Change vars around and fix some stuff, use per-service vault inclusion

This commit is contained in:
Alex 2020-05-21 20:16:53 +02:00
parent 95c334a065
commit 4c83c16780
Signed by: caskd
GPG Key ID: F92BA85F61F4C173
2 changed files with 13 additions and 7 deletions

1
.gitignore vendored Normal file
View File

@ -0,0 +1 @@
vault/

View File

@ -1,3 +1,8 @@
- name: Include sensitive info
include_vars:
dir: '/vault/main.yml'
tags:
- vault
- name: PostgreSQL listen on private subnet - name: PostgreSQL listen on private subnet
replace: replace:
path: /etc/postgresql/12/main/postgresql.conf path: /etc/postgresql/12/main/postgresql.conf
@ -10,10 +15,10 @@
become: yes become: yes
become_user: postgres become_user: postgres
postgresql_user: postgresql_user:
port: '{{ services.postgres.port }}' port: '{{ postgres.port }}'
db: postgres db: postgres
name: "{{ postgres.user }}" name: "{{ vault_postgres.user }}"
password: "{{ postgres.password }}" password: "{{ vault_postgres.password }}"
tags: tags:
- postgres - postgres
- vault - vault
@ -21,12 +26,12 @@
become: yes become: yes
become_user: postgres become_user: postgres
postgresql_user: postgresql_user:
port: '{{ services.postgres.port }}' port: '{{ postgres.port }}'
db: postgres db: postgres
name: '{{ item }}' name: '{{ item }}'
role_attr_flags: "LOGIN,NOSUPERUSER,NOCREATEROLE,NOCREATEDB,NOREPLICATION,NOINHERIT" role_attr_flags: "LOGIN,NOSUPERUSER,NOCREATEROLE,NOCREATEDB,NOREPLICATION,NOINHERIT"
password: "{{ postgres.dbpass[item] }}" password: "{{ vault_postgres.dbpass[item] }}"
loop: "{{ services.postgres.databases }}" loop: "{{ postgres.databases }}"
tags: tags:
- postgres - postgres
- vault - vault
@ -36,7 +41,7 @@
postgresql_db: postgresql_db:
name: '{{ item }}' name: '{{ item }}'
owner: '{{ item }}' owner: '{{ item }}'
loop: "{{ services.postgres.databases }}" loop: "{{ postgres.databases }}"
tags: tags:
- postgres - postgres
- vault - vault