{"id":23818791,"url":"https://github.com/blackieops/ansible-role-postgresql","last_synced_at":"2026-05-02T23:38:32.970Z","repository":{"id":199352079,"uuid":"702698527","full_name":"blackieops/ansible-role-postgresql","owner":"blackieops","description":"🐘🔐 Ansible role to deploy a PKI-enabled PostgreSQL server.","archived":false,"fork":false,"pushed_at":"2023-10-09T22:26:32.000Z","size":14,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-02-21T22:15:52.940Z","etag":null,"topics":["ansible","ansible-role","pki","postgresql"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/blackieops.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2023-10-09T20:31:15.000Z","updated_at":"2023-10-10T13:47:17.000Z","dependencies_parsed_at":null,"dependency_job_id":"74e2708f-7b89-4c67-b1ba-efc40e31b916","html_url":"https://github.com/blackieops/ansible-role-postgresql","commit_stats":null,"previous_names":["blackieops/ansible-role-postgresql"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/blackieops/ansible-role-postgresql","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/blackieops%2Fansible-role-postgresql","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/blackieops%2Fansible-role-postgresql/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/blackieops%2Fansible-role-postgresql/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/blackieops%2Fansible-role-postgresql/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/blackieops","download_url":"https://codeload.github.com/blackieops/ansible-role-postgresql/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/blackieops%2Fansible-role-postgresql/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":278708004,"owners_count":26031932,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-07T02:00:06.786Z","response_time":59,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ansible","ansible-role","pki","postgresql"],"created_at":"2025-01-02T06:17:01.759Z","updated_at":"2025-10-07T02:15:56.734Z","avatar_url":"https://github.com/blackieops.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# PostgreSQL Server Ansible Role\n\n[![Molecule Tests](https://github.com/blackieops/ansible-role-postgresql/actions/workflows/test.yml/badge.svg)](https://github.com/blackieops/ansible-role-postgresql/actions/workflows/test.yml)\n\nThis is an [Ansible] role that deploys a production-ready PostgreSQL server\nwith full support for certificate-based authentication and `verify-full`\nconnections.\n\n[Ansible]: https://ansible.com\n\n## Fully certificate-driven\n\nThis role bootstraps a self-signed root certificate authority, and handles the\nclient certificate and key generation for each configured Postgres role. This\nrole does not support disabling SSL, nor setting passwords for roles.\n\nIt is expected the clients for this server will use `verify-full` for their\n`sslmode`, and authenticate using their private key/certificate pair.\n\nIt is up to the administrator to download the client key material and\ncertificates from the PostgreSQL primary server and distribute them to the\nclients securely.\n\nAll key material and certificates is stored under `{{ pg_conf_dir }}/pki`,\nwhich varies by platform; check the OS-specific variable files to get the path\nfor your target.\n\n## Supported Platforms\n\nWe target the following platforms:\n\n* SUSE Enterprise Linux Server\n* Enterprise Linux (RHEL-derived)\n* Ubuntu (LTS)\n* Debian (Stable)\n\nWe only test and validate the latest long-term release of each platform, and\nhave no plans to expand to more platforms in the future.\n\n## Usage\n\nInstall the role by adding either the Ansible Galaxy package or Git remote to\nyour `requirements.yml`:\n\n```yaml\n# via Galaxy\n- role: blackieops.postgresql\n\n# or via Git\n- src: https://github.com/blackieops/ansible-role-postgresql.git\n```\n\nThen install it with `ansible-galaxy`:\n\n```\n$ ansible-galaxy install -r requirements.yml\n```\n\nFinally, you can reference the role in your playbooks:\n\n```yaml\n- hosts: postgresqls\n  roles:\n    - { role: blackieops.postgresql }\n```\n\n## Configuration\n\nCheck [the vars set in `defaults`][def] for an accounting and example of which\ntasks you can configure.\n\nGenerally, for a simple install, you'll want to minimally set:\n\n* `pg_hostname` to the FQDN of the server your clients will use to connect;\n* `pg_databases` to a list of database names to create;\n* `pg_roles` to a map of postgres roles to create, for example:\n  ```\n  - name: examplerolename\n    flags: NOSUPERUSER\n  ```\n* `pg_role_privs` to map the roles to the databases, for example:\n  ```\n  - db: exampledb\n    role: examplerolename\n    privs: ALL\n  ```\n\nSecurity-conscious administrators will likely also want to set\n`pg_listen_address` to the server's IP in a private subnet to restrict public\naccess, if a cloud/hardware firewall is not available.\n\n[def]: ./defaults/main.yml\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fblackieops%2Fansible-role-postgresql","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fblackieops%2Fansible-role-postgresql","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fblackieops%2Fansible-role-postgresql/lists"}