication
|
|
user: all
|
|
auth_method: peer
|
|
- type: host
|
|
database: replication
|
|
user: all
|
|
address: 127.0.0.1/32
|
|
auth_method: scram-sha-256
|
|
- type: host
|
|
database: replication
|
|
user: all
|
|
address: "::1/128"
|
|
auth_method: scram-sha-256
|
|
|
|
# Database
|
|
postgresql_databases:
|
|
- name: aprsme_prod
|
|
owner: aprs
|
|
|
|
postgresql_users:
|
|
- name: aprs
|
|
password: "{{ vault_postgresql_aprs_password | default(omit) }}"
|
|
role_attr_flags: CREATEDB
|
|
|
|
postgresql_extensions:
|
|
aprsme_prod:
|
|
- citext
|
|
- pg_stat_statements
|
|
- pg_trgm
|
|
- postgis
|