Skip to content
Extraits de code Groupes Projets
Valider dcbe8a7a rédigé par Théo - Le Filament's avatar Théo - Le Filament
Parcourir les fichiers

feat: allow access to database with a read-only user

parent 118c4922
Aucune branche associée trouvée
Aucune étiquette associée trouvée
Aucune requête de fusion associée trouvée
......@@ -456,47 +456,45 @@
# --------------------------------------------------
# Postgres Readonly user
# --------------------------------------------------
# - name: Postgres Read-only user
# tags:
# - "db_remote_ro_user"
# when: item.value.odoo_remote_db_access | default(false)
# block:
# - name: Allow readonly user connection to prod db (with userns_remap)
# when: docker_userns_remap
# ansible.builtin.blockinfile:
# path: "/var/lib/docker/{{ dockremap_subuid }}.{{ dockremap_subgid }}/volumes/{{ item.key }}_db/_data/pg_hba.conf"
# block: |
# host {{ item.value.db }} {{ odoo_instances[item.value.prod_instance | default(item.key)].db_user }} 172.16.0.0/12 md5
# host postgres {{ odoo_instances[item.value.prod_instance | default(item.key)].db_user }} 172.16.0.0/12 md5
# host {{ item.value.db }} {{ item.value.odoo_db_rouser }} all md5
# - name: PROD Allow readonly user connection to prod db (no userns_remap)
# when: not docker_userns_remap
# ansible.builtin.blockinfile:
# path: /var/lib/docker/volumes/{{ item.key }}_db/_data/pg_hba.conf
# block: |
# host {{ item.value.db }} {{ odoo_instances[item.value.prod_instance | default(item.key)].db_user }} 172.16.0.0/12 md5
# host postgres {{ odoo_instances[item.value.prod_instance | default(item.key)].db_user }} 172.16.0.0/12 md5
# host {{ item.value.db }} {{ item.value.odoo_db_rouser }} all md5
# - name: PROD Disable access all rights (with userns_remap)
# when: docker_userns_remap
# ansible.builtin.lineinfile:
# name: "/var/lib/docker/{{ dockremap_subuid }}.{{ dockremap_subgid }}/volumes/{{ item.key }}_db/_data/pg_hba.conf"
# regexp: "^host all all all md5"
# line: "#host all all all md5"
# - name: PROD Disable access all rights (no userns_remap)
# when: not docker_userns_remap
# ansible.builtin.lineinfile:
# name: /var/lib/docker/volumes/{{ item.key }}_db/_data/pg_hba.conf
# regexp: "^host all all all md5"
# line: "#host all all all md5"
# TODO: add restart db container
- name: "Allow readonly user connection to prod db"
tags:
- "db_remote_ro_user"
vars:
pg_hba_path: "/var/lib/docker{{ '/' + (dockremap_subuid | string) + '.' + (dockremap_subgid | string) if docker_userns_remap else '' }}/volumes/{{ odoo_instance.key }}_db/_data/pg_hba.conf"
ansible.builtin.blockinfile:
path: "{{ pg_hba_path }}"
block: |
host {{ odoo_instance.value.db }} {{ odoo_instances[odoo_instance.value.prod_instance | default(odoo_instance.key)].db_user }} 172.16.0.0/12 md5
host {{ odoo_instance.value.db }} {{ odoo_instances[odoo_instance.value.prod_instance | default(odoo_instance.key)].db_user }} 192.168.0.0/16 md5
host postgres {{ odoo_instances[odoo_instance.value.prod_instance | default(odoo_instance.key)].db_user }} 172.16.0.0/12 md5
host postgres {{ odoo_instances[odoo_instance.value.prod_instance | default(odoo_instance.key)].db_user }} 192.168.0.0/16 md5
host {{ odoo_instance.value.db }} {{ odoo_instance.value.odoo_db_rouser }} all md5
loop: "{{ odoo_instances | dict2items }}"
loop_control:
label: "{{ odoo_instance.key }}"
when: >
test_instance_is_prod
and test_instance_is_selected
and odoo_instance.value.odoo_remote_db_access | default(false)
- name: "Disable access all rights to prod db"
tags:
- "db_remote_ro_user"
vars:
pg_hba_path: "/var/lib/docker{{ '/' + (dockremap_subuid | string) + '.' + (dockremap_subgid | string) if docker_userns_remap else '' }}/volumes/{{ odoo_instance.key }}_db/_data/pg_hba.conf"
ansible.builtin.lineinfile:
name: "{{ pg_hba_path }}"
regexp: "^host all all all md5"
line: "#host all all all md5"
loop: "{{ odoo_instances | dict2items }}"
loop_control:
label: "{{ odoo_instance.key }}"
when: >
test_instance_is_prod
and test_instance_is_selected
and odoo_instance.value.odoo_remote_db_access | default(false)
# TODO: add restart db container
# --------------------------------------------------
# Remote imports section
......
0% Chargement en cours ou .
You are about to add 0 people to the discussion. Proceed with caution.
Veuillez vous inscrire ou vous pour commenter