feat: add SUSE/openSUSE support#172
Open
HVSharma12 wants to merge 2 commits intolinux-system-roles:mainfrom
Open
feat: add SUSE/openSUSE support#172HVSharma12 wants to merge 2 commits intolinux-system-roles:mainfrom
HVSharma12 wants to merge 2 commits intolinux-system-roles:mainfrom
Conversation
Reviewer's GuideAdds SUSE/openSUSE support to the PostgreSQL system role by introducing SUSE-specific vars, handling absence of postgresql-setup via direct initdb calls, generalizing certificate paths/permissions, and updating tests and metadata accordingly. Flow diagram for database initialization task selectiongraph TD
Start[Start: PostgreSQL role runs] --> CheckConf[Check if postgresql.conf exists]
CheckConf -->|exists| SkipInit[Skip initdb tasks]
CheckConf -->|missing| CheckBooted[Check __postgresql_is_booted]
CheckBooted -->|booted true| CheckSetupBooted[Check __postgresql_has_setup_cmd]
CheckBooted -->|booted false| CheckSetupNonBooted[Check __postgresql_has_setup_cmd]
CheckSetupBooted -->|true| BootedWithSetup[Task: Init DB on booted systems with postgresql-setup]
CheckSetupBooted -->|false| BootedWithoutSetup[Task: Init DB on booted systems without postgresql-setup using initdb]
CheckSetupNonBooted -->|true| NonBootedWithSetup[Task: Init DB on non-booted systems with patched postgresql-setup]
CheckSetupNonBooted -->|false| NonBootedWithoutSetup[Task: Init DB on non-booted systems without postgresql-setup using initdb]
BootedWithSetup --> End[postgresql.conf created]
BootedWithoutSetup --> End
NonBootedWithSetup --> End
NonBootedWithoutSetup --> End
SkipInit --> End
Flow diagram for certificate installation and permissionsgraph TD
Start[Start: Certificate tasks] --> DefaultDir[Set __postgresql_cert_directory]
DefaultDir --> LinkCert[Create link for server certificate]
LinkCert --> EnsurePrivDir[Ensure private key directory is traversable]
EnsurePrivDir --> CheckNameType[Check if certificate name is absolute]
CheckNameType -->|not abs| EnsureKeyPerms[Ensure private key owned by postgres and mode 0600]
CheckNameType -->|abs| SkipKeyPerms[Skip ownership and mode adjustment]
EnsureKeyPerms --> LinkKey[Create link for server key from cert_directory private]
SkipKeyPerms --> LinkKey
LinkKey --> End[Certificate and key linked with correct permissions]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue, and left some high level feedback:
- The new initdb tasks for booted/non-booted systems with and without postgresql-setup are nearly identical; consider consolidating them (e.g. via a single task with conditional command or a small include) to reduce duplication and keep the init logic in one place.
- In tests_custom_certificate.yml, the certificate name path is defined as
"{{ __postgresql_cert_directory }}//certs/postgresql_test"(double slash); this is likely unintended and should be normalized to a single/for consistency with other usages. - For the
initdbcommand invocations, consider quoting{{ __postgresql_data_dir }}in thecmdargument to avoid potential issues if the data directory path ever contains spaces or shell-special characters.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The new initdb tasks for booted/non-booted systems with and without postgresql-setup are nearly identical; consider consolidating them (e.g. via a single task with conditional command or a small include) to reduce duplication and keep the init logic in one place.
- In tests_custom_certificate.yml, the certificate name path is defined as `"{{ __postgresql_cert_directory }}//certs/postgresql_test"` (double slash); this is likely unintended and should be normalized to a single `/` for consistency with other usages.
- For the `initdb` command invocations, consider quoting `{{ __postgresql_data_dir }}` in the `cmd` argument to avoid potential issues if the data directory path ever contains spaces or shell-special characters.
## Individual Comments
### Comment 1
<location path="tasks/certificate.yml" line_range="24-27" />
<code_context>
owner: postgres
when: (postgresql_certificates | first)['name'] is not abs
+ - name: Ensure private key directory is traversable
+ file:
+ path: "{{ __postgresql_cert_directory }}/private"
+ mode: "o+x"
+
+ - name: Ensure private key is readable by postgres
</code_context>
<issue_to_address>
**🚨 issue (security):** Relaxing directory permissions with `mode: "o+x"` may be overly permissive for a private key directory.
This makes the key directory traversable by every local user, which is broader access than is appropriate for private key material. If you only need `postgres` to traverse it, consider restricting to owner/group (e.g. `u+rx,g+rx,o-x`) and ensuring `postgres` is in the right group, or use ACLs to grant access specifically to `postgres` instead of `others`.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
richm
reviewed
Mar 9, 2026
| - name: ansible.posix | ||
| - name: fedora.linux_system_roles | ||
| - name: community.general | ||
| version: '>=6.6.0,<12.0.0' |
Contributor
There was a problem hiding this comment.
richm
reviewed
Mar 9, 2026
| vars: | ||
| postgresql_password: redhat | ||
| block: | ||
| - name: Load postgresql role platform variables |
Contributor
There was a problem hiding this comment.
The best way to get vars from the role into the test is to use include_role with tasks_from: set_vars.yml:
- name: Load postgresql role platform variables
include_role:
name: linux-system-roles.postgresql
tasks_from: set_vars.yml
public: trueThis will also get __postgresql_is_ostree and __postgresql_is_booted
spetrosi
reviewed
Mar 9, 2026
| # this is tricky: postgresql-setup calls `systemctl` to query the unit file and | ||
| # state, but that doesn't work in container build environments; so patch them | ||
| # out and replace with static values | ||
| - name: Init DB on non-booted systems |
Contributor
There was a problem hiding this comment.
Suggested change
| - name: Init DB on non-booted systems | |
| - name: Init DB on non-booted systems (with postgresql-setup) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Enhancement: add support for SUSE/openSUSE
Reason: The role fails with "command not found" when trying to initialize the database on SUSE.
Result: Role now works for SLES 15.6+/16 and leap 15.6+/16
Issue Tracker Tickets (Jira or BZ if any): na
Summary by Sourcery
Add SUSE and openSUSE compatibility to the PostgreSQL system role, including database initialization and SSL certificate handling adjustments.
New Features:
Enhancements:
Tests: