---
#--------------------------------------------------------------#
# PostgreSQL Database Superuser                 [pg_dbsu_create]
#--------------------------------------------------------------#
- name: create postgres dbsu
  become: true
  tags: [ pg_dbsu, pg_dbsu_create ]
  block:

    # uid = 26 (el rpm default) is already used by other user in debian system
    # so we'll use 543 as default pg_dbsu_uid for deb system if not explicitly set
    - name: use another default pg_dbsu_uid for deb system
      connection: local
      set_fact: { pg_dbsu_uid: 543 }
      when: os_package is defined and os_package == 'deb' and pg_dbsu_uid == 26

    # - dbsu user and group - #
    # the group name is always hard-coded name postgres
    # while the dbsu name is configurable, `postgres` is the default dbsu
    - name: create os group postgres
      group: name=postgres gid={{ pg_dbsu_uid }}
    - name: create postgres dbsu
      user: name={{ pg_dbsu }} uid={{ pg_dbsu_uid }} home={{ pg_dbsu_home }} group=postgres groups=postgres shell=/bin/bash generate_ssh_key=yes

#--------------------------------------------------------------#
# PostgreSQL Database Superuser                   [pg_dbsu_sudo]
#--------------------------------------------------------------#
# - dbsu privilege - #
# all    : require password to execute all sudo command! NOT RECOMMENDED!
# limit  : only allow sudo command with limited privilege! DEFAULT MODE!
# nopass : no password required to execute all sudo command! DANGEROUS!
- name: grant postgres dbsu sudo privilege
  tags: [ pg_dbsu, pg_dbsu_sudo ]
  copy:
    dest: /etc/sudoers.d/postgres
    mode: 0440
    content: |
      {% if pg_dbsu_sudo == 'nopass' %}postgres ALL=(ALL) NOPASSWD: ALL{% endif %}
      {% if pg_dbsu_sudo == 'all' %}postgres ALL=(ALL) ALL{% endif %}
      {% if pg_dbsu_sudo == 'limit' %}
      %postgres ALL=NOPASSWD: /sbin/modprobe softdog
      %postgres ALL=NOPASSWD: /bin/chown {{ pg_dbsu }} /dev/watchdog
      {% for svc in ['postgres', 'pgbouncer', 'patroni', 'pgbackrest', 'pg_exporter', 'pgbouncer_exporter',  'pgbackrest_exporter', 'vip-manager' ] %}
      %postgres ALL=NOPASSWD: /bin/systemctl stop {{ svc }}
      %postgres ALL=NOPASSWD: /bin/systemctl start {{ svc }}
      %postgres ALL=NOPASSWD: /bin/systemctl status {{ svc }}
      %postgres ALL=NOPASSWD: /bin/systemctl reload {{ svc }}
      %postgres ALL=NOPASSWD: /bin/systemctl restart {{ svc }}
      
      {% endfor %}
      %postgres ALL=NOPASSWD: /bin/systemctl reload haproxy
      {% endif %}

#--------------------------------------------------------------#
# Exchange SSH among PostgreSQL DBSU                    [pg_ssh]
#--------------------------------------------------------------#
- name: exchange postgres dbsu ssh keys
  become: true
  tags: [ pg_dbsu, pg_ssh ]
  block:

    # - dbsu ssh - #
    - name: config postgres dbsu ssh no host checking
      lineinfile:
        path: "{{ pg_dbsu_home }}/.ssh/config"
        regexp: '^StrictHostKeyChecking='
        line: StrictHostKeyChecking=no
        create: yes

    # postgres ssh-key exchange
    - name: fetch postgres dbsu public keys
      shell: cat {{ pg_dbsu_home }}/.ssh/id_rsa.pub
      register: dbsu_ssh_keys
      args: { executable: /bin/bash }

    # only exchange ssh keys among same pg cluster
    - name: exchange postgres dbsu ssh keys
      when: pg_dbsu_ssh_exchange|bool
      authorized_key: user={{ pg_dbsu }} key="{{ item[0] }}"
      ignore_errors: true
      delegate_to: "{{ item[1] }}"
      with_nested:
        - "{{ [dbsu_ssh_keys.stdout] }}"
        - "{{ groups[pg_cluster] }}"
...