Updates, bug fixes to postgres deployments

hosts

@@ -1,2 +1,2 @@
 [postgres]
-prod-postgres-1.ibmesports.com
+prod-postgres-2.ibmesports.com

roles/common/tasks/main.yml

@@ -6,29 +6,43 @@
   with_items:
     - libssl-dev
     - libssl-doc
-    - openssh
+    - openssh-client
+    - openssh-server
     - openssl
+    - python3
+    - python3-setuptools
+    - python3-pip
     - ufw
     - vim
 
+- name: Ensure default editor
+  command: update-alternatives --set editor /usr/bin/vim.basic
+
 - name: Ensure sshd config
   template:
     src: etc/ssh/sshd_config
     dest: /etc/ssh/sshd_config
     mode: 0644
 
 - name: Restart sshd
-  systemd:
+  service:
     name: sshd
     state: restarted
 
+- name: Ensure ssh access
+  ufw:
+    name: OpenSSH
+    rule: allow
+  notify:
+    - restart ufw
+
 - name: Ensure ufw defaults
   ufw:
     direction: "{{ item.direction }}"
     policy: "{{ item.policy }}"
   with_items:
-    - { direction: "incoming", policy: "deny" }
     - { direction: "outgoing", policy: "allow" }
+    - { direction: "incoming", policy: "deny" }
   notify:
     - restart ufw
 
@@ -39,7 +53,6 @@
     proto: "{{ item.proto }}"
     src: "{{ item.src }}"
   with_items:
-    - { rule: "allow", port: "{{ ssh_port | default('22') }}", proto: "tcp", src: "*" }
     - { rule: "allow", port: "{{ db_port | default('5432') }}", proto: "tcp", src: "172.30.0.0/16" }
   notify:
     - restart ufw
@@ -54,7 +67,7 @@
   ufw:
     state: enabled
 
-- name: Install pip packages
+- name: Ensure pip packages
   pip:
     name: "{{ item }}"
     state: present

roles/common/templates/etc/ssh/sshd_config

@@ -2,7 +2,7 @@
 # See the sshd_config(5) manpage for details
 
 # What ports, IPs and protocols we listen for
-Port {{ ssh_port }} 
+Port {{ ssh_port }}
 # Use these options to restrict which interfaces/protocols sshd will bind to
 #ListenAddress ::
 #ListenAddress 0.0.0.0
@@ -25,11 +25,11 @@ LogLevel INFO
 
 # Authentication:
 LoginGraceTime 120
-PermitRootLogin {{ ssh_permit_root_login }} 
+PermitRootLogin {{ ssh_permit_root_login }}
 StrictModes yes
 
 RSAAuthentication yes
-PubkeyAuthentication {{ ssh_key_auth }} 
+PubkeyAuthentication {{ ssh_key_auth }}
 #AuthorizedKeysFile	%h/.ssh/authorized_keys
 
 # Don't read the user's ~/.rhosts and ~/.shosts files
@@ -42,7 +42,7 @@ HostbasedAuthentication no
 #IgnoreUserKnownHosts yes
 
 # To enable empty passwords, change to yes (NOT RECOMMENDED)
-PermitEmptyPasswords {{ ssh_permit_empty_passwords }} 
+PermitEmptyPasswords {{ ssh_permit_empty_passwords }}
 
 # Change to yes to enable challenge-response passwords (beware issues with
 # some PAM modules and threads)

roles/common/vars/main.yml

@@ -1,6 +1,6 @@
 ---
 ssh_port: 22
-ssh_permit_root_login: "no"
+ssh_permit_root_login: "yes"
 ssh_key_auth: "yes"
 ssh_permit_empty_passwords: "no"
 ssh_password_auth: "no"

roles/postgres/handlers/main.yml

@@ -1,5 +1,5 @@
 ---
 - name: restart postgresql
-  systemd:
+  service:
     name: postgresql
     state: restarted

roles/postgres/tasks/main.yml

@@ -8,13 +8,6 @@
     - postgresql-contrib
     - libpq-dev
 
-- name: Ensure postgresql homedir
-  file:
-    path: /home/postgres
-    owner: postgres
-    group: postgres
-    mode: 0755
-
 - name: Ensure postgresql service is running
   service:
     name: postgresql
@@ -28,7 +21,6 @@
     lc_collate: 'en_US.UTF-8'
     lc_ctype: 'en_US.UTF-8'
     state: present
-  notify: restart postgresql
 
 - name: Ensure database user
   sudo_user: postgres
@@ -37,15 +29,13 @@
     name: "{{ db_user }}"
     password: "{{ db_password }}"
     state: present
-  notify: restart postgresql
 
 - name: Ensure database role has CREATEDB
   sudo_user: postgres
   postgresql_user:
     name: "{{ db_user }}"
     role_attr_flags: CREATEDB
     state: present
-  notify: restart postgresql
 
 - name: Ensure postgresql config files
   file:
@@ -57,34 +47,35 @@
   with_items:
     - postgresql.conf
     - pg_hba.conf
+  notify: restart postgresql
 
 - name: Ensure backups dir
   file:
-    path: /home/postgres/backups
+    path: /var/lib/postgres/backups
     owner: postgres
     group: postgres
     mode: 0755
 
 - name: Ensure pg_backup.config
   template:
-    src: home/postgres/backups/pg_backup.config
-    dest: /home/postgres/backups/pg_backup.config
+    src: var/lib/postgres/pg_backup.config
+    dest: /var/lib/postgres/backups/pg_backup.config
     owner: postgres
     group: postgres
     mode: 0755
 
 - name: Ensure pg_backup.sh
   template:
-    src: home/postgres/backups/pg_backup.sh
-    dest: /home/postgres/backups/pg_backup.sh
+    src: var/lib/postgres/backups/pg_backup.sh
+    dest: /var/lib/postgres/backups/pg_backup.sh
     owner: postgres
     group: postgres
     mode: 0755
 
 - name: Ensure backup cron job
   cron:
-    - name: "backup postgres db"
-      minute: "0"
-      hour: "3"
-      special_time: daily
-      job: "sudo -u postgres /home/postgres/backups/pg_backup.sh -c /home/postgres/backups/pg_config.sh"
+    name: "backup postgres db"
+    minute: "0"
+    hour: "3"
+    special_time: daily
+    job: "sudo -u postgres /home/postgres/backups/pg_backup.sh -c /home/postgres/backups/pg_config.sh"

site.yml

@@ -8,5 +8,5 @@
 - name: postgres host
   hosts: postgres
   roles:
-    - role: primary
+    - role: postgres
       tags: ['postgres']