allow configurable Postgres authentication

defaults/main.yml

@@ -265,7 +265,9 @@ build_guides: false
 db:
   postgres:
     enabled: true
+    auth: scram-sha-256
     adminpass: DVn33dsth1s
+    adminuser: postgres
     name: dvndb
     host: localhost
     user: dvnuser

tasks/postgres.yml

@@ -109,14 +109,20 @@
 - meta: flush_handlers
 
 - name: dataverse python installer wants to be a postgres admin
-  postgresql_user:
-    name: postgres
+  community.postgresql.postgresql_user:
+    db: postgres
+    login_user: '{{ db.postgres.adminuser }}'
+    name: '{{ db.postgres.adminuser }}'
     password: '{{ db.postgres.adminpass }}'
+  become: true
+  become_user: postgres
   when: db.use_rds == false
 
 - name: create dataverse postgres database
   postgresql_db:
     name: '{{ db.postgres.name }}'
+  become: true
+  become_user: postgres
   when: db.use_rds == false
 
 - name: create dataverse postgres user, set permissions
@@ -125,6 +131,8 @@
     name: '{{ db.postgres.user }}'
     password: '{{ db.postgres.pass }}'
     role_attr_flags: 'NOSUPERUSER,CREATEDB,CREATEROLE,INHERIT,LOGIN'
+  become: true
+  become_user: postgres
   when: db.use_rds == false
 
 - name: postgresql 15 requires explicit permissions on public schema
@@ -134,6 +142,9 @@
     type: schema
     objs: public
     role: '{{ db.postgres.user }}'
+  become: true
+  become_user: postgres
+  when: db.use_rds == false
 
 - ansible.builtin.import_tasks: postgres_sequential_identifiers.yml
   when: dataverse.api.test_suite == true

templates/pg_hba.conf.j2

@@ -1,19 +1,19 @@
 # "local" is for Unix domain socket connections only
-local   all             all                                     trust
+local   all             all                                     peer
 # IPv4 local connections:
-host    all             all             127.0.0.1/32            password
+host    all             all             127.0.0.1/32            {{ db.postgres.auth }}
 # IPv6 local connections:
-host    all             all             ::1/128                 password
+host    all             all             ::1/128                 {{ db.postgres.auth }}
 
 # replication and dataverse access from other servers
 {% if db.postgres.replication.enabled is defined %}
 {% for item in db.postgres.replication.servers %}
 {% if item | regex_search(".*/.*") %}
-host    all             all        {{ item }}      md5
-host    replication     rep        {{ item }}      md5
+host    all             all        {{ item }}      {{ db.postgres.auth }}
+host    replication     rep        {{ item }}      {{ db.postgres.auth }}
 {% else %}
-host    all             all        {{ item }}/32      md5
-host    replication     rep        {{ item }}/32      md5
+host    all             all        {{ item }}/32      {{ db.postgres.auth }}
+host    replication     rep        {{ item }}/32      {{ db.postgres.auth }}
 {% endif %}
 {% endfor %}
 {% endif %}

tests/group_vars/jenkins.yml

@@ -256,6 +256,8 @@ db:
   postgres:
     enabled: true
     adminpass: DVn33dsth1s
+    adminuser: postgres
+    auth: scram-sha-256
     name: dvndb
     host: localhost
     user: dvnuser

tests/group_vars/memorytests.yml

@@ -258,6 +258,8 @@ db:
   postgres:
     enabled: true
     adminpass: DVn33dsth1s
+    adminuser: postgres
+    auth: scram-sha-256
     name: dvndb
     host: localhost
     user: dvnuser

tests/group_vars/vagrant.yml

@@ -260,6 +260,8 @@ build_guides: false
 db:
   postgres:
     enabled: true
+    auth: scram-sha-256
+    adminuser: postgres
     adminpass: DVn33dsth1s
     name: vagrantdb
     host: localhost