Clément Désiles
aa78e238aa
- nginx: nginx-prometheus-exporter gated by nginx_exporter_enabled, deploys loopback-only stub_status (8090), exporter on 9113 - postgres: postgres_exporter gated by postgres_exporter_enabled, creates postgres_exporter role with pg_monitor, exporter on 9187 - valkey: redis_exporter gated by valkey_exporter_enabled, adds read-only ACL user to users.acl, exporter on 9121 Each exporter follows the nut pattern (tasks/exporter.yml included from main.yml, OS vars, 0600 secret env files, password asserts).
62 lines
2.3 KiB
YAML
62 lines
2.3 KiB
YAML
---
|
|
# PostgreSQL port
|
|
postgres_port: 5432
|
|
|
|
# PostgreSQL admin user (only for database management)
|
|
postgres_admin_user: postgres
|
|
|
|
# PostgreSQL admin password (REQUIRED - must be set explicitly)
|
|
# Set via inventory, host_vars, or ansible-vault
|
|
# postgres_admin_password: ""
|
|
|
|
# PostgreSQL data directory
|
|
postgres_data_dir: /var/lib/postgres/data
|
|
|
|
# Binding address(es)
|
|
# example: postgres_bind: "127.0.0.1,10.89.0.1"
|
|
postgres_bind: "127.0.0.1"
|
|
|
|
# Firewall configuration
|
|
postgres_firewall_allowed_sources:
|
|
- 127.0.0.0/8
|
|
|
|
# Performance tuning (adjust based on your hardware)
|
|
postgres_shared_buffers: 256MB
|
|
postgres_effective_cache_size: 1GB
|
|
postgres_maintenance_work_mem: 64MB
|
|
postgres_work_mem: 4MB
|
|
postgres_max_connections: 100
|
|
|
|
# Logging configuration
|
|
# Backend: 'journald' (systemd journal) or 'file' (traditional log files)
|
|
postgres_log_backend: journald
|
|
|
|
# Logging settings (apply to both backends)
|
|
postgres_log_min_duration_statement: -1 # -1 disables, 0 logs all, >0 logs slow queries (ms)
|
|
postgres_log_line_prefix: "%m [%p] %q%u@%d " # timestamp [pid] user@database
|
|
postgres_log_timezone: UTC
|
|
|
|
# File backend settings (only used when postgres_log_backend: file)
|
|
postgres_log_destination: stderr # stderr|csvlog|syslog
|
|
postgres_logging_collector: "on" # Enable log file collection
|
|
postgres_log_directory: log # Relative to data directory
|
|
postgres_log_filename: postgresql-%Y-%m-%d_%H%M%S.log
|
|
postgres_log_rotation_age: 1d # Rotate after this time (0 disables)
|
|
postgres_log_rotation_size: 100MB # Rotate after this size (0 disables)
|
|
postgres_log_truncate_on_rotation: "off" # Overwrite old log files with same name
|
|
|
|
# Logrotate configuration (only used when postgres_log_backend: file)
|
|
postgres_logrotate_rotate: 14 # Keep 14 days of logs
|
|
postgres_logrotate_frequency: daily # daily|weekly|monthly
|
|
postgres_logrotate_compress: true # Compress rotated logs
|
|
|
|
# Prometheus exporter (optional, via postgres_exporter)
|
|
# Creates its own minimal monitoring role (pg_monitor, no superuser).
|
|
postgres_exporter_enabled: false
|
|
postgres_exporter_listen_address: "127.0.0.1:9187"
|
|
postgres_exporter_user: postgres_exporter
|
|
# postgres_exporter_password: "" # Intentionally undefined - required when enabled
|
|
postgres_exporter_pg_host: "127.0.0.1"
|
|
postgres_exporter_pg_port: "{{ postgres_port }}"
|
|
postgres_exporter_pg_dbname: postgres
|