55 lines
No EOL
1.9 KiB
YAML
55 lines
No EOL
1.9 KiB
YAML
---
|
|
# 1Password integration for PostgreSQL passwords
|
|
# This file handles password generation and storage in 1Password
|
|
|
|
- name: Check if 1Password CLI is available
|
|
command: which op
|
|
register: op_cli_check
|
|
changed_when: false
|
|
failed_when: false
|
|
delegate_to: localhost
|
|
|
|
- name: Fail if 1Password CLI is not installed
|
|
fail:
|
|
msg: "1Password CLI (op) is not installed. Please install it first."
|
|
when: op_cli_check.rc != 0
|
|
|
|
- name: Generate password for PostgreSQL user
|
|
set_fact:
|
|
generated_password: "{{ lookup('password', '/dev/null length=32 chars=ascii_letters,digits') }}"
|
|
when: vault_postgresql_aprsme_password is not defined
|
|
no_log: true
|
|
|
|
- name: Create 1Password item for PostgreSQL password
|
|
shell: |
|
|
op item create \
|
|
--category=database \
|
|
--title="PostgreSQL {{ item.name }} - {{ ansible_hostname }}" \
|
|
--vault="Private" \
|
|
username="{{ item.name }}" \
|
|
password="{{ generated_password | default(vault_postgresql_aprsme_password) }}" \
|
|
hostname="{{ ansible_host }}" \
|
|
port="5432" \
|
|
database="{{ postgresql_databases[0].name }}" \
|
|
--account="{{ op_account_id | default('YOOATCZZSVGH7AD6VABUVPORLI') }}" \
|
|
--format=json || \
|
|
op item edit \
|
|
"PostgreSQL {{ item.name }} - {{ ansible_hostname }}" \
|
|
password="{{ generated_password | default(vault_postgresql_aprsme_password) }}" \
|
|
--account="{{ op_account_id | default('YOOATCZZSVGH7AD6VABUVPORLI') }}"
|
|
delegate_to: localhost
|
|
loop: "{{ postgresql_users }}"
|
|
when: use_1password | default(false)
|
|
no_log: true
|
|
register: op_items
|
|
|
|
- name: Set password fact from 1Password or generated
|
|
set_fact:
|
|
postgresql_users_with_passwords: >-
|
|
{%- set users = [] -%}
|
|
{%- for user in postgresql_users -%}
|
|
{%- set _ = user.update({'password': generated_password | default(vault_postgresql_aprsme_password)}) -%}
|
|
{%- set _ = users.append(user) -%}
|
|
{%- endfor -%}
|
|
{{ users }}
|
|
no_log: true |