feat: add metabase role

2026-06-03 10:01:00 +02:00
parent d976a9d701
commit 2f3eebd422
8 changed files with 296 additions and 0 deletions
@@ -0,0 +1,130 @@
+---
+- name: Validate required passwords are set
+  ansible.builtin.assert:
+    that:
+      - metabase_postgres_password is defined
+      - metabase_postgres_password | length >= 12
+    fail_msg: |
+      metabase_postgres_password is required (min 12 chars).
+      See roles/metabase/defaults/main.yml for configuration instructions.
+    success_msg: "Password validation passed"
+
+- name: Create PostgreSQL database for Metabase
+  community.postgresql.postgresql_db:
+    name: "{{ metabase_postgres_db_name }}"
+    owner: "{{ metabase_postgres_user }}"
+    state: present
+  become: false
+  become_user: "{{ postgres_admin_user | default('postgres') }}"
+
+- name: Create PostgreSQL user for Metabase
+  community.postgresql.postgresql_user:
+    name: "{{ metabase_postgres_user }}"
+    password: "{{ metabase_postgres_password }}"
+    state: present
+  become: false
+  become_user: "{{ postgres_admin_user | default('postgres') }}"
+
+- name: Grant all privileges on database to Metabase user
+  community.postgresql.postgresql_privs:
+    login_db: "{{ metabase_postgres_db_name }}"
+    roles: "{{ metabase_postgres_user }}"
+    type: database
+    privs: ALL
+    state: present
+  become: false
+  become_user: "{{ postgres_admin_user | default('postgres') }}"
+
+- name: Ensure Metabase user has no superuser privileges
+  community.postgresql.postgresql_user:
+    name: "{{ metabase_postgres_user }}"
+    role_attr_flags: NOSUPERUSER,NOCREATEDB,NOCREATEROLE
+    state: present
+  become: false
+  become_user: "{{ postgres_admin_user | default('postgres') }}"
+
+- name: Create Metabase project directory
+  ansible.builtin.file:
+    path: "{{ podman_projects_dir }}/metabase"
+    state: directory
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: "0755"
+
+- name: Pull Metabase container image
+  ansible.builtin.command: "podman pull {{ metabase_image }}:{{ metabase_version }}"
+  register: pull_result
+  changed_when: pull_result.stdout is search('Writing manifest')
+  become: false
+  become_user: "{{ ansible_user }}"
+
+- name: Deploy Kubernetes YAML for Metabase
+  ansible.builtin.template:
+    src: metabase.yaml.j2
+    dest: "{{ podman_projects_dir }}/metabase/metabase.yaml"
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: "0644"
+  notify: Restart Metabase
+
+- name: Get home directory for {{ ansible_user }}
+  ansible.builtin.getent:
+    database: passwd
+    key: "{{ ansible_user }}"
+
+- name: Set user home directory fact
+  ansible.builtin.set_fact:
+    user_home_dir: "{{ ansible_facts['getent_passwd'][ansible_user][4] }}"
+
+- name: Create systemd user directory for Metabase
+  ansible.builtin.file:
+    path: "{{ user_home_dir }}/.config/systemd/user"
+    state: directory
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: "0755"
+
+- name: Deploy systemd service for Metabase (user scope)
+  ansible.builtin.template:
+    src: metabase.service.j2
+    dest: "{{ user_home_dir }}/.config/systemd/user/metabase.service"
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: "0644"
+  notify: Reload systemd user
+
+- name: Enable lingering for user {{ ansible_user }}
+  ansible.builtin.command: "loginctl enable-linger {{ ansible_user }}"
+  when: ansible_user != 'root'
+
+- name: Enable and start Metabase service (user scope)
+  ansible.builtin.systemd:
+    name: metabase.service
+    enabled: true
+    state: started
+    scope: user
+  become: false
+  become_user: "{{ ansible_user }}"
+
+- name: Provision TLS certificate for Metabase
+  ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml"
+  vars:
+    certbot_hostname: "{{ metabase_nginx_hostname }}"
+  when: metabase_nginx_enabled
+
+- name: Deploy nginx vhost configuration for Metabase
+  ansible.builtin.template:
+    src: nginx-vhost.conf.j2
+    dest: "{{ nginx_conf_dir | default('/etc/nginx/conf.d') }}/metabase.conf"
+    owner: root
+    group: root
+    mode: "0644"
+  when: metabase_nginx_enabled
+  notify: Reload nginx
+
+- name: Remove nginx vhost configuration for Metabase
+  ansible.builtin.file:
+    path: "{{ nginx_conf_dir | default('/etc/nginx/conf.d') }}/metabase.conf"
+    state: absent
+  when: not metabase_nginx_enabled
+  notify: Reload nginx