01_init.yml

---
- name: "✅ Assert correct context"
  ansible.builtin.assert:
    that:
      - application_id == 'svc-db-postgres'
      - database_consumer_id != 'svc-db-postgres'

- name: 📐 Normalize postgres credential strings for module args
  ansible.builtin.set_fact:
    postgres_login_password_string: "{{ POSTGRES_PASSWORD | string }}"
    postgres_database_password_string: "{{ database_password | string }}"
  changed_when: false
  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"

- name: "🔍 Postgres | Resolve the container and wait for TCP auth once per container"
  ansible.builtin.include_tasks: 01_init/ready.yml
  when: postgres_verified_target != postgres_target
  vars:
    postgres_target: >-
      {{
        [
          lookup('database', database_consumer_id, 'service_name'),
          lookup('database', database_consumer_id, 'container'),
          POSTGRES_PORT
        ] | join('|')
      }}

- name: "📁 Create database: {{ database_name }}"
  community.postgresql.postgresql_db:
    name: "{{ database_name }}"
    state: present
    login_user: postgres
    login_password: "{{ postgres_login_password_string }}"
    login_host: "{{ POSTGRES_LOCAL_HOST }}"
    login_port: "{{ POSTGRES_PORT }}"
  register: postgresql_result
  until: postgresql_result is succeeded
  retries: "{{ POSTGRES_RETRIES }}"
  delay: "{{ POSTGRES_DELAY }}"

- name: "📁 Create database user: {{ database_username }}"
  community.postgresql.postgresql_user:
    name: "{{ database_username }}"
    password: "{{ postgres_database_password_string }}"
    login_db: "{{ database_name }}"
    state: present
    login_user: postgres
    login_password: "{{ postgres_login_password_string }}"
    login_host: "{{ POSTGRES_LOCAL_HOST }}"
    login_port: "{{ POSTGRES_PORT }}"
  register: postgresql_result
  until: postgresql_result is succeeded
  retries: "{{ POSTGRES_RETRIES }}"
  delay: "{{ POSTGRES_DELAY }}"

- name: "🟢 POSTGRES | Enable login for role {{ database_username }}"
  # nocheck: database-query — svc-db-postgres bootstraps its own DB; the `database_query` module's `lookup('database', ...)` indirection isn't usable from inside the role that provides the lookup target.
  community.postgresql.postgresql_query:
    login_db: postgres
    login_user: postgres
    login_password: "{{ postgres_login_password_string }}"
    login_host: "{{ POSTGRES_LOCAL_HOST }}"
    login_port: "{{ POSTGRES_PORT }}"
    query: |
      ALTER ROLE "{{ database_username }}"
        WITH LOGIN;
  register: postgres_enable_login
  until: postgres_enable_login is succeeded
  retries: "{{ POSTGRES_RETRIES }}"
  delay: "{{ POSTGRES_DELAY }}"
  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"

- name: "🔐 Grant ALL privileges on tables in public schema to {{ database_username }}"
  community.postgresql.postgresql_privs:
    login_db: "{{ database_name }}"
    roles: "{{ database_username }}"
    objs: ALL_IN_SCHEMA
    privs: ALL
    type: table
    schema: public
    state: present
    login_user: postgres
    login_password: "{{ postgres_login_password_string }}"
    login_host: "{{ POSTGRES_LOCAL_HOST }}"
    login_port: "{{ POSTGRES_PORT }}"
  register: postgresql_result
  until: postgresql_result is succeeded
  retries: "{{ POSTGRES_RETRIES }}"
  delay: "{{ POSTGRES_DELAY }}"

- name: "🔐 Grant all privileges on {{ database_name }} to {{ database_username }}"
  community.postgresql.postgresql_privs:
    login_db: "{{ database_name }}"
    roles: "{{ database_username }}"
    type: database
    privs: ALL
    state: present
    login_user: postgres
    login_password: "{{ postgres_login_password_string }}"
    login_host: "{{ POSTGRES_LOCAL_HOST }}"
    login_port: "{{ POSTGRES_PORT }}"
  register: postgresql_result
  until: postgresql_result is succeeded
  retries: "{{ POSTGRES_RETRIES }}"
  delay: "{{ POSTGRES_DELAY }}"

- name: "🔧 Set comprehensive schema privileges for {{ database_username }}"
  # nocheck: database-query — svc-db-postgres bootstraps its own DB; the `database_query` module's `lookup('database', ...)` indirection isn't usable from inside the role that provides the lookup target.
  community.postgresql.postgresql_query:
    login_db: "{{ database_name }}"
    login_user: postgres
    login_password: "{{ postgres_login_password_string }}"
    login_host: "{{ POSTGRES_LOCAL_HOST }}"
    login_port: "{{ POSTGRES_PORT }}"
    query: "{{ lookup('template', 'sql/grant_schema_privileges.sql.j2') }}"
  register: postgresql_result
  until: postgresql_result is succeeded
  retries: "{{ POSTGRES_RETRIES }}"
  delay: "{{ POSTGRES_DELAY }}"

- name: "✅ Ensure consumer-specific extensions ({{ database_consumer_id }})"
  community.postgresql.postgresql_ext:
    login_db: "{{ database_name }}"
    ext: "{{ item }}"
    state: present
    login_user: postgres
    login_password: "{{ postgres_login_password_string }}"
    login_host: "{{ POSTGRES_LOCAL_HOST }}"
    login_port: "{{ POSTGRES_PORT }}"
  loop: "{{ lookup('service_extensions', 'postgres')[database_consumer_id] | default([]) }}"
  register: postgresql_result
  until: postgresql_result is succeeded
  retries: "{{ POSTGRES_RETRIES }}"
  delay: "{{ POSTGRES_DELAY }}"