Postgresql 11 role #449

FedericoCeratto · 2020-06-26T11:03:17Z

No description provided.

ansible/deploy-postgres-11.yml

hellais · 2020-06-30T10:17:59Z

ansible/roles/base-buster/tasks/main.yml

+
+- name: Clean cache
+  apt:
+    autoclean: yes


Do you think we should be adding in here also the creation of the accounts, like what dom0 is doing?

The bootstrap is quite different from dom0, maybe we can deploy new nodes with these new roles over the next months before starting to backport stuff (due to the risk of breaking live nodes).

So currently to deploy this, you would still have to run the dom0 bootstrap playbook on it?

Updated to create users

hellais · 2020-06-30T10:19:38Z

ansible/roles/postgresql11/tasks/main.yml

+      - /dev/xvde1
+      - /dev/xvdf1
+      - /dev/xvdg1
+      - /dev/xvdh1


Maybe, since these are about the specific disk setup of the particular ams-pg host, these should go outside of the postgresql11 role?

Active and standby DB hosts are pretty critical. I think it's safer to dedicate a role for a specific host (instead of having variables and conditionals that can cause unexpected changes on a host A while we are changing host B).

Makes sense, perhaps then the role name should contain the active/standby role in it?

hellais

Did another pass at reviewing. Let me know with inline comments if there are specific areas I should be focusing on.

hellais · 2020-07-03T09:36:07Z

ansible/roles/base-buster/tasks/main.yml

+
+- name: configure netdata nginx
+  blockinfile:
+    path: /etc/netdata/python.d/chrony.conf


Is this a typo, or is it normal that it’s writing to the same file?

hellais · 2020-07-03T09:37:54Z

ansible/roles/base-buster/tasks/main.yml

+    name: nftables.service
+    state: reloaded
+
+- name: configure netdata.service


Is there a reason to use blockinfile instead of file or template?

Better readability: we can scan through the task file and see what is being done.

hellais · 2020-07-03T09:39:38Z

ansible/roles/postgresql11/meta/main.yml

@@ -0,0 +1,4 @@
+---
+dependencies:


So the key here is that the role itself will specify the dependencies for other roles, correct?
I think this a reasonable approach, though we should probably document this architecture/pattern somewhere as it might not be immediately obvious this is how roles should be written from now on.

hellais · 2020-07-03T09:40:41Z

ansible/roles/prometheus/templates/prometheus.yml.j2

@@ -51,7 +51,7 @@ scrape_configs:
      module: [{{ bbjob.module }}]
    static_configs:
      - targets:
-{% for target in bbjob.targets %}
+{% for target in (bbjob.targets|sort) %}


Was the sort added to make the diff more deterministic? I am surprised that ansible did not do it automatically.

Yes the first, no to the latter: the diff was random every time

hellais · 2020-07-03T09:41:38Z

ansible/roles/prometheus/templates/prometheus.yml.j2

+      format: [prometheus]
+    static_configs:
+      - targets:
+        - ams-pg.ooni.nu:9187


What is the difference between these two netadata endpoints and the ones that have_netdata?

hellais · 2020-07-03T09:43:34Z

ansible/roles/base-buster/meta/main.yml

@@ -0,0 +1,8 @@
+---
+dependencies:
+  - role: track_etc_directory


Maybe this is a bit too much indirection? Can we put the content of this in the role directly for the time being and abstract it when N > 1 roles need to depend on this and not the base one?

base-buster and letsencrypt already both depend on it (and don't depend on each other)

hellais · 2020-07-03T09:45:10Z

ansible/roles/nginx-buster/templates/nginx.conf

@@ -0,0 +1,101 @@
+
+# Managed by ansible
+# roles/nginx-buster/templates/nginx.conf


Where is this role being included?

FedericoCeratto requested a review from hellais June 26, 2020 11:03

FedericoCeratto changed the base branch from master to certbot-377 June 26, 2020 11:03

FedericoCeratto force-pushed the postgresql11 branch from 363588f to 1fee3d5 Compare June 29, 2020 17:01

hellais reviewed Jun 30, 2020

View reviewed changes

ansible/deploy-postgres-11.yml Show resolved Hide resolved

hellais reviewed Jun 30, 2020

View reviewed changes

hellais reviewed Jul 3, 2020

View reviewed changes

FedericoCeratto force-pushed the certbot-377 branch from 1de5815 to c010bd4 Compare July 7, 2020 12:50

Base automatically changed from certbot-377 to master July 7, 2020 12:56

Federico Ceratto added 8 commits July 7, 2020 14:03

Add PostgreSQL 11 role, nginx-buster, base-buster

aa15e61

Fix APT conf

8b1025a

Add APT sources

cbc5cb0

Setup pg host

ec47537

Setup nftables

fabdc7c

Remove and reset smartd

80ee261

Improve monitoring

48c48f1

Minor cleanup

dda26af

FedericoCeratto force-pushed the postgresql11 branch from 5ad8345 to dda26af Compare July 7, 2020 13:03

Federico Ceratto added 10 commits July 15, 2020 16:12

Add comments

31a9864

Create users

d570058

Install ncdu

537e8f1

Trust localhost IPv4 access on postgresql

9b2c66a

Comment out unused plugin

6d3542e

Accept incoming TCP traffic to ams-pg

bb51bd9

Fix dir name

444eea6

Add temporary pg11 config file

12a8254

Listen on all interfaces

e926cd1

Deploy pg_hba.conf

64e3e8f

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Postgresql 11 role #449

Postgresql 11 role #449

FedericoCeratto commented Jun 26, 2020

hellais Jun 30, 2020

FedericoCeratto Jul 2, 2020

hellais Jul 3, 2020

FedericoCeratto Jul 15, 2020

hellais Jun 30, 2020

FedericoCeratto Jul 2, 2020

hellais Jul 3, 2020

hellais left a comment

hellais Jul 3, 2020

hellais Jul 3, 2020

FedericoCeratto Jul 7, 2020

hellais Jul 3, 2020

hellais Jul 3, 2020

FedericoCeratto Jul 15, 2020

hellais Jul 3, 2020

hellais Jul 3, 2020

FedericoCeratto Jul 7, 2020 •

edited

Loading

hellais Jul 3, 2020

		@@ -0,0 +1,101 @@

		# Managed by ansible
		# roles/nginx-buster/templates/nginx.conf

		@@ -0,0 +1,4 @@
		---
		dependencies:

Postgresql 11 role #449

Are you sure you want to change the base?

Postgresql 11 role #449

Conversation

FedericoCeratto commented Jun 26, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hellais left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

FedericoCeratto Jul 7, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

FedericoCeratto Jul 7, 2020 •

edited

Loading