postgres: Add Commvault backup compatibility

postgres/defaults/main.yml

@@ -2,3 +2,11 @@
 
 postgres_pgdg_repo: false
 postgres_rsnapshot: false
+postgres_commvault_compat: false
+
+postgres_versions_debian:
+  buster: "11"
+  bullseye: "13"
+  bookworm: "14"
+
+postgres_version: "{{ postgres_versions_debian[ansible_distribution_release] }}"

postgres/handlers/main.yml

+---
+
+- name: Restart Postgres
+  systemd:
+    name: postgresql.service
+    state: restarted

postgres/tasks/main.yml

@@ -17,8 +17,7 @@
 - name: ensure postgres packages are installed
   apt:
     name:
-      # yamllint disable-line rule:line-length
-      - postgresql{{ "-{}".format(postgres_version) if postgres_version is defined }}
+      - postgresql-{{ postgres_version }}
       - python3-psycopg2
       - libpq-dev
     state: present
@@ -41,6 +40,7 @@
   block:
     - name: ensure we have our postgres backup script
       copy:
+        # yamllint disable-line rule:line-length
         src: "pgbackup{{ '-bullseye' if ansible_distribution_major_version|int(default=99) > 10 else '' }}.sh"
         dest: /usr/local/bin/pgbackup.sh
         owner: root
@@ -59,3 +59,50 @@
       file:
         path: /etc/cron.d/postgres-snapshot
         state: absent
+
+- name: Configure Commvault backup compatibility
+  when: postgres_commvault_compat
+  block:
+    - name: Create WAL backup directory
+      file:
+        path: /var/backups/pg_wal
+        state: directory
+        owner: postgres
+        group: postgres
+        mode: '0750'
+
+    - name: Configure Postgres WAL archive
+      postgresql_set:
+        name: "{{ item.name }}"
+        value: "{{ item.value }}"
+      loop:
+        - name: archive_mode
+          value: "on"
+        - name: archive_command
+          value: 'cp %p /var/backups/pg_wal/%f'
+
+    - name: Configure Postgres ident mappings
+      blockinfile:
+        path: /etc/postgresql/{{ postgres_version }}/main/pg_ident.conf
+        insertafter: '^# MAPNAME\s+SYSTEM-USERNAME\s+PG-USERNAME$'
+        block: '{{ lookup("template", "pg_ident.j2") }}'
+      vars:
+        postgres_ident_mappings:
+          - mapname: postgres
+            system_username: postgres
+            pg_username: postgres
+          - mapname: postgres
+            system_username: root
+            pg_username: postgres
+      notify:
+        - Restart Postgres
+
+    - name: Configure Postgres to use ident mapping for postgres role
+      postgresql_pg_hba:
+        dest: /etc/postgresql/{{ postgres_version }}/main/pg_hba.conf
+        contype: local
+        users: postgres
+        method: peer
+        options: map=postgres
+      notify:
+        - Restart Postgres

postgres/templates/pg_ident.j2

+{% for i in postgres_ident_mappings %}
+{{ "{mapname:15} {system_username:23} {pg_username}".format(**i) }}
+{% endfor %}