panxiao81andClaude Opus 5.5
0cd4a67e12
- 数据库主机上按实例运行 prometheus-community/postgres_exporter 0.20.1， 以实例 OS 用户走本地 socket，经 peer + ident 映射到仅有 pg_monitor 的 homelab_monitor 角色；无密码、不经 Bao。版本与官方 sha256sums.txt 同源。 - prod/dev 启用 pg_stat_statements；monitoring.yml 仅在未生效时 reload/重启 （prod 走 Patroni pending restart），重复执行 changed=0。 - 告警以上游 postgres_mixin 为底改写为 PrometheusRule，阈值对齐 Patroni failover lag 与 max_slot_wal_keep_size；抓取目标带 env 标签。 - Alertmanager 新增 env="dev" 路由到独立 dev 频道，dev SQL 检查告警补 env。 Co-Authored-By: Claude Opus 5.5 <[email protected]>
81 lines
2.6 KiB
YAML
81 lines
2.6 KiB
YAML
---
|
|
- name: 派生实例专用路径
|
|
ansible.builtin.set_fact:
|
|
pg_profile: "{{ pg_profiles[pg_instance] }}"
|
|
pg_config_dir: "{{ pg_config_root }}/{{ pg_instance }}"
|
|
pg_parent_dir: "{{ pg_data_root }}/{{ pg_instance }}"
|
|
pg_data_dir: "{{ pg_data_root }}/{{ pg_instance }}/data"
|
|
pg_socket_dir: "/run/homelab-postgresql-{{ pg_instance }}"
|
|
pg_member: "{{ inventory_hostname }}"
|
|
pg_credentials: "{{ hostvars['localhost'].pg_loaded_credentials[pg_instance] }}"
|
|
pg_etcd_credentials: "{{ hostvars['localhost'].pg_loaded_etcd }}"
|
|
no_log: true
|
|
- name: 创建实例操作系统组
|
|
ansible.builtin.group:
|
|
name: "{{ pg_profile.user }}"
|
|
system: true
|
|
- name: 创建实例操作系统账号
|
|
ansible.builtin.user:
|
|
name: "{{ pg_profile.user }}"
|
|
group: "{{ pg_profile.user }}"
|
|
home: "{{ pg_parent_dir }}"
|
|
create_home: false
|
|
shell: /bin/bash
|
|
system: true
|
|
- name: 创建隔离目录
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
owner: "{{ pg_profile.user }}"
|
|
group: "{{ pg_profile.user }}"
|
|
mode: '0700'
|
|
loop:
|
|
- "{{ pg_parent_dir }}"
|
|
- "{{ pg_data_dir }}"
|
|
- "{{ pg_socket_dir }}"
|
|
- "{{ pg_parent_dir }}/backup-lock"
|
|
- "{{ pg_parent_dir }}/backup-spool"
|
|
- name: 保持共享配置父目录可遍历，实例目录各自受限
|
|
ansible.builtin.file:
|
|
path: "{{ pg_config_root }}"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: '0755'
|
|
- name: 创建 root 管理的配置目录
|
|
ansible.builtin.file:
|
|
path: "{{ pg_config_dir }}"
|
|
state: directory
|
|
owner: root
|
|
group: "{{ pg_profile.user }}"
|
|
mode: '0750'
|
|
- name: 签发实例服务器证书
|
|
ansible.builtin.include_tasks: certificate.yml
|
|
vars:
|
|
pg_cert_name: server
|
|
pg_cert_cn: "{{ pg_profile.dns }}"
|
|
pg_cert_role: "homelab-pg-{{ pg_instance }}"
|
|
pg_cert_eku: [serverAuth]
|
|
- name: 签发 Patroni 独立无 CN 客户端证书
|
|
ansible.builtin.include_tasks: certificate.yml
|
|
vars:
|
|
pg_cert_name: etcd
|
|
pg_cert_cn: ''
|
|
pg_cert_role: homelab-etcd-client
|
|
pg_cert_eku: [clientAuth]
|
|
when: pg_instance == 'prod'
|
|
- name: 写入实例配置
|
|
ansible.builtin.template:
|
|
src: "{{ item }}.j2"
|
|
dest: "{{ pg_config_dir }}/{{ item }}"
|
|
owner: root
|
|
group: "{{ pg_profile.user }}"
|
|
mode: '0640'
|
|
loop: "{{ ['patroni.yml', 'pgbackrest.conf'] if pg_instance == 'prod' else ['postgresql.conf', 'pg_hba.conf', 'pg_ident.conf'] }}"
|
|
no_log: true
|
|
- name: 安装实例专用服务（不自动启动或重启）
|
|
ansible.builtin.template:
|
|
src: instance.service.j2
|
|
dest: "/etc/systemd/system/homelab-postgresql-{{ pg_instance }}.service"
|
|
mode: '0644'
|