feat: 纳管共享 etcd 与 k3s 外 PostgreSQL 高可用及备份

infrastructure/shared-postgresql/ansible/roles/pg_instance/tasks/main.yml

@@ -0,0 +1,80 @@
+---
+- name: 派生实例专用路径
+  ansible.builtin.set_fact:
+    pg_profile: "{{ pg_profiles[pg_instance] }}"
+    pg_config_dir: "{{ pg_config_root }}/{{ pg_instance }}"
+    pg_parent_dir: "{{ pg_data_root }}/{{ pg_instance }}"
+    pg_data_dir: "{{ pg_data_root }}/{{ pg_instance }}/data"
+    pg_socket_dir: "/run/homelab-postgresql-{{ pg_instance }}"
+    pg_member: "{{ inventory_hostname }}"
+    pg_credentials: "{{ hostvars['localhost'].pg_loaded_credentials[pg_instance] }}"
+    pg_etcd_credentials: "{{ hostvars['localhost'].pg_loaded_etcd }}"
+  no_log: true
+- name: 创建实例操作系统组
+  ansible.builtin.group:
+    name: "{{ pg_profile.user }}"
+    system: true
+- name: 创建实例操作系统账号
+  ansible.builtin.user:
+    name: "{{ pg_profile.user }}"
+    group: "{{ pg_profile.user }}"
+    home: "{{ pg_parent_dir }}"
+    create_home: false
+    shell: /bin/bash
+    system: true
+- name: 创建隔离目录
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ pg_profile.user }}"
+    group: "{{ pg_profile.user }}"
+    mode: '0700'
+  loop:
+    - "{{ pg_parent_dir }}"
+    - "{{ pg_data_dir }}"
+    - "{{ pg_socket_dir }}"
+    - "{{ pg_parent_dir }}/backup-lock"
+    - "{{ pg_parent_dir }}/backup-spool"
+- name: 保持共享配置父目录可遍历，实例目录各自受限
+  ansible.builtin.file:
+    path: "{{ pg_config_root }}"
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+- name: 创建 root 管理的配置目录
+  ansible.builtin.file:
+    path: "{{ pg_config_dir }}"
+    state: directory
+    owner: root
+    group: "{{ pg_profile.user }}"
+    mode: '0750'
+- name: 签发实例服务器证书
+  ansible.builtin.include_tasks: certificate.yml
+  vars:
+    pg_cert_name: server
+    pg_cert_cn: "{{ pg_profile.dns }}"
+    pg_cert_role: "homelab-pg-{{ pg_instance }}"
+    pg_cert_eku: [serverAuth]
+- name: 签发 Patroni 独立无 CN 客户端证书
+  ansible.builtin.include_tasks: certificate.yml
+  vars:
+    pg_cert_name: etcd
+    pg_cert_cn: ''
+    pg_cert_role: homelab-etcd-client
+    pg_cert_eku: [clientAuth]
+  when: pg_instance == 'prod'
+- name: 写入实例配置
+  ansible.builtin.template:
+    src: "{{ item }}.j2"
+    dest: "{{ pg_config_dir }}/{{ item }}"
+    owner: root
+    group: "{{ pg_profile.user }}"
+    mode: '0640'
+  loop: "{{ ['patroni.yml', 'pgbackrest.conf'] if pg_instance == 'prod' else ['postgresql.conf', 'pg_hba.conf'] }}"
+  no_log: true
+- name: 安装实例专用服务（不自动启动或重启）
+  ansible.builtin.template:
+    src: instance.service.j2
+    dest: "/etc/systemd/system/homelab-postgresql-{{ pg_instance }}.service"
+    mode: '0644'