NewsBlur-viq/ansible/roles/postgres/tasks/main.yml

---
- name: Template postgresql-13.conf file
  template:
    src: /srv/newsblur/docker/postgres/postgresql-13.conf.j2
    dest: /srv/newsblur/docker/postgres/postgres.conf
  notify: reload postgres
  register: updated_config

- name: Create Postgres docker volumes with correct permissions
  file:
    path: "{{ item  }}"
    state: directory
    recurse: yes
    owner: "{{ ansible_effective_user_id|int }}"
    group: "{{ ansible_effective_group_id|int }}"
  with_items:
    - /srv/newsblur/docker/volumes/postgres/archive
    - /srv/newsblur/docker/volumes/postgres/backups
    - /srv/newsblur/docker/volumes/postgres/data

- name: Template postgres secondaries with empty standby.signal file
  file:
    path: /srv/newsblur/docker/volumes/postgres/data/standby.signal
    state: file
    owner: "{{ ansible_effective_user_id|int }}"
    group: "{{ ansible_effective_group_id|int }}"
  when: (inventory_hostname | regex_replace('\-?[0-9]+', '')) in ['db-postgres-secondary', 'hdb-postgres']

- name: Copy SSH private key
  copy:
    src: /srv/secrets-newsblur/keys/postgres.key
    dest: /home/nb/.ssh/id_rsa
    owner: "{{ ansible_effective_user_id|int }}"
    group: "{{ ansible_effective_group_id|int }}"
    mode: "0600"

- name: Copy SSH public key
  copy:
    src: /srv/secrets-newsblur/keys/postgres.key.pub
    dest: /home/nb/.ssh/id_rsa.pub
    owner: "{{ ansible_effective_user_id|int }}"
    group: "{{ ansible_effective_group_id|int }}"
    mode: "0600"

- name: Add SSH public key to authorized keys
  authorized_key:
    user: "nb"
    state: present
    key: "{{ lookup('file', '/srv/secrets-newsblur/keys/postgres.key.pub') }}"

- name: Build the custom postgres docker image
  docker_image:
    name: newsblur/postgres:13
    build:
      path: /srv/newsblur/docker/postgres/Dockerfile.postgres
      pull: yes
    force_tag: yes
    state: present

- name: Start postgres docker containers
  docker_container:
    name: postgres
    image: newsblur/postgres:13
    state: started
    container_default_behavior: no_defaults
    command: postgres -c config_file=/etc/postgresql/postgresql.conf
    env:
      # POSTGRES_USER: "{{ postgres_user }}" # Don't auto-create newsblur, manually add it
      POSTGRES_PASSWORD: "{{ postgres_password }}"
    hostname: "{{ inventory_hostname }}"
    networks_cli_compatible: yes
    network_mode: default
    networks:
      - name: newsblurnet
        aliases:
          - postgres
    ports:
      - 5432:5432
    user: "{{ ansible_effective_user_id|int }}:{{ ansible_effective_group_id|int }}"
    volumes:
      - /srv/newsblur/docker/volumes/postgres/data:/var/lib/postgresql/data
      - /srv/newsblur/docker/volumes/postgres/archive:/var/lib/postgresql/archive
      - /srv/newsblur/docker/volumes/postgres/backups:/var/lib/postgresql/backups
      - /srv/newsblur/docker/postgres/postgres.conf:/etc/postgresql/postgresql.conf
      - /srv/newsblur/docker/postgres/postgres_hba-13.conf:/etc/postgresql/pg_hba.conf
      - /srv/newsblur/docker/postgres/postgres_ident-13.conf:/etc/postgresql/pg_ident.conf
      - /home/nb/.ssh/id_rsa:/var/lib/postgresql/.ssh/id_rsa
    restart_policy: unless-stopped
  when: (inventory_hostname | regex_replace('\-?[0-9]+', '')) in ['db-postgres-primary', 'db-postgres', 'hdb-postgres']

# - name: Change ownership in postgres docker container
#   become: yes
#   command: >
#     docker exec postgres chown -fR postgres.postgres /var/lib/postgresql
#   ignore_errors: yes

- name: Ensure newsblur role in postgres
  become: yes
  shell: >
    sleep 15; 
    docker exec postgres createuser -s newsblur -U postgres;
    docker exec postgres createdb newsblur -U newsblur;
  register: ensure_role
  ignore_errors: yes
  changed_when:
    - "ensure_role.rc == 0"
  failed_when:
    - "'already exists' not in ensure_role.stderr"
    - "ensure_role.rc != 0"

- name: Register postgres in consul
  tags: consul
  become: yes
  template:
    src: consul_service.json
    dest: /etc/consul.d/postgres.json
  notify:
    - reload consul

- name: Copy common secrets
  copy:
    src: /srv/secrets-newsblur/settings/common_settings.py
    dest: /srv/newsblur/newsblur_web/local_settings.py
  register: app_changed

- name: Add sanity checkers cronjob for disk usage
  cron:
    name: disk_usage_sanity_checker
    minute: "0"
    job: >-
      OUTPUT=$(df / | head -n 2 |  tail -1) docker run --rm -it -v /srv/newsblur:/srv/newsblur \
      --network=newsblurnet --hostname {{ ansible_hostname }} newsblur/newsblur_python3 \
      /srv/newsblur/utils/monitor_disk_usage.py $OUTPUT
  tags: cron

- name: Add postgresql archive cleaner cronjob
  cron:
    name: postgres_archive_cleaner
    minute: "0"
    job: >-
      sudo find /srv/newsblur/docker/volumes/postgres/archive -type f -mmin +180 -delete
  tags: cron

- name: Add postgresql backup cleaner cronjob
  cron:
    name: postgres_backup_cleaner
    minute: "0"
    hour: "5"
    job: >-
      sudo find /srv/newsblur/docker/volumes/postgres/backups -type f -mmin +18000 -delete
  tags: cron

- name: Add postgres backup log
  become: yes
  file:
    path: /var/log/postgres_backup.log
    state: touch
    mode: 0777
    owner: "{{ ansible_effective_user_id|int }}"
    group: "{{ ansible_effective_group_id|int }}"

- name: Add postgres backup
  cron:
    name: postgres backup
    minute: "0"
    hour: "4"
    job: /srv/newsblur/docker/postgres/backup_postgres.sh >> /var/log/postgres_backup.log 2>&1
  tags: cron