fix: postgresql_cert_name didn't work properly, using this parameter

[fila43]

postgresql_cert_name parameter caused an error. Because there is a missing variable __pg_server_crt definition in the correct context. This commit also enhances the description of postgresql_cern_name variable.

Issue Tracker Tickets (Jira or BZ if any): SYSROLES-157

[fila43]

[citest]

[richm]

@fila43 we'll need to add a new test for this, or modify one of the existing tests in tests/ e.g. https://github.com/linux-system-roles/postgresql/blob/main/tests/tests_certificate.yml

[fila43]

@richm I would prefer to add the new one.

[fila43]

[citest]

[richm]

this doesn't have to be a separate play - this can be a task in the Test PostgreSQL server with ssl support using certificate role play

There is a way to use the certificate role in test mode which makes it easier to use for system roles testing.

        - name: Generate certificates
          include_role:
            name: fedora.linux_system_roles.certificate
          vars:
            certificate_requests:
              - name: /tmp/mycert
                dns: www.example.com
                ca: self-sign
            certificate_test_mode: true

then you don't need the task for Stop tracking certificate

[fila43]

Thanks, I didn't know it.

[fila43]

[citest]

[richm]

When using the certificate role with certificate_test_mode: true you don't need to stop tracking - the certificate role does this for you https://github.com/linux-system-roles/certificate/blob/main/tasks/main.yml#L184

[richm]

@fila43 all Ansible YAML files must have a .yml extension, not a .yaml extension

[spetrosi]

[citest]

[richm]

The certificate role test mode doesn't work with name: using a full path. I'm trying to figure out an alternate way to do this.

[fila43]

[citest]

[fila43]

The certificate role test mode doesn't work with name: using a full path. I'm trying to figure out an alternate way to do this.

My current version works locally, but since I am not an ansible expert, I don't know if it satisfies all the rules.

[richm]

The certificate role test mode doesn't work with name: using a full path. I'm trying to figure out an alternate way to do this.

My current version works locally, but since I am not an ansible expert, I don't know if it satisfies all the rules.

Ah - because you aren't using /tmp - name: /etc/pki/tls/certs/mycert
using /tmp fails with an selinux AVC

[richm]

Suggested change

	- name: /etc/pki/tls/certs/mycert
	- name: /etc/pki/tls/certs/postgresql_test

So that if something goes wrong with the test, and doesn't clean up, we know which test this is

[richm]

Suggested change

	postgresql_cert_name: /etc/pki/tls/certs/mycert
	postgresql_cert_name: /etc/pki/tls/certs/postgresql_test

[fila43]

The certificate role test mode doesn't work with name: using a full path. I'm trying to figure out an alternate way to do this.

My current version works locally, but since I am not an ansible expert, I don't know if it satisfies all the rules.

Ah - because you aren't using /tmp - name: /etc/pki/tls/certs/mycert using /tmp fails with an selinux AVC

Yes, but there is a missing check mechanism in the certificate role. Usually, it gets stuck in the Ensure certificate requests task without any message.

[fila43]

[citest]