63 lines
2 KiB
YAML
63 lines
2 KiB
YAML
|
---
|
||
|
|
# Devis PostgreSQL — RELEVE seul. Ne modifie rien (D-23).
|
||
|
|
#
|
||
|
|
# On interroge l'ETAT EFFECTIF (`pg_settings`), jamais les fichiers. Un `grep` de
|
||
|
|
# `postgresql.conf` annonce `ssl_cert_file = snakeoil` sur cet hote, alors que le
|
||
|
|
# serveur sert bien le certificat de l'AC interne : la valeur vient d'un
|
||
|
|
# `conf.d/99-setops.conf` que le grep ne voyait pas. C'est l'instrument qui etait
|
||
|
|
# incomplet, pas la configuration. Constate le 2026-08-08.
|
||
|
|
#
|
||
|
|
# make postgresql-plan
|
||
|
|
|
||
|
|
- name: Devis PostgreSQL — chiffrement et portee des accès
|
||
|
|
hosts: serveur_postgresql
|
||
|
|
become: true
|
||
|
|
gather_facts: false
|
||
|
|
|
||
|
|
tasks:
|
||
|
|
- name: Relever les réglages TLS effectifs
|
||
|
|
ansible.builtin.command:
|
||
|
|
argv:
|
||
|
|
- sudo
|
||
|
|
- -u
|
||
|
|
- postgres
|
||
|
|
- psql
|
||
|
|
- -tAF|
|
||
|
|
- -c
|
||
|
|
- >-
|
||
|
|
select name, setting from pg_settings
|
||
|
|
where name in ('ssl','ssl_cert_file','ssl_key_file','ssl_ca_file')
|
||
|
|
register: devis_pg_tls
|
||
|
|
changed_when: false
|
||
|
|
|
||
|
|
- name: Relever les règles d'accès effectives
|
||
|
|
ansible.builtin.command:
|
||
|
|
argv:
|
||
|
|
- sudo
|
||
|
|
- -u
|
||
|
|
- postgres
|
||
|
|
- psql
|
||
|
|
- -tAF|
|
||
|
|
- -c
|
||
|
|
# `address` et `netmask` sont du TEXTE dans cette vue, pas des inet : on les
|
||
|
|
# rend tels quels et Python les recompose.
|
||
|
|
- >-
|
||
|
|
select type, coalesce(address,''), coalesce(netmask,''), auth_method
|
||
|
|
from pg_hba_file_rules where error is null order by rule_number
|
||
|
|
register: devis_pg_hba
|
||
|
|
changed_when: false
|
||
|
|
|
||
|
|
- name: Déposer le relevé sur le contrôleur
|
||
|
|
ansible.builtin.copy:
|
||
|
|
dest: "{{ playbook_dir }}/../../instance/devis-postgresql.json.{{ inventory_hostname }}"
|
||
|
|
mode: "0600"
|
||
|
|
content: >-
|
||
|
|
{{ {
|
||
|
|
'hote': inventory_hostname,
|
||
|
|
'supernet': setops_supernet | default(''),
|
||
|
|
'tls': devis_pg_tls.stdout_lines | default([]),
|
||
|
|
'hba': devis_pg_hba.stdout_lines | default([]),
|
||
|
|
} | to_nice_json }}
|
||
|
|
delegate_to: localhost
|
||
|
|
become: false
|