Set up redis jail, improve role setup

6 files changed, 49 insertions, 9 deletions

diff --git a/roles/jails/01_ingress/tasks/main.yml b/roles/jails/01_ingress/tasks/main.yml
index 5b56286..8248c3f 100644
--- a/roles/jails/01_ingress/tasks/main.yml
+++ b/roles/jails/01_ingress/tasks/main.yml
@@ -36,6 +36,7 @@
 
 - import_role:
     name: jail
+    tasks_from: jail_setup
 
 - name: Check if TLS certs exist
   stat:
@@ -47,3 +48,7 @@
   pause:
     prompt: "Run certbot manually in the ingress jail to obtain certs, then press Enter."
   when: is_prod and not (_certbot_certs.stat.exists | default(true))
+
+- import_role:
+    name: jail
+    tasks_from: jail_launch
diff --git a/roles/jails/02_postgres/defaults/main.yml b/roles/jails/02_postgres/defaults/main.yml
index a6ea7d9..ec54e55 100644
--- a/roles/jails/02_postgres/defaults/main.yml
+++ b/roles/jails/02_postgres/defaults/main.yml
@@ -8,7 +8,8 @@ jail_conf_options:
 pkg:
   - postgresql18-server
 
-services: []
+services:
+  - postgresql
 
 pg_users:
   - spliit
diff --git a/roles/jails/02_postgres/tasks/main.yml b/roles/jails/02_postgres/tasks/main.yml
index 12365d0..226e734 100644
--- a/roles/jails/02_postgres/tasks/main.yml
+++ b/roles/jails/02_postgres/tasks/main.yml
@@ -1,5 +1,6 @@
 - import_role:
     name: jail
+    tasks_from: jail_setup
 
 - name: Check if database is initialized
   stat:
@@ -10,11 +11,6 @@
   shell: /usr/local/etc/rc.d/postgresql initdb
   when: not _pg_data.stat.exists
 
-- name: Enable postgresql
-  community.general.sysrc:
-    name: postgresql_enable
-    value: "YES"
-
 - name: Allow LAN connections in pg_hba.conf
   lineinfile:
     path: /var/db/postgres/data18/pg_hba.conf
@@ -29,14 +25,16 @@
     regexp: "^listen_addresses"
   notify: Restart postgresql
 
-- name: Flush handlers
-  meta: flush_handlers
+- import_role:
+    name: jail
+    tasks_from: jail_launch
 
 - name: Create database users
-  shell: "su -l postgres -c \"psql -tc \\\"SELECT 1 FROM pg_roles WHERE rolname='{{ item }}'\\\"\" | grep -q 1 || su -l postgres -c \"createuser {{ item }}\""
+  shell: "su -l postgres -c \"psql -tc \\\"SELECT 1 FROM pg_roles WHERE rolname='{{ item }}'\\\"\" | grep -q 1 || su -l postgres -c \"psql -c \\\"CREATE ROLE {{ item }} LOGIN PASSWORD '{{ pg_user_passwords[item] }}'\\\"\""
   loop: "{{ pg_users }}"
   register: _pg_user
   changed_when: "'CREATE ROLE' in _pg_user.stdout"
+  no_log: true
 
 - name: Create databases
   shell: "su -l postgres -c \"psql -tc \\\"SELECT 1 FROM pg_database WHERE datname='{{ item.name }}'\\\"\" | grep -q 1 || su -l postgres -c \"createdb -O {{ item.owner }} {{ item.name }}\""
diff --git a/roles/jails/09_redis/defaults/main.yml b/roles/jails/09_redis/defaults/main.yml
index 5416267..bb34d92 100644
--- a/roles/jails/09_redis/defaults/main.yml
+++ b/roles/jails/09_redis/defaults/main.yml
@@ -1 +1,7 @@
 userland: "15.0-RELEASE"
+
+pkg:
+  - valkey
+
+services:
+  - valkey
diff --git a/roles/jails/09_redis/handlers/main.yml b/roles/jails/09_redis/handlers/main.yml
new file mode 100644
index 0000000..0ad139c
--- /dev/null
+++ b/roles/jails/09_redis/handlers/main.yml
@@ -0,0 +1,4 @@
+- name: Restart valkey
+  service:
+    name: valkey
+    state: restarted
diff --git a/roles/jails/09_redis/tasks/main.yml b/roles/jails/09_redis/tasks/main.yml
index 2abdaff..9e79df1 100644
--- a/roles/jails/09_redis/tasks/main.yml
+++ b/roles/jails/09_redis/tasks/main.yml
@@ -1,2 +1,28 @@
 - import_role:
     name: jail
+    tasks_from: jail_setup
+
+- name: Configure bind address
+  lineinfile:
+    path: /usr/local/etc/valkey.conf
+    line: "bind * -::*"
+    regexp: "^bind "
+  notify: Restart valkey
+
+- name: Configure protected-mode
+  lineinfile:
+    path: /usr/local/etc/valkey.conf
+    line: "protected-mode yes"
+    regexp: "^protected-mode"
+  notify: Restart valkey
+
+- name: Configure requirepass
+  lineinfile:
+    path: /usr/local/etc/valkey.conf
+    line: "requirepass {{ valkey_password }}"
+    regexp: "^requirepass"
+  notify: Restart valkey
+
+- import_role:
+    name: jail
+    tasks_from: jail_launch