70 lines
No EOL
2.5 KiB
YAML
70 lines
No EOL
2.5 KiB
YAML
---
|
|
# SSL/TLS configuration for PostgreSQL
|
|
|
|
- name: Install OpenSSL
|
|
apt:
|
|
name: openssl
|
|
state: present
|
|
|
|
- name: Create SSL directory
|
|
file:
|
|
path: "{{ postgresql_data_directory }}/ssl"
|
|
state: directory
|
|
owner: postgres
|
|
group: postgres
|
|
mode: '0700'
|
|
|
|
- name: Check if SSL certificate exists
|
|
stat:
|
|
path: "{{ postgresql_data_directory }}/ssl/server.crt"
|
|
register: ssl_cert
|
|
|
|
- name: Generate private key for PostgreSQL
|
|
shell: |
|
|
openssl genrsa -out {{ postgresql_data_directory }}/ssl/server.key 4096
|
|
chmod 600 {{ postgresql_data_directory }}/ssl/server.key
|
|
chown postgres:postgres {{ postgresql_data_directory }}/ssl/server.key
|
|
when: not ssl_cert.stat.exists
|
|
|
|
- name: Generate self-signed certificate
|
|
shell: |
|
|
openssl req -new -x509 -days 3650 \
|
|
-key {{ postgresql_data_directory }}/ssl/server.key \
|
|
-out {{ postgresql_data_directory }}/ssl/server.crt \
|
|
-subj "/C=US/ST=State/L=City/O=Organization/CN={{ ansible_hostname }}" \
|
|
-addext "subjectAltName=DNS:{{ ansible_hostname }},DNS:{{ ansible_fqdn | default(ansible_hostname) }},IP:{{ ansible_default_ipv4.address }},IP:{{ ansible_host }}"
|
|
chmod 644 {{ postgresql_data_directory }}/ssl/server.crt
|
|
chown postgres:postgres {{ postgresql_data_directory }}/ssl/server.crt
|
|
when: not ssl_cert.stat.exists
|
|
|
|
- name: Create CA certificate (copy server cert as CA for self-signed)
|
|
copy:
|
|
src: "{{ postgresql_data_directory }}/ssl/server.crt"
|
|
dest: "{{ postgresql_data_directory }}/ssl/ca.crt"
|
|
remote_src: yes
|
|
owner: postgres
|
|
group: postgres
|
|
mode: '0644'
|
|
|
|
- name: Set proper permissions on SSL files
|
|
file:
|
|
path: "{{ item.path }}"
|
|
owner: postgres
|
|
group: postgres
|
|
mode: "{{ item.mode }}"
|
|
loop:
|
|
- { path: "{{ postgresql_data_directory }}/ssl/server.key", mode: '0600' }
|
|
- { path: "{{ postgresql_data_directory }}/ssl/server.crt", mode: '0644' }
|
|
- { path: "{{ postgresql_data_directory }}/ssl/ca.crt", mode: '0644' }
|
|
|
|
- name: Create symlinks in PostgreSQL config directory
|
|
file:
|
|
src: "{{ item.src }}"
|
|
dest: "{{ item.dest }}"
|
|
state: link
|
|
owner: postgres
|
|
group: postgres
|
|
loop:
|
|
- { src: "{{ postgresql_data_directory }}/ssl/server.crt", dest: "{{ postgresql_config_directory }}/server.crt" }
|
|
- { src: "{{ postgresql_data_directory }}/ssl/server.key", dest: "{{ postgresql_config_directory }}/server.key" }
|
|
- { src: "{{ postgresql_data_directory }}/ssl/ca.crt", dest: "{{ postgresql_config_directory }}/ca.crt" } |