diff options
| author | Mitch Riedstra <mitch@riedstra.us> | 2019-10-03 18:52:48 -0400 |
|---|---|---|
| committer | Mitch Riedstra <mitch@riedstra.us> | 2019-10-03 18:52:48 -0400 |
| commit | 5725d926f9ef7bc750f6b09bf67b33aa3e033a6f (patch) | |
| tree | f174800b75b3e12ce1ce4e4e3b48077aa21bdb6a | |
| parent | 6a0aa89e3dfd7bd0755b67931532eaa173f73919 (diff) | |
| download | alpine-postgres-5725d926f9ef7bc750f6b09bf67b33aa3e033a6f.tar.gz alpine-postgres-5725d926f9ef7bc750f6b09bf67b33aa3e033a6f.tar.xz | |
Write out pgpass, also document how to secure the database for production use
| -rw-r--r-- | defaults/main.yml | 3 | ||||
| -rw-r--r-- | readme.md | 21 | ||||
| -rw-r--r-- | tasks/main.yml | 6 |
3 files changed, 30 insertions, 0 deletions
diff --git a/defaults/main.yml b/defaults/main.yml index 8b13789..159b40b 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -1 +1,4 @@ +# postgres_pgpass: | +# # hostname:port:database:username:password +# *:*:*:postgres:my super secret password @@ -3,3 +3,24 @@ Ideally used in conjunction with my Alpine Linux playbook, though it shouldn't be hard to adapt it to other systems. + + +Securing your postgres installation should go as follows: + +``` +root@alpine-dev /root # psql -U postgres +psql (11.5) +Type "help" for help. + +postgres=# \password +Enter new password: +Enter it again: +postgres=# \q +root@alpine-dev /root # sv down postgres +root@alpine-dev /root # sed -i.bak -e's/trust$/md5/g' /var/postgres/pg_hba.conf +``` + +Ideally add the password to your `~/.pgpass` if you're going to do +backups from cron or similar. This can be done by defining `postgres_pgpass` +as found commented out in `defaults/main.yml` + diff --git a/tasks/main.yml b/tasks/main.yml index 7b67816..dd3dd98 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -26,3 +26,9 @@ src: /etc/sv/postgres dest: /var/service/postgres follow: false +- name: Write pgpass for 'root' + copy: + content: '{{postgres_pgpass}}' + dest: '/root/.pgpass' + mode: '0600' + when: postgres_pgpass is defined |