---
- name: Install zabbix-db
  hosts:
    - vm-zabbix-db
  roles:
    - postgresql
    - firewall
    - chrony
    - zabbix-agent2
  vars:
    postgresql_enablerepo: "pgdg18"
    # "https://download.postgresql.org/pub/repos/yum/reporpms/EL-9-x86_64/pgdg-redhat-repo-latest.noarch.rpm"
    postgresql_version: "18"
    timescaledb_enabled: true
    postgresql_databases: []
#     - name: exampledb # required; the rest are optional
#       lc_collate: # defaults to 'en_US.UTF-8'
#       lc_ctype: # defaults to 'en_US.UTF-8'
#       encoding: # defaults to 'UTF-8'
#       template: # defaults to 'template0'
#       login_host: # defaults to 'localhost'
#       login_password: # defaults to not set
#       login_user: # defaults to '{{ postgresql_user }}'
#       login_unix_socket: # defaults to 1st of postgresql_unix_socket_directories
#       port: # defaults to not set
#       owner: # defaults to postgresql_user
#       state: # defaults to 'present'
    postgres_users_no_log: false
    postgresql_users:
      - name: zabbix
        password: zabbixpw
        db: zabbix
        state: present
#     - name: jdoe #required; the rest are optional
#       password: # defaults to not set
#       encrypted: # defaults to not set
#       role_attr_flags: # defaults to not set
#       db: # defaults to not set
#       login_host: # defaults to 'localhost'
#       login_password: # defaults to not set
#       login_user: # defaults to '{{ postgresql_user }}'
#       login_unix_socket: # defaults to 1st of postgresql_unix_socket_directories
#       port: # defaults to not set
#       state: # defaults to 'present'
    postgresql_hba_entries:
      - type: host
        database: all
        user: all
        address: 127.0.0.1/32
        auth_method: trust
      - type: host
        database: all
        user: all
        address: localhost
        auth_method: trust
      - type: host
        database: zabbix
        user: zabbix
        address: 10.203.0.50/32
        auth_method: scram-sha-256

    firewall:
#      - previous: replaced          # flush previous rules
      - zone: internal
        state: enabled
        permanent: true
        service:
          - ssh
          - zabbix-agent
          - postgresql
        source:
          - 10.200.0.0/16
          - 10.202.0.0/16
          - 10.203.0.0/16
          - 91.218.87.192/26

      - zone: internal
        state: disabled
        permanent: true
        service:
          - cockpit
          - dhcpv6-client
          - mdns
          - samba-client

      - set_default_zone: internal
        state: enabled
        permanent: true

      - interface: ens192
        zone: internal
        state: enabled
        permanent: true

###### chrony-client ######
    chrony_disable_ntpd: true
    chrony_enable: true

###### Zabbix agent configuration ######
    agent_package_state: present # present or latest
    agent_2_plugin_list: ['postgresql']
    agent_param_plugins_postgresql_system_path: /usr/sbin/zabbix-agent2-plugin/zabbix-agent2-plugin-postgresql