From 5e2c40b479df638a21725794b37ca0360f5d7aa9 Mon Sep 17 00:00:00 2001
From: atsikham <atsikham@users.noreply.github.com>
Date: Tue, 18 May 2021 11:36:22 +0200
Subject: [PATCH 01/28] Removed auto generated vars

---
 .../playbooks/roles/postgresql/vars/main.yml  | 119 ------------------
 1 file changed, 119 deletions(-)
 delete mode 100644 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/vars/main.yml

diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/vars/main.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/vars/main.yml
deleted file mode 100644
index b96ac496fc..0000000000
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/vars/main.yml
+++ /dev/null
@@ -1,119 +0,0 @@
-kind: configuration/postgresql
-title: PostgreSQL
-specification:
-  config_file:
-    parameter_groups:
-    - name: CONNECTIONS AND AUTHENTICATION
-      subgroups:
-      - name: Connection Settings
-        parameters:
-        - name: listen_addresses
-          value: "'*'"
-          comment: listen on all addresses
-      - name: Security and Authentication
-        parameters:
-        - name: ssl
-          value: off
-          comment: to have the default value also on Ubuntu
-    - name: RESOURCE USAGE (except WAL)
-      subgroups:
-      - name: Kernel Resource Usage
-        parameters:
-        - name: shared_preload_libraries
-          value: AUTOCONFIGURED
-          comment: set by automation
-    - name: ERROR REPORTING AND LOGGING
-      subgroups:
-      - name: Where to Log
-        parameters:
-        - name: log_directory
-          value: "'/var/log/postgresql'"
-          comment: to have standard location for Filebeat and logrotate
-        - name: log_filename
-          value: "'postgresql.log'"
-          comment: to use logrotate with common configuration
-    - name: WRITE AHEAD LOG
-      subgroups:
-      - name: Settings
-        parameters:
-        - name: wal_level
-          value: replica
-          when: replication
-      - name: Archiving
-        parameters:
-        - name: archive_mode
-          value: on
-          when: replication
-        - name: archive_command
-          value: "'test ! -f /dbbackup/{{ inventory_hostname }}/backup/%f && gzip\
-            \ -c < %p > /dbbackup/{{ inventory_hostname }}/backup/%f'"
-          when: replication
-    - name: REPLICATION
-      subgroups:
-      - name: Sending Server(s)
-        parameters:
-        - name: max_wal_senders
-          value: 10
-          comment: maximum number of simultaneously running WAL sender processes
-          when: replication
-        - name: wal_keep_segments
-          value: 34
-          comment: number of WAL files held for standby servers
-          when: replication
-      - name: Standby Servers
-        parameters:
-        - name: hot_standby
-          value: on
-          comment: must be 'on' for repmgr needs, ignored on primary but recommended
-            in case primary becomes standby
-          when: replication
-  extensions:
-    pgaudit:
-      enabled: true
-      shared_preload_libraries:
-      - pgaudit
-      config_file_parameters:
-        log_connections: off
-        log_disconnections: off
-        log_statement: none
-        log_line_prefix: "'%m [%p] %q%u@%d,host=%h '"
-        pgaudit.log: "'write, function, role, ddl' # 'misc_set' is not supported for\
-          \ PG 10"
-        pgaudit.log_catalog: 'off # to reduce overhead of logging'
-        pgaudit.log_relation: 'on # separate log entry for each relation'
-        pgaudit.log_statement_once: off
-        pgaudit.log_parameter: on
-    pgbouncer:
-      enabled: true
-    replication:
-      enabled: true
-      replication_user_name: epi_repmgr
-      replication_user_password: PASSWORD_TO_CHANGE
-      privileged_user_name: epi_repmgr_admin
-      privileged_user_password: PASSWORD_TO_CHANGE
-      repmgr_database: epi_repmgr
-      shared_preload_libraries:
-      - repmgr
-  logrotate:
-    pgbouncer:
-      period: weekly
-      rotations: 5
-    postgresql: |-
-      /var/log/postgresql/postgresql*.log {
-          maxsize 10M
-          daily
-          rotate 6
-          copytruncate
-          # delaycompress is for Filebeat
-          delaycompress
-          compress
-          notifempty
-          missingok
-          su root root
-          nomail
-          # to have multiple unique filenames per day when dateext option is set
-          dateformat -%Y%m%dH%H
-      }
-  provider: aws
-provider: any
-version: 1.1.0

From 38926c2145fdee309b6a24b92a57e63e14aabda6 Mon Sep 17 00:00:00 2001
From: atsikham <atsikham@users.noreply.github.com>
Date: Wed, 19 May 2021 00:26:43 +0200
Subject: [PATCH 02/28] Updated postgresql default configuration with correct
 settings

---
 .../defaults/configuration/postgresql.yml      | 18 +++++-------------
 1 file changed, 5 insertions(+), 13 deletions(-)

diff --git a/core/src/epicli/data/common/defaults/configuration/postgresql.yml b/core/src/epicli/data/common/defaults/configuration/postgresql.yml
index 2e9a781a43..7cd1dc6009 100644
--- a/core/src/epicli/data/common/defaults/configuration/postgresql.yml
+++ b/core/src/epicli/data/common/defaults/configuration/postgresql.yml
@@ -40,14 +40,6 @@ specification:
               - name: wal_level
                 value: replica
                 when: replication
-          - name: Archiving
-            parameters:
-              - name: archive_mode
-                value: 'on'
-                when: replication
-              - name: archive_command
-                value: "'test ! -f /dbbackup/{{ inventory_hostname }}/backup/%f && gzip -c < %p > /dbbackup/{{ inventory_hostname }}/backup/%f'"
-                when: replication
       - name: REPLICATION
         subgroups:
           - name: Sending Server(s)
@@ -56,9 +48,9 @@ specification:
                 value: 10
                 comment: maximum number of simultaneously running WAL sender processes
                 when: replication
-              - name: wal_keep_segments
-                value: 34
-                comment: number of WAL files held for standby servers
+              - name: wal_keep_size
+                value: 500
+                comment: the size of WAL files held for standby servers (MB)
                 when: replication
           - name: Standby Servers # ignored on master server
             parameters:
@@ -76,8 +68,8 @@ specification:
         log_disconnections: 'off'
         log_statement: 'none'
         log_line_prefix: "'%m [%p] %q%u@%d,host=%h '"
-        ## pgaudit specific, see https://github.com/pgaudit/pgaudit/blob/REL_10_STABLE/README.md#settings
-        pgaudit.log: "'write, function, role, ddl' # 'misc_set' is not supported for PG 10"
+        # pgaudit specific, see https://github.com/pgaudit/pgaudit/tree/REL_13_STABLE#settings
+        pgaudit.log: "'write, function, role, ddl, misc_set'"
         pgaudit.log_catalog: 'off # to reduce overhead of logging' # default is 'on'
         # the following first 2 parameters are set to values that make it easier to access audit log per table
         # change their values to the opposite if you need to reduce overhead of logging

From 92d877ffd12a1abb4b2bd69823474b573739a655 Mon Sep 17 00:00:00 2001
From: atsikham <atsikham@users.noreply.github.com>
Date: Wed, 19 May 2021 00:29:13 +0200
Subject: [PATCH 03/28] Updated tests according to the new version

---
 .../tests/spec/postgresql/postgresql_spec.rb  | 48 +++++++++----------
 1 file changed, 24 insertions(+), 24 deletions(-)

diff --git a/core/src/epicli/data/common/tests/spec/postgresql/postgresql_spec.rb b/core/src/epicli/data/common/tests/spec/postgresql/postgresql_spec.rb
index 4f29619570..3d26fcea6e 100644
--- a/core/src/epicli/data/common/tests/spec/postgresql/postgresql_spec.rb
+++ b/core/src/epicli/data/common/tests/spec/postgresql/postgresql_spec.rb
@@ -106,7 +106,7 @@ def queryForDropping
 
 describe 'Checking PostgreSQL service status' do
   if os[:family] == 'redhat'
-    describe command("systemctl status postgresql-10 > /dev/null") do
+    describe command("systemctl status postgresql-13 > /dev/null") do
       its(:exit_status) { should eq 0 }
     end
   elsif os[:family] == 'ubuntu'
@@ -118,7 +118,7 @@ def queryForDropping
 
 describe 'Checking if PostgreSQL service is running' do
   if os[:family] == 'redhat'
-    describe service('postgresql-10') do
+    describe service('postgresql-13') do
       it { should be_enabled }
       it { should be_running }
     end
@@ -133,7 +133,7 @@ def queryForDropping
 if replicated
   describe 'Checking if repmgr service is running' do
     if os[:family] == 'redhat'
-      describe service('repmgr10') do
+      describe service('repmgr13') do
         it { should be_enabled }
         it { should be_running }
       end
@@ -149,21 +149,21 @@ def queryForDropping
 if os[:family] == 'redhat'
   describe 'Checking PostgreSQL directories and config files' do
     let(:disable_sudo) { false }
-    describe file('/var/lib/pgsql/10/data') do
+    describe file('/var/lib/pgsql/13/data') do
       it { should exist }
       it { should be_a_directory }
     end
-    describe file("/var/lib/pgsql/10/data/pg_hba.conf") do
+    describe file("/var/lib/pgsql/13/data/pg_hba.conf") do
       it { should exist }
       it { should be_a_file }
       it { should be_readable }
      end
-    describe file("/var/lib/pgsql/10/data/postgresql.conf") do
+    describe file("/var/lib/pgsql/13/data/postgresql.conf") do
       it { should exist }
       it { should be_a_file }
       it { should be_readable }
     end
-    describe file("/var/lib/pgsql/10/data/postgresql-epiphany.conf") do
+    describe file("/var/lib/pgsql/13/data/postgresql-epiphany.conf") do
       it { should exist }
       it { should be_a_file }
       it { should be_readable }
@@ -172,21 +172,21 @@ def queryForDropping
 elsif os[:family] == 'ubuntu'
   describe 'Checking PostgreSQL directories and config files' do
     let(:disable_sudo) { false }
-    describe file('/etc/postgresql/10/main') do
+    describe file('/etc/postgresql/13/main') do
       it { should exist }
       it { should be_a_directory }
     end
-    describe file("/etc/postgresql/10/main/pg_hba.conf") do
+    describe file("/etc/postgresql/13/main/pg_hba.conf") do
       it { should exist }
       it { should be_a_file }
       it { should be_readable }
      end
-    describe file("/etc/postgresql/10/main/postgresql.conf") do
+    describe file("/etc/postgresql/13/main/postgresql.conf") do
       it { should exist }
       it { should be_a_file }
       it { should be_readable }
     end
-    describe file("/etc/postgresql/10/main/postgresql-epiphany.conf") do
+    describe file("/etc/postgresql/13/main/postgresql-epiphany.conf") do
       it { should exist }
       it { should be_a_file }
       it { should be_readable }
@@ -231,12 +231,12 @@ def queryForDropping
 
   describe 'Displaying information about each registered node in the replication cluster' do
     let(:disable_sudo) { false }
-    describe command("su - postgres -c \"repmgr -f /etc/postgresql/10/main/repmgr.conf cluster show\""), :if => os[:family] == 'ubuntu' do
+    describe command("su - postgres -c \"repmgr -f /etc/postgresql/13/main/repmgr.conf cluster show\""), :if => os[:family] == 'ubuntu' do
       its(:stdout) { should match /primary.*\*.*running/ }
       its(:stdout) { should match /standby.*running/ }
       its(:exit_status) { should eq 0 }
     end
-    describe command("su - postgres -c \"repmgr -f /etc/repmgr/10/repmgr.conf cluster show\""), :if => os[:family] == 'redhat' do
+    describe command("su - postgres -c \"repmgr -f /etc/repmgr/13/repmgr.conf cluster show\""), :if => os[:family] == 'redhat' do
       its(:stdout) { should match /primary.*\*.*running/ }
       its(:stdout) { should match /standby.*running/ }
       its(:exit_status) { should eq 0 }
@@ -246,12 +246,12 @@ def queryForDropping
   describe 'Check hot_standby setting in postgresql-epiphany.conf file' do
     let(:disable_sudo) { false }
     if os[:family] == 'redhat'
-      describe command("grep -Eio '^hot_standby\s*=[^#]*' /var/lib/pgsql/10/data/postgresql-epiphany.conf") do
+      describe command("grep -Eio '^hot_standby\s*=[^#]*' /var/lib/pgsql/13/data/postgresql-epiphany.conf") do
         its(:exit_status) { should eq 0 }
         its(:stdout) { should match /^hot_standby\s*=\s*#{pg_config_file_booleans[:true]}/i }
       end
     elsif os[:family] == 'ubuntu'
-      describe command("grep -Eio '^hot_standby\s*=[^#]*' /etc/postgresql/10/main/postgresql-epiphany.conf") do
+      describe command("grep -Eio '^hot_standby\s*=[^#]*' /etc/postgresql/13/main/postgresql-epiphany.conf") do
         its(:exit_status) { should eq 0 }
         its(:stdout) { should match /^hot_standby\s*=\s*#{pg_config_file_booleans[:true]}/i }
       end
@@ -262,15 +262,15 @@ def queryForDropping
     if os[:family] == 'redhat'
       describe 'Checking PostgreSQL config files for master node' do
         let(:disable_sudo) { false }
-        describe command("cat /var/lib/pgsql/10/data/postgresql-epiphany.conf | grep wal_level") do
+        describe command("cat /var/lib/pgsql/13/data/postgresql-epiphany.conf | grep wal_level") do
           its(:stdout) { should match /^wal_level = replica/ }
           its(:exit_status) { should eq 0 }
         end
-        describe command("cat /var/lib/pgsql/10/data/postgresql-epiphany.conf | grep max_wal_senders") do
+        describe command("cat /var/lib/pgsql13/data/postgresql-epiphany.conf | grep max_wal_senders") do
           its(:stdout) { should match /^max_wal_senders = #{max_wal_senders}/ }
           its(:exit_status) { should eq 0 }
         end
-        describe command("cat /var/lib/pgsql/10/data/postgresql-epiphany.conf | grep wal_keep_segments") do
+        describe command("cat /var/lib/pgsql/13/data/postgresql-epiphany.conf | grep wal_keep_segments") do
           its(:stdout) { should match /^wal_keep_segments = #{wal_keep_segments}/ }
           its(:exit_status) { should eq 0 }
         end
@@ -279,7 +279,7 @@ def queryForDropping
           its(:stdout) { should match /Replication/ }
           its(:exit_status) { should eq 0 }
         end
-        describe command("cat /var/lib/pgsql/10/data/pg_hba.conf | grep replication | grep md5") do
+        describe command("cat /var/lib/pgsql/13/data/pg_hba.conf | grep replication | grep md5") do
           its(:stdout) { should match /#{replication_user}/ }
           its(:stdout) { should match /replication/ }
           its(:exit_status) { should eq 0 }
@@ -288,15 +288,15 @@ def queryForDropping
     elsif os[:family] == 'ubuntu'
       describe 'Checking PostgreSQL config files for master node' do
         let(:disable_sudo) { false }
-        describe command("cat /etc/postgresql/10/main/postgresql-epiphany.conf | grep wal_level") do
+        describe command("cat /etc/postgresql/13/main/postgresql-epiphany.conf | grep wal_level") do
           its(:stdout) { should match /^wal_level = replica/ }
           its(:exit_status) { should eq 0 }
         end
-        describe command("cat /etc/postgresql/10/main/postgresql-epiphany.conf | grep max_wal_senders") do
+        describe command("cat /etc/postgresql/13/main/postgresql-epiphany.conf | grep max_wal_senders") do
           its(:stdout) { should match /^max_wal_senders = #{max_wal_senders}/ }
           its(:exit_status) { should eq 0 }
         end
-        describe command("cat /etc/postgresql/10/main/postgresql-epiphany.conf | grep wal_keep_segments") do
+        describe command("cat /etc/postgresql/13/main/postgresql-epiphany.conf | grep wal_keep_segments") do
           its(:stdout) { should match /^wal_keep_segments = #{wal_keep_segments}/ }
           its(:exit_status) { should eq 0 }
         end
@@ -305,7 +305,7 @@ def queryForDropping
           its(:stdout) { should match /Replication/ }
           its(:exit_status) { should eq 0 }
         end
-        describe command("cat /etc/postgresql/10/main/pg_hba.conf | grep replication | grep md5") do
+        describe command("cat /etc/postgresql/13/main/pg_hba.conf | grep replication | grep md5") do
           its(:stdout) { should match /#{replication_user}/ }
           its(:stdout) { should match /replication/ }
           its(:exit_status) { should eq 0 }
@@ -524,7 +524,7 @@ def get_elasticsearch_query(message_pattern:, size: 20, with_sort: true)
         _source: [ 'message', '@timestamp' ],
         query: {
           query_string: {
-            query: "log.file.path:(\\/var\\/log\\/postgresql\\/postgresql\\-10\\-main.log OR \\/var\\/log\\/postgresql\\/postgresql.log) AND message:#{message_pattern} AND @timestamp:[now-30m TO now]"
+            query: "log.file.path:(\\/var\\/log\\/postgresql\\/postgresql\\-13\\-main.log OR \\/var\\/log\\/postgresql\\/postgresql.log) AND message:#{message_pattern} AND @timestamp:[now-30m TO now]"
           }
         },
         size: size

From 129f59ebc6736511ce2b9e61b55fd6b9e4d30599 Mon Sep 17 00:00:00 2001
From: atsikham <atsikham@users.noreply.github.com>
Date: Wed, 19 May 2021 00:42:22 +0200
Subject: [PATCH 04/28] Increased postgresql, pgaudit, pgpool, repmgr versions

---
 .../tasks/extensions/pgaudit/packages.yml          |  4 ++--
 .../tasks/extensions/replication/packages.yml      |  4 ++--
 .../centos-7/add-repositories.multiarch.sh         |  8 ++++----
 .../centos-7/add-repositories.x86_64.sh            |  4 ++--
 .../centos-7/requirements.aarch64.txt              |  4 ++--
 .../centos-7/requirements.x86_64.txt               | 10 +++++-----
 .../redhat-7/add-repositories.multiarch.sh         |  8 ++++----
 .../redhat-7/add-repositories.x86_64.sh            |  4 ++--
 .../redhat-7/requirements.x86_64.txt               | 10 +++++-----
 .../ubuntu-18.04/requirements.x86_64.txt           | 14 +++++++-------
 .../common/defaults/configuration/applications.yml | 11 +++++------
 .../defaults/configuration/image-registry.yml      |  8 ++++----
 12 files changed, 44 insertions(+), 45 deletions(-)

diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/pgaudit/packages.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/pgaudit/packages.yml
index 051d0853b6..72d0d4b938 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/pgaudit/packages.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/pgaudit/packages.yml
@@ -6,8 +6,8 @@
   vars:
     _packages:
       Debian:
-        - postgresql-10-pgaudit
+        - postgresql-13-pgaudit
       RedHat:
-        - pgaudit12_10
+        - pgaudit15_13
   module_defaults:
     yum: { lock_timeout: "{{ yum_lock_timeout }}" }
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/packages.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/packages.yml
index 30f90263e0..a74a771a4c 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/packages.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/packages.yml
@@ -6,8 +6,8 @@
   vars:
     _packages:
       Debian:
-        - postgresql-10-repmgr
+        - postgresql-13-repmgr
       RedHat:
-        - repmgr10-4.0.6
+        - repmgr13
   module_defaults:
     yum: { lock_timeout: "{{ yum_lock_timeout }}" }
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/centos-7/add-repositories.multiarch.sh b/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/centos-7/add-repositories.multiarch.sh
index b28df2df1b..7c1f323719 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/centos-7/add-repositories.multiarch.sh
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/centos-7/add-repositories.multiarch.sh
@@ -82,9 +82,9 @@ EOF
 )
 
 POSTGRESQL_REPO_CONF=$(cat <<'EOF'
-[pgdg10]
-name=PostgreSQL 10 for RHEL/CentOS $releasever - $basearch
-baseurl=https://download.postgresql.org/pub/repos/yum/10/redhat/rhel-$releasever-$basearch
+[pgdg13]
+name=PostgreSQL 13 for RHEL/CentOS $releasever - $basearch
+baseurl=https://download.postgresql.org/pub/repos/yum/13/redhat/rhel-$releasever-$basearch
 enabled=1
 gpgcheck=1
 gpgkey=https://download.postgresql.org/pub/repos/yum/RPM-GPG-KEY-PGDG
@@ -117,5 +117,5 @@ add_repo_as_file 'elasticsearch-curator-5' "$ELASTICSEARCH_CURATOR_REPO_CONF"
 add_repo_as_file 'grafana' "$GRAFANA_REPO_CONF"
 add_repo_as_file 'kubernetes' "$KUBERNETES_REPO_CONF"
 add_repo_as_file 'opendistroforelasticsearch' "$OPENDISTRO_REPO_CONF"
-add_repo_as_file 'postgresql-10' "$POSTGRESQL_REPO_CONF"
+add_repo_as_file 'postgresql-13' "$POSTGRESQL_REPO_CONF"
 add_repo_as_file 'rabbitmq' "$RABBITMQ_SERVER_REPO_CONF"
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/centos-7/add-repositories.x86_64.sh b/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/centos-7/add-repositories.x86_64.sh
index d48f497f96..036ab2d56f 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/centos-7/add-repositories.x86_64.sh
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/centos-7/add-repositories.x86_64.sh
@@ -1,4 +1,4 @@
 #!/usr/bin/env bash -eu
 
-add_repo_from_script 'https://dl.2ndquadrant.com/default/release/get/10/rpm'
-disable_repo '2ndquadrant-dl-default-release-pg10-debug'
+add_repo_from_script 'https://dl.2ndquadrant.com/default/release/get/13/rpm' # for repmgr
+disable_repo '2ndquadrant-dl-default-release-pg13-debug' # script adds 2 repositories, only 1 is required
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/centos-7/requirements.aarch64.txt b/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/centos-7/requirements.aarch64.txt
index 7226a39883..1b79782f0b 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/centos-7/requirements.aarch64.txt
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/centos-7/requirements.aarch64.txt
@@ -78,7 +78,7 @@ perl-libs # for vim
 perl-Pod-Perldoc # for vim
 perl-Pod-Simple # for vim
 perl-Pod-Usage # for vim
-pgaudit12_10
+pgaudit15_13
 policycoreutils-python # for container-selinux
 pyldb # for cifs-utils
 python-cffi # for python2-cryptography
@@ -96,7 +96,7 @@ quota # for nfs-utils
 rabbitmq-server-3.8.9
 #rh-haproxy18
 #rh-haproxy18-haproxy-syspaths
-postgresql10-server
+postgresql13-server
 samba-client
 samba-client-libs # for samba-client
 samba-common
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/centos-7/requirements.x86_64.txt b/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/centos-7/requirements.x86_64.txt
index 6a41c9cc4f..a90d187b34 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/centos-7/requirements.x86_64.txt
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/centos-7/requirements.x86_64.txt
@@ -78,7 +78,7 @@ perl-libs # for vim
 perl-Pod-Perldoc # for vim
 perl-Pod-Simple # for vim
 perl-Pod-Usage # for vim
-pgaudit12_10
+pgaudit15_13
 pgbouncer-1.10.*
 policycoreutils-python # for container-selinux
 pyldb # for cifs-utils
@@ -97,8 +97,8 @@ quota # for nfs-utils
 rabbitmq-server-3.8.9
 rh-haproxy18
 rh-haproxy18-haproxy-syspaths
-postgresql10-server
-repmgr10-4.0.6
+postgresql13-server
+repmgr13
 samba-client
 samba-client-libs # for samba-client
 samba-common
@@ -178,8 +178,8 @@ hashicorp/vault-k8s:0.10.0
 vault:1.7.0
 # applications
 epiphanyplatform/ignite:2.9.1
-bitnami/pgpool:4.1.1-debian-10-r29
-brainsam/pgbouncer:1.12
+bitnami/pgpool:4.2.2
+bitnami/pgbouncer:1.15.0
 # istio
 istio/pilot:1.8.1
 istio/proxyv2:1.8.1
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/redhat-7/add-repositories.multiarch.sh b/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/redhat-7/add-repositories.multiarch.sh
index b28df2df1b..7c1f323719 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/redhat-7/add-repositories.multiarch.sh
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/redhat-7/add-repositories.multiarch.sh
@@ -82,9 +82,9 @@ EOF
 )
 
 POSTGRESQL_REPO_CONF=$(cat <<'EOF'
-[pgdg10]
-name=PostgreSQL 10 for RHEL/CentOS $releasever - $basearch
-baseurl=https://download.postgresql.org/pub/repos/yum/10/redhat/rhel-$releasever-$basearch
+[pgdg13]
+name=PostgreSQL 13 for RHEL/CentOS $releasever - $basearch
+baseurl=https://download.postgresql.org/pub/repos/yum/13/redhat/rhel-$releasever-$basearch
 enabled=1
 gpgcheck=1
 gpgkey=https://download.postgresql.org/pub/repos/yum/RPM-GPG-KEY-PGDG
@@ -117,5 +117,5 @@ add_repo_as_file 'elasticsearch-curator-5' "$ELASTICSEARCH_CURATOR_REPO_CONF"
 add_repo_as_file 'grafana' "$GRAFANA_REPO_CONF"
 add_repo_as_file 'kubernetes' "$KUBERNETES_REPO_CONF"
 add_repo_as_file 'opendistroforelasticsearch' "$OPENDISTRO_REPO_CONF"
-add_repo_as_file 'postgresql-10' "$POSTGRESQL_REPO_CONF"
+add_repo_as_file 'postgresql-13' "$POSTGRESQL_REPO_CONF"
 add_repo_as_file 'rabbitmq' "$RABBITMQ_SERVER_REPO_CONF"
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/redhat-7/add-repositories.x86_64.sh b/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/redhat-7/add-repositories.x86_64.sh
index d48f497f96..036ab2d56f 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/redhat-7/add-repositories.x86_64.sh
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/redhat-7/add-repositories.x86_64.sh
@@ -1,4 +1,4 @@
 #!/usr/bin/env bash -eu
 
-add_repo_from_script 'https://dl.2ndquadrant.com/default/release/get/10/rpm'
-disable_repo '2ndquadrant-dl-default-release-pg10-debug'
+add_repo_from_script 'https://dl.2ndquadrant.com/default/release/get/13/rpm' # for repmgr
+disable_repo '2ndquadrant-dl-default-release-pg13-debug' # script adds 2 repositories, only 1 is required
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/redhat-7/requirements.x86_64.txt b/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/redhat-7/requirements.x86_64.txt
index 292fb15bc7..d4c3d2e5dc 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/redhat-7/requirements.x86_64.txt
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/redhat-7/requirements.x86_64.txt
@@ -76,7 +76,7 @@ perl-libs # for vim
 perl-Pod-Perldoc # for vim
 perl-Pod-Simple # for vim
 perl-Pod-Usage # for vim
-pgaudit12_10
+pgaudit15_13
 pgbouncer-1.10.*
 policycoreutils-python # for container-selinux
 pyldb # for cifs-utils
@@ -93,8 +93,8 @@ quota # for nfs-utils
 rabbitmq-server-3.8.9
 rh-haproxy18
 rh-haproxy18-haproxy-syspaths
-postgresql10-server
-repmgr10-4.0.6
+postgresql13-server
+repmgr13
 samba-client
 samba-client-libs # for samba-client
 samba-common
@@ -174,8 +174,8 @@ hashicorp/vault-k8s:0.10.0
 vault:1.7.0
 # applications
 epiphanyplatform/ignite:2.9.1
-bitnami/pgpool:4.1.1-debian-10-r29
-brainsam/pgbouncer:1.12
+bitnami/pgpool:4.2.2
+bitnami/pgbouncer:1.15.0
 # istio
 istio/pilot:1.8.1
 istio/proxyv2:1.8.1
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/ubuntu-18.04/requirements.x86_64.txt b/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/ubuntu-18.04/requirements.x86_64.txt
index 726a7500e8..2aab48c097 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/ubuntu-18.04/requirements.x86_64.txt
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/ubuntu-18.04/requirements.x86_64.txt
@@ -64,7 +64,7 @@ opendistro-sql 1.13.0
 opendistroforelasticsearch-kibana 1.13.1
 openjdk-8-jre-headless
 openssl
-postgresql-10
+postgresql-13
 python-pip
 python-psycopg2
 python-selinux
@@ -141,11 +141,11 @@ samba-libs
 libsmbclient
 
 # for postgres
-postgresql-client-10
-postgresql-10-pgaudit
-postgresql-10-repmgr 4.0.6
+postgresql-client-13
+postgresql-13-pgaudit
+postgresql-13-repmgr
 postgresql-common
-pgbouncer 1.10.*
+pgbouncer 1.15.*
 
 # for firewalld
 ipset
@@ -231,8 +231,8 @@ hashicorp/vault-k8s:0.10.0
 vault:1.7.0
 # applications
 epiphanyplatform/ignite:2.9.1
-bitnami/pgpool:4.1.1-debian-10-r29
-brainsam/pgbouncer:1.12
+bitnami/pgpool:4.2.2
+bitnami/pgbouncer:1.15.0
 # istio
 istio/pilot:1.8.1
 istio/proxyv2:1.8.1
diff --git a/core/src/epicli/data/common/defaults/configuration/applications.yml b/core/src/epicli/data/common/defaults/configuration/applications.yml
index 393123fcaf..6a591bb25b 100644
--- a/core/src/epicli/data/common/defaults/configuration/applications.yml
+++ b/core/src/epicli/data/common/defaults/configuration/applications.yml
@@ -20,7 +20,7 @@ specification:
     - ignite-kubernetes # required to work on K8s
     - ignite-rest-http
 
-# Abstract these configs to seperate default files and add
+# Abstract these configs to separate default files and add
 # the ability to add custom application roles.
 
 ## --- rabbitmq ---
@@ -78,7 +78,7 @@ specification:
   - name: pgpool # this service requires PostgreSQL to be installed in cluster
     enabled: false
     image:
-      path: bitnami/pgpool:4.1.1-debian-10-r29
+      path: bitnami/pgpool:4.2.2
       debug: false # ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging
     use_local_image_registry: true
     namespace: postgres-pool
@@ -141,9 +141,8 @@ specification:
 
   - name: pgbouncer
     enabled: false
-    #https://github.com/brainsam/pgbouncer/tree/release/1.12
-    image_path: brainsam/pgbouncer:1.12
-    init_image_path: bitnami/pgpool:4.1.1-debian-10-r29 #TODO: make reference to pgpool section
+    image_path: bitnami/pgbouncer:1.15.0
+    init_image_path: bitnami/pgpool:4.2.2 #TODO: make reference to pgpool section
     use_local_image_registry: true
     namespace: postgres-pool
     service:
@@ -181,5 +180,5 @@ specification:
         - istio-system
       istio: istio-system # namespace where istio control plane will be deployed
     istio_spec:
-      profile: default # Check all possibilites https://istio.io/latest/docs/setup/additional-setup/config-profiles/
+      profile: default # Check all possibilities https://istio.io/latest/docs/setup/additional-setup/config-profiles/
       name: istiocontrolplane
diff --git a/core/src/epicli/data/common/defaults/configuration/image-registry.yml b/core/src/epicli/data/common/defaults/configuration/image-registry.yml
index b35839da60..89805e61ce 100644
--- a/core/src/epicli/data/common/defaults/configuration/image-registry.yml
+++ b/core/src/epicli/data/common/defaults/configuration/image-registry.yml
@@ -30,10 +30,10 @@ specification:
         - name: "istio/operator:1.8.1"
           file_name: operator-1.8.1.tar
         # postgres
-        - name: bitnami/pgpool:4.1.1-debian-10-r29
-          file_name: pgpool-4.1.1-debian-10-r29.tar
-        - name: "brainsam/pgbouncer:1.12"
-          file_name: pgbouncer-1.12.tar
+        - name: bitnami/pgpool:4.2.2
+          file_name: pgpool-4.2.2.tar
+        - name: bitnami/pgbouncer:1.15.0
+          file_name: pgbouncer-1.15.0.tar
       current:
         - name: "haproxy:2.2.2-alpine"
           file_name: haproxy-2.2.2-alpine.tar

From 5881f1def4fdf4f8c3833c21708886338bd781b8 Mon Sep 17 00:00:00 2001
From: atsikham <atsikham@users.noreply.github.com>
Date: Wed, 19 May 2021 00:48:15 +0200
Subject: [PATCH 05/28] Postgres installation

---
 .../roles/postgresql/defaults/main.yml        |  24 +-
 .../roles/postgresql/files/postgresql.conf    | 780 ++++++++++++++++++
 .../playbooks/roles/postgresql/tasks/main.yml |  41 +-
 .../roles/postgresql/templates/pg_hba.conf.j2 |  98 +++
 4 files changed, 913 insertions(+), 30 deletions(-)
 create mode 100755 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/files/postgresql.conf
 create mode 100755 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/pg_hba.conf.j2

diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/defaults/main.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/defaults/main.yml
index c373883796..cd340fd42b 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/defaults/main.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/defaults/main.yml
@@ -1,34 +1,34 @@
 ---
 pg:
   service_name:
-    RedHat: postgresql-10
+    RedHat: postgresql-13
     Debian: postgresql
   instantiated_service_name:
     RedHat: null
-    Debian: postgresql@10-main
+    Debian: postgresql@13-main
   base_dir:
     RedHat: /var/lib/pgsql
     Debian: /var/lib/postgresql
   config_dir:
-    RedHat: /var/lib/pgsql/10/data
-    Debian: /etc/postgresql/10/main
+    RedHat: /var/lib/pgsql/13/data
+    Debian: /etc/postgresql/13/main
   data_dir:
-    RedHat: /var/lib/pgsql/10/data
-    Debian: /var/lib/postgresql/10/main
+    RedHat: /var/lib/pgsql/13/data
+    Debian: /var/lib/postgresql/13/main
 
 repmgr:
   bindir:
-    RedHat: /usr/pgsql-10/bin
+    RedHat: /usr/pgsql-13/bin
     Debian: /usr/bin
   pg_bindir:
-    RedHat: /usr/pgsql-10/bin
-    Debian: /usr/lib/postgresql/10/bin
+    RedHat: /usr/pgsql-13/bin
+    Debian: /usr/lib/postgresql/13/bin
   service_name:
-    RedHat: repmgr10
+    RedHat: repmgr13
     Debian: repmgrd
   config_dir:
-    RedHat: /etc/repmgr/10
-    Debian: /etc/postgresql/10/main
+    RedHat: /etc/repmgr/13
+    Debian: /etc/postgresql/13/main
 
 pgbouncer:
   logfile:
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/files/postgresql.conf b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/files/postgresql.conf
new file mode 100755
index 0000000000..6d23f04021
--- /dev/null
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/files/postgresql.conf
@@ -0,0 +1,780 @@
+# -----------------------------
+# PostgreSQL configuration file
+# -----------------------------
+#
+# This file consists of lines of the form:
+#
+#   name = value
+#
+# (The "=" is optional.)  Whitespace may be used.  Comments are introduced with
+# "#" anywhere on a line.  The complete list of parameter names and allowed
+# values can be found in the PostgreSQL documentation.
+#
+# The commented-out settings shown in this file represent the default values.
+# Re-commenting a setting is NOT sufficient to revert it to the default value;
+# you need to reload the server.
+#
+# This file is read on server startup and when the server receives a SIGHUP
+# signal.  If you edit the file on a running system, you have to SIGHUP the
+# server for the changes to take effect, run "pg_ctl reload", or execute
+# "SELECT pg_reload_conf()".  Some parameters, which are marked below,
+# require a server shutdown and restart to take effect.
+#
+# Any parameter can also be given as a command-line option to the server, e.g.,
+# "postgres -c log_connections=on".  Some parameters can be changed at run time
+# with the "SET" SQL command.
+#
+# Memory units:  kB = kilobytes        Time units:  ms  = milliseconds
+#                MB = megabytes                     s   = seconds
+#                GB = gigabytes                     min = minutes
+#                TB = terabytes                     h   = hours
+#                                                   d   = days
+
+
+#------------------------------------------------------------------------------
+# FILE LOCATIONS
+#------------------------------------------------------------------------------
+
+# The default values of these variables are driven from the -D command-line
+# option or PGDATA environment variable, represented here as ConfigDir.
+
+#data_directory = 'ConfigDir'		# use data in another directory
+					# (change requires restart)
+#hba_file = 'ConfigDir/pg_hba.conf'	# host-based authentication file
+					# (change requires restart)
+#ident_file = 'ConfigDir/pg_ident.conf'	# ident configuration file
+					# (change requires restart)
+
+# If external_pid_file is not explicitly set, no extra PID file is written.
+#external_pid_file = ''			# write an extra PID file
+					# (change requires restart)
+
+
+#------------------------------------------------------------------------------
+# CONNECTIONS AND AUTHENTICATION
+#------------------------------------------------------------------------------
+
+# - Connection Settings -
+
+listen_addresses = '*'		# what IP address(es) to listen on;
+					# comma-separated list of addresses;
+					# defaults to 'localhost'; use '*' for all
+					# (change requires restart)
+#port = 5432				# (change requires restart)
+max_connections = 100			# (change requires restart)
+#superuser_reserved_connections = 3	# (change requires restart)
+#unix_socket_directories = '/var/run/postgresql, /tmp'	# comma-separated list of directories
+					# (change requires restart)
+#unix_socket_group = ''			# (change requires restart)
+#unix_socket_permissions = 0777		# begin with 0 to use octal notation
+					# (change requires restart)
+#bonjour = off				# advertise server via Bonjour
+					# (change requires restart)
+#bonjour_name = ''			# defaults to the computer name
+					# (change requires restart)
+
+# - TCP settings -
+# see "man tcp" for details
+
+#tcp_keepalives_idle = 0		# TCP_KEEPIDLE, in seconds;
+					# 0 selects the system default
+#tcp_keepalives_interval = 0		# TCP_KEEPINTVL, in seconds;
+					# 0 selects the system default
+#tcp_keepalives_count = 0		# TCP_KEEPCNT;
+					# 0 selects the system default
+#tcp_user_timeout = 0			# TCP_USER_TIMEOUT, in milliseconds;
+					# 0 selects the system default
+
+# - Authentication -
+
+#authentication_timeout = 1min		# 1s-600s
+password_encryption = scram-sha-256		# md5 or scram-sha-256
+#db_user_namespace = off
+
+# GSSAPI using Kerberos
+#krb_server_keyfile = 'FILE:${sysconfdir}/krb5.keytab'
+#krb_caseins_users = off
+
+# - SSL -
+
+#ssl = off
+#ssl_ca_file = ''
+#ssl_cert_file = 'server.crt'
+#ssl_crl_file = ''
+#ssl_key_file = 'server.key'
+#ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL' # allowed SSL ciphers
+#ssl_prefer_server_ciphers = on
+#ssl_ecdh_curve = 'prime256v1'
+#ssl_min_protocol_version = 'TLSv1.2'
+#ssl_max_protocol_version = ''
+#ssl_dh_params_file = ''
+#ssl_passphrase_command = ''
+#ssl_passphrase_command_supports_reload = off
+
+
+#------------------------------------------------------------------------------
+# RESOURCE USAGE (except WAL)
+#------------------------------------------------------------------------------
+
+# - Memory -
+
+shared_buffers = 128MB			# min 128kB
+					# (change requires restart)
+#huge_pages = try			# on, off, or try
+					# (change requires restart)
+#temp_buffers = 8MB			# min 800kB
+#max_prepared_transactions = 0		# zero disables the feature
+					# (change requires restart)
+# Caution: it is not advisable to set max_prepared_transactions nonzero unless
+# you actively intend to use prepared transactions.
+#work_mem = 4MB				# min 64kB
+#hash_mem_multiplier = 1.0		# 1-1000.0 multiplier on hash table work_mem
+#maintenance_work_mem = 64MB		# min 1MB
+#autovacuum_work_mem = -1		# min 1MB, or -1 to use maintenance_work_mem
+#logical_decoding_work_mem = 64MB	# min 64kB
+#max_stack_depth = 2MB			# min 100kB
+#shared_memory_type = mmap		# the default is the first option
+					# supported by the operating system:
+					#   mmap
+					#   sysv
+					#   windows
+					# (change requires restart)
+dynamic_shared_memory_type = posix	# the default is the first option
+					# supported by the operating system:
+					#   posix
+					#   sysv
+					#   windows
+					#   mmap
+					# (change requires restart)
+
+# - Disk -
+
+#temp_file_limit = -1			# limits per-process temp file space
+					# in kilobytes, or -1 for no limit
+
+# - Kernel Resources -
+
+#max_files_per_process = 1000		# min 64
+					# (change requires restart)
+
+# - Cost-Based Vacuum Delay -
+
+#vacuum_cost_delay = 0			# 0-100 milliseconds (0 disables)
+#vacuum_cost_page_hit = 1		# 0-10000 credits
+#vacuum_cost_page_miss = 10		# 0-10000 credits
+#vacuum_cost_page_dirty = 20		# 0-10000 credits
+#vacuum_cost_limit = 200		# 1-10000 credits
+
+# - Background Writer -
+
+#bgwriter_delay = 200ms			# 10-10000ms between rounds
+#bgwriter_lru_maxpages = 100		# max buffers written/round, 0 disables
+#bgwriter_lru_multiplier = 2.0		# 0-10.0 multiplier on buffers scanned/round
+#bgwriter_flush_after = 512kB		# measured in pages, 0 disables
+
+# - Asynchronous Behavior -
+
+#effective_io_concurrency = 1		# 1-1000; 0 disables prefetching
+#maintenance_io_concurrency = 10	# 1-1000; 0 disables prefetching
+#max_worker_processes = 8		# (change requires restart)
+#max_parallel_maintenance_workers = 2	# taken from max_parallel_workers
+#max_parallel_workers_per_gather = 2	# taken from max_parallel_workers
+#parallel_leader_participation = on
+#max_parallel_workers = 8		# maximum number of max_worker_processes that
+					# can be used in parallel operations
+#old_snapshot_threshold = -1		# 1min-60d; -1 disables; 0 is immediate
+					# (change requires restart)
+#backend_flush_after = 0		# measured in pages, 0 disables
+
+
+#------------------------------------------------------------------------------
+# WRITE-AHEAD LOG
+#------------------------------------------------------------------------------
+
+# - Settings -
+
+#wal_level = replica			# minimal, replica, or logical
+					# (change requires restart)
+#fsync = on				# flush data to disk for crash safety
+					# (turning this off can cause
+					# unrecoverable data corruption)
+#synchronous_commit = on		# synchronization level;
+					# off, local, remote_write, remote_apply, or on
+#wal_sync_method = fsync		# the default is the first option
+					# supported by the operating system:
+					#   open_datasync
+					#   fdatasync (default on Linux and FreeBSD)
+					#   fsync
+					#   fsync_writethrough
+					#   open_sync
+#full_page_writes = on			# recover from partial page writes
+#wal_compression = off			# enable compression of full-page writes
+#wal_log_hints = off			# also do full page writes of non-critical updates
+					# (change requires restart)
+#wal_init_zero = on			# zero-fill new WAL files
+#wal_recycle = on			# recycle WAL files
+#wal_buffers = -1			# min 32kB, -1 sets based on shared_buffers
+					# (change requires restart)
+#wal_writer_delay = 200ms		# 1-10000 milliseconds
+#wal_writer_flush_after = 1MB		# measured in pages, 0 disables
+#wal_skip_threshold = 2MB
+
+#commit_delay = 0			# range 0-100000, in microseconds
+#commit_siblings = 5			# range 1-1000
+
+# - Checkpoints -
+
+#checkpoint_timeout = 5min		# range 30s-1d
+max_wal_size = 1GB
+min_wal_size = 80MB
+#checkpoint_completion_target = 0.5	# checkpoint target duration, 0.0 - 1.0
+#checkpoint_flush_after = 256kB		# measured in pages, 0 disables
+#checkpoint_warning = 30s		# 0 disables
+
+# - Archiving -
+
+#archive_mode = off		# enables archiving; off, on, or always
+				# (change requires restart)
+#archive_command = ''		# command to use to archive a logfile segment
+				# placeholders: %p = path of file to archive
+				#               %f = file name only
+				# e.g. 'test ! -f /mnt/server/archivedir/%f && cp %p /mnt/server/archivedir/%f'
+#archive_timeout = 0		# force a logfile segment switch after this
+				# number of seconds; 0 disables
+
+# - Archive Recovery -
+
+# These are only used in recovery mode.
+
+#restore_command = ''		# command to use to restore an archived logfile segment
+				# placeholders: %p = path of file to restore
+				#               %f = file name only
+				# e.g. 'cp /mnt/server/archivedir/%f %p'
+				# (change requires restart)
+#archive_cleanup_command = ''	# command to execute at every restartpoint
+#recovery_end_command = ''	# command to execute at completion of recovery
+
+# - Recovery Target -
+
+# Set these only when performing a targeted recovery.
+
+#recovery_target = ''		# 'immediate' to end recovery as soon as a
+                                # consistent state is reached
+				# (change requires restart)
+#recovery_target_name = ''	# the named restore point to which recovery will proceed
+				# (change requires restart)
+#recovery_target_time = ''	# the time stamp up to which recovery will proceed
+				# (change requires restart)
+#recovery_target_xid = ''	# the transaction ID up to which recovery will proceed
+				# (change requires restart)
+#recovery_target_lsn = ''	# the WAL LSN up to which recovery will proceed
+				# (change requires restart)
+#recovery_target_inclusive = on # Specifies whether to stop:
+				# just after the specified recovery target (on)
+				# just before the recovery target (off)
+				# (change requires restart)
+#recovery_target_timeline = 'latest'	# 'current', 'latest', or timeline ID
+				# (change requires restart)
+#recovery_target_action = 'pause'	# 'pause', 'promote', 'shutdown'
+				# (change requires restart)
+
+
+#------------------------------------------------------------------------------
+# REPLICATION
+#------------------------------------------------------------------------------
+
+# - Sending Servers -
+
+# Set these on the master and on any standby that will send replication data.
+
+#max_wal_senders = 10		# max number of walsender processes
+				# (change requires restart)
+#wal_keep_size = 0		# in megabytes; 0 disables
+#max_slot_wal_keep_size = -1	# in megabytes; -1 disables
+#wal_sender_timeout = 60s	# in milliseconds; 0 disables
+
+#max_replication_slots = 10	# max number of replication slots
+				# (change requires restart)
+#track_commit_timestamp = off	# collect timestamp of transaction commit
+				# (change requires restart)
+
+# - Master Server -
+
+# These settings are ignored on a standby server.
+
+#synchronous_standby_names = ''	# standby servers that provide sync rep
+				# method to choose sync standbys, number of sync standbys,
+				# and comma-separated list of application_name
+				# from standby(s); '*' = all
+#vacuum_defer_cleanup_age = 0	# number of xacts by which cleanup is delayed
+
+# - Standby Servers -
+
+# These settings are ignored on a master server.
+
+#primary_conninfo = ''			# connection string to sending server
+#primary_slot_name = ''			# replication slot on sending server
+#promote_trigger_file = ''		# file name whose presence ends recovery
+#hot_standby = on			# "off" disallows queries during recovery
+					# (change requires restart)
+#max_standby_archive_delay = 30s	# max delay before canceling queries
+					# when reading WAL from archive;
+					# -1 allows indefinite delay
+#max_standby_streaming_delay = 30s	# max delay before canceling queries
+					# when reading streaming WAL;
+					# -1 allows indefinite delay
+#wal_receiver_create_temp_slot = off	# create temp slot if primary_slot_name
+					# is not set
+#wal_receiver_status_interval = 10s	# send replies at least this often
+					# 0 disables
+#hot_standby_feedback = off		# send info from standby to prevent
+					# query conflicts
+#wal_receiver_timeout = 60s		# time that receiver waits for
+					# communication from master
+					# in milliseconds; 0 disables
+#wal_retrieve_retry_interval = 5s	# time to wait before retrying to
+					# retrieve WAL after a failed attempt
+#recovery_min_apply_delay = 0		# minimum delay for applying changes during recovery
+
+# - Subscribers -
+
+# These settings are ignored on a publisher.
+
+#max_logical_replication_workers = 4	# taken from max_worker_processes
+					# (change requires restart)
+#max_sync_workers_per_subscription = 2	# taken from max_logical_replication_workers
+
+
+#------------------------------------------------------------------------------
+# QUERY TUNING
+#------------------------------------------------------------------------------
+
+# - Planner Method Configuration -
+
+#enable_bitmapscan = on
+#enable_hashagg = on
+#enable_hashjoin = on
+#enable_indexscan = on
+#enable_indexonlyscan = on
+#enable_material = on
+#enable_mergejoin = on
+#enable_nestloop = on
+#enable_parallel_append = on
+#enable_seqscan = on
+#enable_sort = on
+#enable_incremental_sort = on
+#enable_tidscan = on
+#enable_partitionwise_join = off
+#enable_partitionwise_aggregate = off
+#enable_parallel_hash = on
+#enable_partition_pruning = on
+
+# - Planner Cost Constants -
+
+#seq_page_cost = 1.0			# measured on an arbitrary scale
+#random_page_cost = 4.0			# same scale as above
+#cpu_tuple_cost = 0.01			# same scale as above
+#cpu_index_tuple_cost = 0.005		# same scale as above
+#cpu_operator_cost = 0.0025		# same scale as above
+#parallel_tuple_cost = 0.1		# same scale as above
+#parallel_setup_cost = 1000.0	# same scale as above
+
+#jit_above_cost = 100000		# perform JIT compilation if available
+					# and query more expensive than this;
+					# -1 disables
+#jit_inline_above_cost = 500000		# inline small functions if query is
+					# more expensive than this; -1 disables
+#jit_optimize_above_cost = 500000	# use expensive JIT optimizations if
+					# query is more expensive than this;
+					# -1 disables
+
+#min_parallel_table_scan_size = 8MB
+#min_parallel_index_scan_size = 512kB
+#effective_cache_size = 4GB
+
+# - Genetic Query Optimizer -
+
+#geqo = on
+#geqo_threshold = 12
+#geqo_effort = 5			# range 1-10
+#geqo_pool_size = 0			# selects default based on effort
+#geqo_generations = 0			# selects default based on effort
+#geqo_selection_bias = 2.0		# range 1.5-2.0
+#geqo_seed = 0.0			# range 0.0-1.0
+
+# - Other Planner Options -
+
+#default_statistics_target = 100	# range 1-10000
+#constraint_exclusion = partition	# on, off, or partition
+#cursor_tuple_fraction = 0.1		# range 0.0-1.0
+#from_collapse_limit = 8
+#join_collapse_limit = 8		# 1 disables collapsing of explicit
+					# JOIN clauses
+#force_parallel_mode = off
+#jit = on				# allow JIT compilation
+#plan_cache_mode = auto			# auto, force_generic_plan or
+					# force_custom_plan
+
+
+#------------------------------------------------------------------------------
+# REPORTING AND LOGGING
+#------------------------------------------------------------------------------
+
+# - Where to Log -
+
+log_destination = 'stderr'		# Valid values are combinations of
+					# stderr, csvlog, syslog, and eventlog,
+					# depending on platform.  csvlog
+					# requires logging_collector to be on.
+
+# This is used when logging to stderr:
+logging_collector = on			# Enable capturing of stderr and csvlog
+					# into log files. Required to be on for
+					# csvlogs.
+					# (change requires restart)
+
+# These are only used if logging_collector is on:
+log_directory = 'log'			# directory where log files are written,
+					# can be absolute or relative to PGDATA
+log_filename = 'postgresql-%a.log'	# log file name pattern,
+					# can include strftime() escapes
+#log_file_mode = 0600			# creation mode for log files,
+					# begin with 0 to use octal notation
+log_truncate_on_rotation = on		# If on, an existing log file with the
+					# same name as the new log file will be
+					# truncated rather than appended to.
+					# But such truncation only occurs on
+					# time-driven rotation, not on restarts
+					# or size-driven rotation.  Default is
+					# off, meaning append to existing files
+					# in all cases.
+log_rotation_age = 1d			# Automatic rotation of logfiles will
+					# happen after that time.  0 disables.
+log_rotation_size = 0			# Automatic rotation of logfiles will
+					# happen after that much log output.
+					# 0 disables.
+
+# These are relevant when logging to syslog:
+#syslog_facility = 'LOCAL0'
+#syslog_ident = 'postgres'
+#syslog_sequence_numbers = on
+#syslog_split_messages = on
+
+# This is only relevant when logging to eventlog (win32):
+# (change requires restart)
+#event_source = 'PostgreSQL'
+
+# - When to Log -
+
+#log_min_messages = warning		# values in order of decreasing detail:
+					#   debug5
+					#   debug4
+					#   debug3
+					#   debug2
+					#   debug1
+					#   info
+					#   notice
+					#   warning
+					#   error
+					#   log
+					#   fatal
+					#   panic
+
+#log_min_error_statement = error	# values in order of decreasing detail:
+					#   debug5
+					#   debug4
+					#   debug3
+					#   debug2
+					#   debug1
+					#   info
+					#   notice
+					#   warning
+					#   error
+					#   log
+					#   fatal
+					#   panic (effectively off)
+
+#log_min_duration_statement = -1	# -1 is disabled, 0 logs all statements
+					# and their durations, > 0 logs only
+					# statements running at least this number
+					# of milliseconds
+
+#log_min_duration_sample = -1		# -1 is disabled, 0 logs a sample of statements
+					# and their durations, > 0 logs only a sample of
+					# statements running at least this number
+					# of milliseconds;
+					# sample fraction is determined by log_statement_sample_rate
+
+#log_statement_sample_rate = 1.0	# fraction of logged statements exceeding
+					# log_min_duration_sample to be logged;
+					# 1.0 logs all such statements, 0.0 never logs
+
+
+#log_transaction_sample_rate = 0.0	# fraction of transactions whose statements
+					# are logged regardless of their duration; 1.0 logs all
+					# statements from all transactions, 0.0 never logs
+
+# - What to Log -
+
+#debug_print_parse = off
+#debug_print_rewritten = off
+#debug_print_plan = off
+#debug_pretty_print = on
+#log_checkpoints = off
+#log_connections = off
+#log_disconnections = off
+#log_duration = off
+#log_error_verbosity = default		# terse, default, or verbose messages
+#log_hostname = off
+log_line_prefix = '%m [%p] '		# special values:
+					#   %a = application name
+					#   %u = user name
+					#   %d = database name
+					#   %r = remote host and port
+					#   %h = remote host
+					#   %b = backend type
+					#   %p = process ID
+					#   %t = timestamp without milliseconds
+					#   %m = timestamp with milliseconds
+					#   %n = timestamp with milliseconds (as a Unix epoch)
+					#   %i = command tag
+					#   %e = SQL state
+					#   %c = session ID
+					#   %l = session line number
+					#   %s = session start timestamp
+					#   %v = virtual transaction ID
+					#   %x = transaction ID (0 if none)
+					#   %q = stop here in non-session
+					#        processes
+					#   %% = '%'
+					# e.g. '<%u%%%d> '
+#log_lock_waits = off			# log lock waits >= deadlock_timeout
+#log_parameter_max_length = -1		# when logging statements, limit logged
+					# bind-parameter values to N bytes;
+					# -1 means print in full, 0 disables
+#log_parameter_max_length_on_error = 0	# when logging an error, limit logged
+					# bind-parameter values to N bytes;
+					# -1 means print in full, 0 disables
+#log_statement = 'none'			# none, ddl, mod, all
+#log_replication_commands = off
+#log_temp_files = -1			# log temporary files equal or larger
+					# than the specified size in kilobytes;
+					# -1 disables, 0 logs all temp files
+log_timezone = 'UTC'
+
+#------------------------------------------------------------------------------
+# PROCESS TITLE
+#------------------------------------------------------------------------------
+
+#cluster_name = ''			# added to process titles if nonempty
+					# (change requires restart)
+#update_process_title = on
+
+
+#------------------------------------------------------------------------------
+# STATISTICS
+#------------------------------------------------------------------------------
+
+# - Query and Index Statistics Collector -
+
+#track_activities = on
+#track_counts = on
+#track_io_timing = off
+#track_functions = none			# none, pl, all
+#track_activity_query_size = 1024	# (change requires restart)
+#stats_temp_directory = 'pg_stat_tmp'
+
+
+# - Monitoring -
+
+#log_parser_stats = off
+#log_planner_stats = off
+#log_executor_stats = off
+#log_statement_stats = off
+
+
+#------------------------------------------------------------------------------
+# AUTOVACUUM
+#------------------------------------------------------------------------------
+
+#autovacuum = on			# Enable autovacuum subprocess?  'on'
+					# requires track_counts to also be on.
+#log_autovacuum_min_duration = -1	# -1 disables, 0 logs all actions and
+					# their durations, > 0 logs only
+					# actions running at least this number
+					# of milliseconds.
+#autovacuum_max_workers = 3		# max number of autovacuum subprocesses
+					# (change requires restart)
+#autovacuum_naptime = 1min		# time between autovacuum runs
+#autovacuum_vacuum_threshold = 50	# min number of row updates before
+					# vacuum
+#autovacuum_vacuum_insert_threshold = 1000	# min number of row inserts
+					# before vacuum; -1 disables insert
+					# vacuums
+#autovacuum_analyze_threshold = 50	# min number of row updates before
+					# analyze
+#autovacuum_vacuum_scale_factor = 0.2	# fraction of table size before vacuum
+#autovacuum_vacuum_insert_scale_factor = 0.2	# fraction of inserts over table
+					# size before insert vacuum
+#autovacuum_analyze_scale_factor = 0.1	# fraction of table size before analyze
+#autovacuum_freeze_max_age = 200000000	# maximum XID age before forced vacuum
+					# (change requires restart)
+#autovacuum_multixact_freeze_max_age = 400000000	# maximum multixact age
+					# before forced vacuum
+					# (change requires restart)
+#autovacuum_vacuum_cost_delay = 2ms	# default vacuum cost delay for
+					# autovacuum, in milliseconds;
+					# -1 means use vacuum_cost_delay
+#autovacuum_vacuum_cost_limit = -1	# default vacuum cost limit for
+					# autovacuum, -1 means use
+					# vacuum_cost_limit
+
+
+#------------------------------------------------------------------------------
+# CLIENT CONNECTION DEFAULTS
+#------------------------------------------------------------------------------
+
+# - Statement Behavior -
+
+#client_min_messages = notice		# values in order of decreasing detail:
+					#   debug5
+					#   debug4
+					#   debug3
+					#   debug2
+					#   debug1
+					#   log
+					#   notice
+					#   warning
+					#   error
+#search_path = '"$user", public'	# schema names
+#row_security = on
+#default_tablespace = ''		# a tablespace name, '' uses the default
+#temp_tablespaces = ''			# a list of tablespace names, '' uses
+					# only default tablespace
+#default_table_access_method = 'heap'
+#check_function_bodies = on
+#default_transaction_isolation = 'read committed'
+#default_transaction_read_only = off
+#default_transaction_deferrable = off
+#session_replication_role = 'origin'
+#statement_timeout = 0			# in milliseconds, 0 is disabled
+#lock_timeout = 0			# in milliseconds, 0 is disabled
+#idle_in_transaction_session_timeout = 0	# in milliseconds, 0 is disabled
+#vacuum_freeze_min_age = 50000000
+#vacuum_freeze_table_age = 150000000
+#vacuum_multixact_freeze_min_age = 5000000
+#vacuum_multixact_freeze_table_age = 150000000
+#vacuum_cleanup_index_scale_factor = 0.1	# fraction of total number of tuples
+						# before index cleanup, 0 always performs
+						# index cleanup
+#bytea_output = 'hex'			# hex, escape
+#xmlbinary = 'base64'
+#xmloption = 'content'
+#gin_fuzzy_search_limit = 0
+#gin_pending_list_limit = 4MB
+
+# - Locale and Formatting -
+
+datestyle = 'iso, mdy'
+#intervalstyle = 'postgres'
+timezone = 'UTC'
+#timezone_abbreviations = 'Default'     # Select the set of available time zone
+					# abbreviations.  Currently, there are
+					#   Default
+					#   Australia (historical usage)
+					#   India
+					# You can create your own file in
+					# share/timezonesets/.
+#extra_float_digits = 1			# min -15, max 3; any value >0 actually
+					# selects precise output mode
+#client_encoding = sql_ascii		# actually, defaults to database
+					# encoding
+
+# These settings are initialized by initdb, but they can be changed.
+lc_messages = 'en_US.UTF-8'			# locale for system error message
+					# strings
+lc_monetary = 'en_US.UTF-8'			# locale for monetary formatting
+lc_numeric = 'en_US.UTF-8'			# locale for number formatting
+lc_time = 'en_US.UTF-8'				# locale for time formatting
+
+# default configuration for text search
+default_text_search_config = 'pg_catalog.english'
+
+# - Shared Library Preloading -
+
+#shared_preload_libraries = ''	# (change requires restart)
+#local_preload_libraries = ''
+#session_preload_libraries = ''
+#jit_provider = 'llvmjit'		# JIT library to use
+
+# - Other Defaults -
+
+#dynamic_library_path = '$libdir'
+
+
+#------------------------------------------------------------------------------
+# LOCK MANAGEMENT
+#------------------------------------------------------------------------------
+
+#deadlock_timeout = 1s
+#max_locks_per_transaction = 64		# min 10
+					# (change requires restart)
+#max_pred_locks_per_transaction = 64	# min 10
+					# (change requires restart)
+#max_pred_locks_per_relation = -2	# negative values mean
+					# (max_pred_locks_per_transaction
+					#  / -max_pred_locks_per_relation) - 1
+#max_pred_locks_per_page = 2            # min 0
+
+
+#------------------------------------------------------------------------------
+# VERSION AND PLATFORM COMPATIBILITY
+#------------------------------------------------------------------------------
+
+# - Previous PostgreSQL Versions -
+
+#array_nulls = on
+#backslash_quote = safe_encoding	# on, off, or safe_encoding
+#escape_string_warning = on
+#lo_compat_privileges = off
+#operator_precedence_warning = off
+#quote_all_identifiers = off
+#standard_conforming_strings = on
+#synchronize_seqscans = on
+
+# - Other Platforms and Clients -
+
+#transform_null_equals = off
+
+
+#------------------------------------------------------------------------------
+# ERROR HANDLING
+#------------------------------------------------------------------------------
+
+#exit_on_error = off			# terminate session on any error?
+#restart_after_crash = on		# reinitialize after backend crash?
+#data_sync_retry = off			# retry or panic on failure to fsync
+					# data?
+					# (change requires restart)
+
+
+#------------------------------------------------------------------------------
+# CONFIG FILE INCLUDES
+#------------------------------------------------------------------------------
+
+# These options allow settings to be loaded from files other than the
+# default postgresql.conf.  Note that these are directives, not variable
+# assignments, so they can usefully be given more than once.
+
+#include_dir = '...'			# include files ending in '.conf' from
+					# a directory, e.g., 'conf.d'
+#include_if_exists = '...'		# include file only if it exists
+#include = '...'			# include file
+include = 'postgresql-epiphany.conf'	# Epiphany managed configuration that overrides settings above
+
+
+#------------------------------------------------------------------------------
+# CUSTOMIZED OPTIONS
+#------------------------------------------------------------------------------
+
+# Add settings for extensions here
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/main.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/main.yml
index abe9a5731e..d7c8dc5700 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/main.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/main.yml
@@ -22,11 +22,11 @@
   vars:
     _packages:
       Debian:
-        - postgresql-10
-        - postgresql-contrib-10
+        - postgresql-13
+        - postgresql-contrib-13
         - python-psycopg2 # required for postgresql ansible management
       RedHat:
-        - postgresql10-server
+        - postgresql13-server
         - python-psycopg2 # required for postgresql ansible management
   module_defaults:
     yum: { lock_timeout: "{{ yum_lock_timeout }}" }
@@ -38,14 +38,16 @@
     loop_var: data
   loop: "{{ enabled_extensions }}"
 
-- name: Create directory /var/log/postgresql
-  # The same permissions as for PG installed on RHEL from Software Collections (different on Ubuntu)
+- name: Create directories and ensure correct permissions
   file:
-    path: /var/log/postgresql
+    path: "{{ item }}"
     state: directory
     owner: postgres
     group: postgres
     mode: u=rwx,g=,o=
+  loop:
+    - /var/log/postgresql
+    - "{{ pg.data_dir[ansible_os_family] }}" # Permissions should be u=rwx (0700) or u=rwx,g=rx (0750)
 
 - name: RedHat | Initialize database
   block:
@@ -55,17 +57,19 @@
       register: pg_hba_conf_stat
 
     - name: Initialize database (RedHat)
-      command: /usr/pgsql-10/bin/postgresql-10-setup initdb {{ pg.service_name[ansible_os_family] }}
+      command: /usr/pgsql-13/bin/postgresql-13-setup initdb {{ pg.service_name[ansible_os_family] }}
       when:
         - not pg_hba_conf_stat.stat.exists
   when:
     - ansible_os_family == 'RedHat'
 
-- name: Change pg_hba.conf
-  replace:
-    path: "{{ pg.config_dir[ansible_os_family] }}/pg_hba.conf"
-    regexp: '^host\s+all\s+all\s+127\.0\.0\.1/32\s+(?:ident|md5)$'
-    replace: 'host    all             all             0.0.0.0/0               md5'
+- name: Copy pg_hba.conf
+  template:
+    src: pg_hba.conf.j2
+    dest: "{{ pg.config_dir[ansible_os_family] }}/pg_hba.conf"
+    owner: postgres
+    group: postgres
+    mode: u=rw,g=,o=
     backup: true
   register: change_pg_hba_conf
 
@@ -104,12 +108,13 @@
     mode: u=rw,g=,o=
   register: change_postgresql_epiphany_conf
 
-- name: Change postgresql.conf
-  lineinfile:
-    path: "{{ pg.config_dir[ansible_os_family] }}/postgresql.conf"
-    line: "include = 'postgresql-epiphany.conf'	# Epiphany managed configuration that overrides above settings"
-    insertafter: '^#include ' # insert line after the last 'include' to override all settings
-    firstmatch: false
+- name: Copy postgresql.conf
+  copy:
+    src: postgresql.conf
+    dest: "{{ pg.config_dir[ansible_os_family] }}/postgresql.conf"
+    owner: postgres
+    group: postgres
+    mode: u=rw,g=,o=
     backup: true
   register: change_postgresql_conf
 
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/pg_hba.conf.j2 b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/pg_hba.conf.j2
new file mode 100755
index 0000000000..4e6397586c
--- /dev/null
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/pg_hba.conf.j2
@@ -0,0 +1,98 @@
+# {{ ansible_managed }}
+# PostgreSQL Client Authentication Configuration File
+# ===================================================
+#
+# Refer to the "Client Authentication" section in the PostgreSQL
+# documentation for a complete description of this file.  A short
+# synopsis follows.
+#
+# This file controls: which hosts are allowed to connect, how clients
+# are authenticated, which PostgreSQL user names they can use, which
+# databases they can access.  Records take one of these forms:
+#
+# local         DATABASE  USER  METHOD  [OPTIONS]
+# host          DATABASE  USER  ADDRESS  METHOD  [OPTIONS]
+# hostssl       DATABASE  USER  ADDRESS  METHOD  [OPTIONS]
+# hostnossl     DATABASE  USER  ADDRESS  METHOD  [OPTIONS]
+# hostgssenc    DATABASE  USER  ADDRESS  METHOD  [OPTIONS]
+# hostnogssenc  DATABASE  USER  ADDRESS  METHOD  [OPTIONS]
+#
+# (The uppercase items must be replaced by actual values.)
+#
+# The first field is the connection type: "local" is a Unix-domain
+# socket, "host" is either a plain or SSL-encrypted TCP/IP socket,
+# "hostssl" is an SSL-encrypted TCP/IP socket, and "hostnossl" is a
+# non-SSL TCP/IP socket.  Similarly, "hostgssenc" uses a
+# GSSAPI-encrypted TCP/IP socket, while "hostnogssenc" uses a
+# non-GSSAPI socket.
+#
+# DATABASE can be "all", "sameuser", "samerole", "replication", a
+# database name, or a comma-separated list thereof. The "all"
+# keyword does not match "replication". Access to replication
+# must be enabled in a separate record (see example below).
+#
+# USER can be "all", a user name, a group name prefixed with "+", or a
+# comma-separated list thereof.  In both the DATABASE and USER fields
+# you can also write a file name prefixed with "@" to include names
+# from a separate file.
+#
+# ADDRESS specifies the set of hosts the record matches.  It can be a
+# host name, or it is made up of an IP address and a CIDR mask that is
+# an integer (between 0 and 32 (IPv4) or 128 (IPv6) inclusive) that
+# specifies the number of significant bits in the mask.  A host name
+# that starts with a dot (.) matches a suffix of the actual host name.
+# Alternatively, you can write an IP address and netmask in separate
+# columns to specify the set of hosts.  Instead of a CIDR-address, you
+# can write "samehost" to match any of the server's own IP addresses,
+# or "samenet" to match any address in any subnet that the server is
+# directly connected to.
+#
+# METHOD can be "trust", "reject", "md5", "password", "scram-sha-256",
+# "gss", "sspi", "ident", "peer", "pam", "ldap", "radius" or "cert".
+# Note that "password" sends passwords in clear text; "md5" or
+# "scram-sha-256" are preferred since they send encrypted passwords.
+#
+# OPTIONS are a set of options for the authentication in the format
+# NAME=VALUE.  The available options depend on the different
+# authentication methods -- refer to the "Client Authentication"
+# section in the documentation for a list of which options are
+# available for which authentication methods.
+#
+# Database and user names containing spaces, commas, quotes and other
+# special characters must be quoted.  Quoting one of the keywords
+# "all", "sameuser", "samerole" or "replication" makes the name lose
+# its special character, and just match a database or username with
+# that name.
+#
+# This file is read on server startup and when the server receives a
+# SIGHUP signal.  If you edit the file on a running system, you have to
+# SIGHUP the server for the changes to take effect, run "pg_ctl reload",
+# or execute "SELECT pg_reload_conf()".
+#
+# Put your actual configuration here
+# ----------------------------------
+#
+# If you want to allow non-local connections, you need to add more
+# "host" records.  In that case you will also need to make PostgreSQL
+# listen on a non-local interface via the listen_addresses
+# configuration parameter, or via the -i or -h command line switches.
+
+
+
+# TYPE  DATABASE        USER            ADDRESS                 METHOD
+
+# "local" is for Unix domain socket connections only
+local   all             all                                     peer
+# IPv4 connections:
+host    all             all             0.0.0.0/0               scram-sha-256
+# IPv6 local connections:
+host    all             all             ::1/128                 scram-sha-256
+# Allow replication connections from localhost, by a user with the
+# replication privilege.
+local   replication     all                                     peer
+host    replication     all             127.0.0.1/32            scram-sha-256
+host    replication     all             ::1/128                 scram-sha-256
+
+{% if specification.extensions.replication.enabled is defined and specification.extensions.replication.enabled %}
+host    replication     {{ specification.extensions.replication.replication_user_name }}      0.0.0.0/0               scram-sha-256
+{% endif %}
\ No newline at end of file

From e63cb7ff4a5fb6058c8360be4936893efcec9c75 Mon Sep 17 00:00:00 2001
From: atsikham <atsikham@users.noreply.github.com>
Date: Wed, 19 May 2021 01:21:24 +0200
Subject: [PATCH 06/28] Repmgr RedHat installation

---
 .../extensions/replication/extension.yml      | 227 +++++++++---------
 .../roles/postgresql/templates/repmgr.conf.j2 |   4 +-
 .../playbooks/roles/preflight/tasks/apply.yml |  13 +-
 3 files changed, 122 insertions(+), 122 deletions(-)

diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml
index 44df453cb9..18ff2e2a77 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml
@@ -13,9 +13,12 @@
   lineinfile:
     path: /etc/sudoers
     line: >-
-      'postgres ALL=(ALL:ALL) NOPASSWD: /bin/systemctl start postgresql,
-      /bin/systemctl stop postgresql, /bin/systemctl restart postgresql,
-      /bin/systemctl reload postgresql'
+      postgres ALL=(ALL:ALL) NOPASSWD:
+      /bin/systemctl start {{ pg.service_name[ansible_os_family] }},
+      /bin/systemctl stop {{ pg.service_name[ansible_os_family] }},
+      /bin/systemctl restart {{ pg.service_name[ansible_os_family] }},
+      /bin/systemctl reload {{ pg.service_name[ansible_os_family] }},
+      {{ repmgr.bindir[ansible_os_family] }}/repmgr standby follow
     validate: 'visudo -cf %s'
 
 - name: Extensions | Repmgr | Create super user in postgresql
@@ -40,19 +43,7 @@
     group: postgres
     mode: u=rw,g=,o=
 
-- name: Extensions | Repmgr | Add replication user to pg_hba.conf
-  lineinfile:
-    path: "{{ pg.config_dir[ansible_os_family] }}/pg_hba.conf"
-    line: "host    replication     {{ specification.extensions.replication.replication_user_name }}      0.0.0.0/0               md5"
-  register: modify_pg_hba_conf
-
-- name: Extensions | Repmgr | Restart postgresql service
-  systemd:
-    name: "{{ pg.service_name[ansible_os_family] }}"
-    state: restarted
-  when: modify_pg_hba_conf.changed
-
-  # --- Configure repmgr ---
+# --- Configure repmgr ---
 
 - name: Extensions | Repmgr | Create database for repmgr
   become_user: postgres
@@ -60,6 +51,13 @@
     name: "{{ specification.extensions.replication.repmgr_database }}"
     owner: "{{ specification.extensions.replication.replication_user_name }}"
 
+# Node id is a constant value independent on order in Ansible host group
+- name: Extensions | Repmgr | Set node id
+  set_fact:
+    pg_repmgr_node_id: >-
+      {{ pg_repmgr_node_id | default(groups.postgresql.index(inventory_hostname) + 1) }}
+    cacheable: true
+
 - name: Extensions | Repmgr | Create repmgr config file
   template:
     src: repmgr.conf.j2
@@ -69,80 +67,64 @@
     mode: u=rw,g=,o=
   register: template_repmgr_conf
   vars:
-    node_id: "{{ (groups.postgresql.index(inventory_hostname) + 1) }}"
-
-# On Ubuntu config file location is not set by package (see https://repmgr.org/docs/4.0/packages-debian-ubuntu.html).
-# Create symlink to allow using repmgr commands without specifying config file location (which is custom).
-# See https://repmgr.org/docs/4.0/configuration-file.html
-- name: Extensions | Repmgr | Debian specific tasks
-  when: ansible_os_family == 'Debian'
-  block:
-    - name: Extensions | Repmgr | Create symlink /etc/repmgr.conf
-      file:
-        src: "{{ template_repmgr_conf.dest }}"
-        dest: /etc/repmgr.conf
-        state: link
-        owner: postgres
-        group: postgres
-      when: template_repmgr_conf.dest != '/etc/repmgr.conf'
-
-    # For repmgr installed from Ubuntu package additional configuration is required before repmgrd is started as daemon
-    - name: Extensions | Repmgr | Set repmgr.conf file in /etc/default/repmgrd
-      replace:
-        path: /etc/default/repmgrd
-        regexp: "^#REPMGRD_CONF=\"/path/to/repmgr.conf\""
-        replace: "REPMGRD_CONF=\"{{ repmgr.config_dir[ansible_os_family] }}/repmgr.conf\""
-
-    - name: Extensions | Repmgr | Enable repmgrd in /etc/default/repmgrd
-      replace:
-        path: /etc/default/repmgrd
-        regexp: "^[#]?REPMGRD_ENABLED=no"
-        replace: "REPMGRD_ENABLED=yes"
-
-# --- Configure primary node ---
-
-- name: Extensions | Repmgr | Tasks to run only on primary node
-  when: groups.postgresql[0] == inventory_hostname
+    node_id: "{{ pg_repmgr_node_id }}"
+
+## On Ubuntu config file location is not set by package (see https://repmgr.org/docs/4.0/packages-debian-ubuntu.html).
+## Create symlink to allow using repmgr commands without specifying config file location (which is custom).
+## See https://repmgr.org/docs/4.0/configuration-file.html
+#- name: Extensions | Repmgr | Debian specific tasks
+#  when: ansible_os_family == 'Debian'
+#  block:
+#    - name: Extensions | Repmgr | Create symlink /etc/repmgr.conf
+#      file:
+#        src: "{{ template_repmgr_conf.dest }}"
+#        dest: /etc/repmgr.conf
+#        state: link
+#        owner: postgres
+#        group: postgres
+#      when: template_repmgr_conf.dest != '/etc/repmgr.conf'
+#
+#    # For repmgr installed from Ubuntu package additional configuration is required before repmgrd is started as daemon
+#    - name: Extensions | Repmgr | Set repmgr.conf file in /etc/default/repmgrd
+#      replace:
+#        path: /etc/default/repmgrd
+#        regexp: "^#REPMGRD_CONF=\"/path/to/repmgr.conf\""
+#        replace: "REPMGRD_CONF=\"{{ repmgr.config_dir[ansible_os_family] }}/repmgr.conf\""
+#
+#    - name: Extensions | Repmgr | Enable repmgrd in /etc/default/repmgrd
+#      replace:
+#        path: /etc/default/repmgrd
+#        regexp: "^[#]?REPMGRD_ENABLED=no"
+#        replace: "REPMGRD_ENABLED=yes"
+
+- name: Extensions | Repmgr | Check cluster status
+  become_user: postgres
+  command: "{{ repmgr.bindir[ansible_os_family] }}/repmgr cluster show --csv"
+  register: pg_cluster_status
+  # 25 means there is an error with at least one registered node
+  # sometimes 'repmgr cluster show' returns 25 code with empty stderr and no explaination
+  failed_when: pg_cluster_status.rc not in [0, 25] or pg_cluster_status.stdout_lines|length > groups.postgresql|length
+
+# There is a preflight check that no more than 2 cluster nodes are supported
+- name: Extensions | Repmgr | Set 'pg_is_clustered' fact
+  set_fact:
+    pg_is_clustered: "{{ pg_cluster_status.stdout_lines | length }} == 2"
+
+- name: Extensions | Repmgr | Configure PostgreSQL cluster
+  when: not pg_is_clustered
+  vars:
+    pg_node_primary: "{{ groups.postgresql[0] }}" # the first node in the group is primary
   block:
-    - name: Extensions | Repmgr | Check if primary node is already registered in repmgr cluster
-      become_user: postgres
-      shell: >-
-        set -o pipefail &&
-        {{ repmgr.bindir[ansible_os_family] }}/repmgr cluster show | grep -iw {{ inventory_hostname }} | grep -vw standby
-      changed_when: false
-      register: is_primary_already_registered
-      failed_when: is_primary_already_registered.rc not in [0, 1]
-
     - name: Extensions | Repmgr | Register primary node
-      when: is_primary_already_registered.stdout == ""
-      block:
-        - name: Register primary node
-          become_user: postgres
-          command: >-
-            {{ repmgr.bindir[ansible_os_family] }}/repmgr primary register
-            --superuser={{ specification.extensions.replication.privileged_user_name }} --force
-
-        - name: Extensions | Repmgr | Restart repmgrd service
-          service:
-            name: "{{ repmgr.service_name[ansible_os_family] }}"
-            state: restarted
-
-# --- Configure standby node ---
-
-- name: Extensions | Repmgr | Tasks to run only on standby node
-  when: groups.postgresql[1] == inventory_hostname
-  block:
-    - name: Extensions | Repmgr | Check if node is already registered in repmgr cluster
+      when: pg_node_primary == inventory_hostname
       become_user: postgres
-      shell: >-
-        set -o pipefail &&
-        {{ repmgr.bindir[ansible_os_family] }}/repmgr cluster show | grep -iw {{ inventory_hostname }}
-      changed_when: false
-      register: is_node_already_registered
-      failed_when: is_node_already_registered.rc not in [0, 1]
+      command: >-
+        {{ repmgr.bindir[ansible_os_family] }}/repmgr primary register
+          --superuser={{ specification.extensions.replication.privileged_user_name }}
+          --force
 
-    - name: Extensions | Repmgr | Clone node from primary and register
-      when: is_node_already_registered.stdout == ""
+    - name: Extensions | Repmgr | Clone standby node from primary and register
+      when: pg_node_primary != inventory_hostname
       block:
         # Ubuntu specific: there are two systemd unit files: postgresql.service (service for managing all clusters
         # on system) and postgresql@.service (service template for clusters). The latter is 'PartOf' the former.
@@ -161,13 +143,13 @@
                 - "{{ pg.service_name['RedHat'] }}"
           loop: "{{ _services[ansible_os_family] }}"
 
-        - name: Extensions | Repmgr | Clone node with repmgr
+        - name: Extensions | Repmgr | Clone standby node with repmgr
           become_user: postgres
           command: >-
             {{ repmgr.bindir[ansible_os_family] }}/repmgr standby clone
-            -h {{ hostvars[groups.postgresql[0]].ansible_default_ipv4.address }}
-            -U {{ specification.extensions.replication.privileged_user_name }}
-            -d {{ specification.extensions.replication.repmgr_database }} -p 5432 --force
+              -h {{ hostvars[groups.postgresql[0]].ansible_default_ipv4.address }}
+              -U {{ specification.extensions.replication.privileged_user_name }}
+              -d {{ specification.extensions.replication.repmgr_database }} -p 5432 --force
 
         - name: Extensions | Repmgr | Start postgresql service
           systemd:
@@ -178,38 +160,47 @@
           become_user: postgres
           command: >-
             {{ repmgr.bindir[ansible_os_family] }}/repmgr standby register --force
-              -f  {{ repmgr.config_dir[ansible_os_family] }}/repmgr.conf
               --upstream-conninfo='host={{ hostvars[groups['postgresql'][0]]['ansible_default_ipv4']['address'] }},
-                user={{ specification.extensions.replication.replication_user_name }},
-                dbname={{ specification.extensions.replication.repmgr_database }},
-                connect_timeout=2'
+                  user={{ specification.extensions.replication.replication_user_name }},
+                  dbname={{ specification.extensions.replication.repmgr_database }},
+                  connect_timeout=2'
               --upstream-node-id 1
 
-        - name: Extensions | Repmgr | Restart repmgrd service
-          systemd:
-            name: "{{ repmgr.service_name[ansible_os_family] }}"
-            state: restarted
+    - name: Extensions | Repmgr | Restart and enable repmgr service
+      systemd:
+        name: "{{ repmgr.service_name[ansible_os_family] }}"
+        state: restarted
+        enabled: true
 
-    - name: Extensions | Repmgr | Check if node is not attached to repmgr
+- name: Extensions | Repmgr | Check already configured cluster
+  when: pg_is_clustered
+  block:
+    - name: Extensions | Repmgr | Search for a primary node
       become_user: postgres
-      shell: >-
-        set -o pipefail &&
-        {{ repmgr.bindir[ansible_os_family] }}/repmgr cluster show | grep -i 'not attached to its upstream node'
+      shell: |-
+        set -o pipefail && \
+        {{ repmgr.bindir[ansible_os_family] }}/repmgr cluster show \
+          | awk 'BEGIN{FS="|"} {gsub(/ /,""); if ($3 == "primary") print $2}'
       changed_when: false
-      register: is_node_not_attached
-      failed_when: is_node_not_attached.rc not in [0, 1]
+      register: pg_node_primary_found
+      failed_when: pg_node_primary_found.rc != 0 or pg_node_primary_found.stdout == ""
 
-    - name: Extensions | Repmgr | Attach active standby to current primary node
-      become_user: postgres
-      command: >-
-        {{ repmgr.bindir[ansible_os_family] }}/repmgr standby
-          -f {{ repmgr.config_dir[ansible_os_family] }}/repmgr.conf
-          follow
-      when:
-        - is_node_not_attached.stdout | length > 0
-
-- name: Extensions | Repmgr | Restart repmgr service
-  service:
-    name: "{{ repmgr.service_name[ansible_os_family] }}"
-    state: restarted
-    enabled: true
+    - name: Extensions | Repmgr | Tasks to run only on standby node
+      when: pg_node_primary_found.stdout != inventory_hostname
+      block:
+        - name: Extensions | Repmgr | Check if node is not attached to repmgr
+          become_user: postgres
+          shell: >-
+            set -o pipefail &&
+            {{ repmgr.bindir[ansible_os_family] }}/repmgr cluster show
+              | grep -i 'not attached to its upstream node'
+          changed_when: false
+          register: is_node_not_attached
+          failed_when: is_node_not_attached.rc not in [0, 1]
+
+        - name: Extensions | Repmgr | Attach active standby to current primary node
+          when: is_node_not_attached.stdout | length > 0
+          become: true
+          become_user: postgres
+          become_method: sudo
+          command: "{{ repmgr.bindir[ansible_os_family] }}/repmgr standby follow"
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/repmgr.conf.j2 b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/repmgr.conf.j2
index 0bbe285990..88925e69ed 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/repmgr.conf.j2
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/repmgr.conf.j2
@@ -4,8 +4,8 @@ conninfo='host={{ ansible_default_ipv4.address }} user={{ specification.extensio
 data_directory='{{ pg.data_dir[ansible_os_family] }}'
 
 failover=automatic
-promote_command='{{ repmgr.pg_bindir[ansible_os_family] }}/repmgr standby promote -f {{ repmgr.config_dir[ansible_os_family] }}/repmgr.conf --log-to-file'
-follow_command='{{ repmgr.pg_bindir[ansible_os_family] }}/repmgr standby follow -f {{ repmgr.config_dir[ansible_os_family] }}/repmgr.conf --log-to-file --upstream-node-id=%n'
+promote_command='{{ repmgr.pg_bindir[ansible_os_family] }}/repmgr standby promote --log-to-file'
+follow_command='{{ repmgr.pg_bindir[ansible_os_family] }}/repmgr standby follow --log-to-file --upstream-node-id=%n'
 monitoring_history=yes
 monitor_interval_secs=10
 
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/preflight/tasks/apply.yml b/core/src/epicli/data/common/ansible/playbooks/roles/preflight/tasks/apply.yml
index 6998636c09..4f3ae70beb 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/preflight/tasks/apply.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/preflight/tasks/apply.yml
@@ -9,7 +9,9 @@
     - name: Check if enabled applications are supported for the architecture
       assert:
         that: _unsupported_enabled_apps | length == 0
-        fail_msg: "Following application(s) are not supported for {{ _k8s_arch }} and cannot be installed: {{ _unsupported_enabled_apps | map(attribute='name') | join(', ') }}"
+        fail_msg: >-
+          Following application(s) are not supported for {{ _k8s_arch }} and cannot be installed:
+            {{ _unsupported_enabled_apps | map(attribute='name') | join(', ') }}
         success_msg: "All enabled applications are supported for {{ _k8s_arch }}"
         quiet: true
       vars:
@@ -30,7 +32,7 @@
     - groups.kubernetes_master | length > 0
     - "'applications' in roles_with_generated_vars" # there is a case with disabled applications by custom feature mapping
 
-- name: Check if PostgreSQL extentions and architecture are compatible
+- name: PostgreSQL checks
   block:
     - name: Include postgresql vars from postgresql role
       include_vars:
@@ -61,6 +63,13 @@
           {{ (_defined | selectattr('config.enabled') | list) + _undefined }}
         _unsupported_enabled_extensions: >-
           {{ _enabled_extensions | selectattr('name', 'in', unsupported_postgres_extensions[_pg_arch]) | list }}
+
+    - name: Check the number of PostgreSQL hosts for Repmgr
+      when: postgresql.specification.extensions.replication.enabled | default(false)
+      assert:
+        that: groups.postgresql | length <= 2
+        fail_msg: "Max number of PostgreSQL hosts with enabled replication is 2"
+        success_msg: "The number of PostgreSQL hosts is correct"
   run_once: true
   delegate_to: localhost
   when:

From e9780fde7576fffdd9dec4799fac09ba9440fcd2 Mon Sep 17 00:00:00 2001
From: atsikham <atsikham@users.noreply.github.com>
Date: Wed, 19 May 2021 01:26:22 +0200
Subject: [PATCH 07/28] Commented pgbouncer package not to fail installation

---
 .../download-requirements/centos-7/requirements.x86_64.txt    | 4 ++--
 .../download-requirements/redhat-7/requirements.x86_64.txt    | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/centos-7/requirements.x86_64.txt b/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/centos-7/requirements.x86_64.txt
index c081755204..a9ac52e734 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/centos-7/requirements.x86_64.txt
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/centos-7/requirements.x86_64.txt
@@ -23,7 +23,7 @@ https://github.com/google/go-containerregistry/releases/download/v0.4.1/go-conta
 [packages]
 audit # for docker-ce
 bash-completion
-c-ares # for pgbouncer
+#c-ares # for pgbouncer
 ca-certificates
 cifs-utils
 conntrack-tools # for kubelet
@@ -79,7 +79,7 @@ perl-Pod-Perldoc # for vim
 perl-Pod-Simple # for vim
 perl-Pod-Usage # for vim
 pgaudit15_13
-pgbouncer-1.10.*
+#pgbouncer-1.10.*
 policycoreutils-python # for container-selinux
 pyldb # for cifs-utils
 python-cffi # for python2-cryptography
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/redhat-7/requirements.x86_64.txt b/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/redhat-7/requirements.x86_64.txt
index 714f81d42a..1575fdd1e3 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/redhat-7/requirements.x86_64.txt
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/redhat-7/requirements.x86_64.txt
@@ -21,7 +21,7 @@ https://github.com/google/go-containerregistry/releases/download/v0.4.1/go-conta
 [packages]
 audit # for docker-ce
 bash-completion
-c-ares # for pgbouncer
+#c-ares # for pgbouncer
 ca-certificates
 cifs-utils
 conntrack-tools # for kubelet
@@ -77,7 +77,7 @@ perl-Pod-Perldoc # for vim
 perl-Pod-Simple # for vim
 perl-Pod-Usage # for vim
 pgaudit15_13
-pgbouncer-1.10.*
+#pgbouncer-1.10.*
 policycoreutils-python # for container-selinux
 pyldb # for cifs-utils
 python-cffi # for python2-cryptography

From 54640cc362499dc913e4d33864c1a148088349e1 Mon Sep 17 00:00:00 2001
From: atsikham <atsikham@users.noreply.github.com>
Date: Mon, 24 May 2021 00:47:08 +0200
Subject: [PATCH 08/28] Ubuntu installation except pgbouncer

---
 .../extensions/replication/extension.yml      | 108 +++++++++---------
 .../tasks/extensions/replication/packages.yml |   2 +-
 .../playbooks/roles/postgresql/tasks/main.yml | 104 ++++++++---------
 .../postgresql.conf.j2}                       |   3 +-
 .../playbooks/roles/preflight/tasks/apply.yml |   6 +-
 .../centos-7/requirements.x86_64.txt          |   2 +-
 .../redhat-7/requirements.x86_64.txt          |   2 +-
 .../ubuntu-18.04/add-repositories.sh          |   3 +
 .../ubuntu-18.04/requirements.x86_64.txt      |   4 +-
 9 files changed, 117 insertions(+), 117 deletions(-)
 rename core/src/epicli/data/common/ansible/playbooks/roles/postgresql/{files/postgresql.conf => templates/postgresql.conf.j2} (99%)

diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml
index 18ff2e2a77..8c4010c70c 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml
@@ -9,7 +9,7 @@
 
 # --- Configure users ---
 
-- name: Extensions | Repmgr | Add postgres user to sudoers file
+- name: Extensions | Repmgr | Add 'postgres' user to sudoers file
   lineinfile:
     path: /etc/sudoers
     line: >-
@@ -21,19 +21,22 @@
       {{ repmgr.bindir[ansible_os_family] }}/repmgr standby follow
     validate: 'visudo -cf %s'
 
-- name: Extensions | Repmgr | Create super user in postgresql
-  become_user: postgres
-  postgresql_user:
-    user: "{{ specification.extensions.replication.privileged_user_name }}"
-    password: "{{ specification.extensions.replication.privileged_user_password }}"
-    role_attr_flags: LOGIN,SUPERUSER
-
-- name: Extensions | Repmgr | Create replication user in postgresql
+- name: Extensions | Repmgr | Create replication and super users in PostgreSQL
   become_user: postgres
+  vars:
+    _users:
+      - user: "{{ specification.extensions.replication.privileged_user_name }}"
+        password: "{{ specification.extensions.replication.privileged_user_password }}"
+        role_attr_flags: LOGIN,SUPERUSER
+      - user: "{{ specification.extensions.replication.replication_user_name }}"
+        password: "{{ specification.extensions.replication.replication_user_password }}"
+        role_attr_flags: LOGIN,REPLICATION
   postgresql_user:
-    user: "{{ specification.extensions.replication.replication_user_name }}"
-    password: "{{ specification.extensions.replication.replication_user_password }}"
-    role_attr_flags: LOGIN,REPLICATION
+    user: "{{ item.user }}"
+    password: "{{ item.password }}"
+    role_attr_flags: "{{ item.role_attr_flags }}"
+  no_log: true
+  loop: "{{ _users }}"
 
 - name: Extensions | Repmgr | Create pgpass file
   template:
@@ -69,49 +72,51 @@
   vars:
     node_id: "{{ pg_repmgr_node_id }}"
 
-## On Ubuntu config file location is not set by package (see https://repmgr.org/docs/4.0/packages-debian-ubuntu.html).
-## Create symlink to allow using repmgr commands without specifying config file location (which is custom).
-## See https://repmgr.org/docs/4.0/configuration-file.html
-#- name: Extensions | Repmgr | Debian specific tasks
-#  when: ansible_os_family == 'Debian'
-#  block:
-#    - name: Extensions | Repmgr | Create symlink /etc/repmgr.conf
-#      file:
-#        src: "{{ template_repmgr_conf.dest }}"
-#        dest: /etc/repmgr.conf
-#        state: link
-#        owner: postgres
-#        group: postgres
-#      when: template_repmgr_conf.dest != '/etc/repmgr.conf'
-#
-#    # For repmgr installed from Ubuntu package additional configuration is required before repmgrd is started as daemon
-#    - name: Extensions | Repmgr | Set repmgr.conf file in /etc/default/repmgrd
-#      replace:
-#        path: /etc/default/repmgrd
-#        regexp: "^#REPMGRD_CONF=\"/path/to/repmgr.conf\""
-#        replace: "REPMGRD_CONF=\"{{ repmgr.config_dir[ansible_os_family] }}/repmgr.conf\""
-#
-#    - name: Extensions | Repmgr | Enable repmgrd in /etc/default/repmgrd
-#      replace:
-#        path: /etc/default/repmgrd
-#        regexp: "^[#]?REPMGRD_ENABLED=no"
-#        replace: "REPMGRD_ENABLED=yes"
+# On Ubuntu config file location is not set by package (see https://repmgr.org/docs/5.2/packages-debian-ubuntu.html).
+# Create symlink to allow using repmgr commands without specifying config file location (which is custom).
+# See https://repmgr.org/docs/5.2/configuration-file.html
+- name: Extensions | Repmgr | Debian specific tasks
+  when: ansible_os_family == 'Debian'
+  block:
+    - name: Extensions | Repmgr | Create symlink /etc/repmgr.conf
+      file:
+        src: "{{ template_repmgr_conf.dest }}"
+        dest: /etc/repmgr.conf
+        state: link
+        owner: postgres
+        group: postgres
+      when: template_repmgr_conf.dest != '/etc/repmgr.conf'
+
+    # For repmgr installed from Ubuntu package additional configuration is required before repmgrd is started as daemon
+    - name: Extensions | Repmgr | Set repmgr.conf file in /etc/default/repmgrd
+      replace:
+        path: /etc/default/repmgrd
+        regexp: "^#REPMGRD_CONF=\"/path/to/repmgr.conf\""
+        replace: "REPMGRD_CONF=\"{{ repmgr.config_dir[ansible_os_family] }}/repmgr.conf\""
+
+    - name: Extensions | Repmgr | Enable repmgrd in /etc/default/repmgrd
+      replace:
+        path: /etc/default/repmgrd
+        regexp: "^[#]?REPMGRD_ENABLED=no"
+        replace: "REPMGRD_ENABLED=yes"
 
 - name: Extensions | Repmgr | Check cluster status
   become_user: postgres
   command: "{{ repmgr.bindir[ansible_os_family] }}/repmgr cluster show --csv"
   register: pg_cluster_status
-  # 25 means there is an error with at least one registered node
-  # sometimes 'repmgr cluster show' returns 25 code with empty stderr and no explaination
-  failed_when: pg_cluster_status.rc not in [0, 25] or pg_cluster_status.stdout_lines|length > groups.postgresql|length
+  changed_when: false
+  failed_when: false
+  no_log: true
 
-# There is a preflight check that no more than 2 cluster nodes are supported
+# 1. There is a preflight check that no more than 2 cluster nodes are supported
+# 2. rc = 25 means that there is an error with at least one registered node
+#    sometimes 'repmgr cluster show' returns 25 code with empty stderr and no explanation
 - name: Extensions | Repmgr | Set 'pg_is_clustered' fact
   set_fact:
-    pg_is_clustered: "{{ pg_cluster_status.stdout_lines | length }} == 2"
+    pg_is_clustered: "{{ pg_cluster_status.rc in [0, 25] and pg_cluster_status.stdout_lines | length  > 1 }}"
 
 - name: Extensions | Repmgr | Configure PostgreSQL cluster
-  when: not pg_is_clustered
+  when: not pg_is_clustered|bool
   vars:
     pg_node_primary: "{{ groups.postgresql[0] }}" # the first node in the group is primary
   block:
@@ -173,7 +178,7 @@
         enabled: true
 
 - name: Extensions | Repmgr | Check already configured cluster
-  when: pg_is_clustered
+  when: pg_is_clustered|bool
   block:
     - name: Extensions | Repmgr | Search for a primary node
       become_user: postgres
@@ -190,16 +195,13 @@
       block:
         - name: Extensions | Repmgr | Check if node is not attached to repmgr
           become_user: postgres
-          shell: >-
-            set -o pipefail &&
-            {{ repmgr.bindir[ansible_os_family] }}/repmgr cluster show
-              | grep -i 'not attached to its upstream node'
+          command: "{{ repmgr.bindir[ansible_os_family] }}/repmgr cluster show"
           changed_when: false
-          register: is_node_not_attached
-          failed_when: is_node_not_attached.rc not in [0, 1]
+          register: pg_cluster_status
+          failed_when: pg_cluster_status.rc not in [0, 25]
 
         - name: Extensions | Repmgr | Attach active standby to current primary node
-          when: is_node_not_attached.stdout | length > 0
+          when: "'not attached to its upstream node' in pg_cluster_status.stdout|lower"
           become: true
           become_user: postgres
           become_method: sudo
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/packages.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/packages.yml
index a74a771a4c..d3e6a076ab 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/packages.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/packages.yml
@@ -8,6 +8,6 @@
       Debian:
         - postgresql-13-repmgr
       RedHat:
-        - repmgr13
+        - repmgr13-5.2.1
   module_defaults:
     yum: { lock_timeout: "{{ yum_lock_timeout }}" }
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/main.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/main.yml
index d7c8dc5700..639263cd90 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/main.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/main.yml
@@ -1,5 +1,5 @@
 ---
-- name: Set facts
+- name: Set 'enabled_extensions' fact
   set_fact:
     enabled_extensions: >-
       {{ (_defined_extensions | selectattr('config.enabled') | list) + _undefined_extensions }}
@@ -22,6 +22,9 @@
   vars:
     _packages:
       Debian:
+        - postgresql-client-common
+        - postgresql-common
+        - postgresql-client-13
         - postgresql-13
         - postgresql-contrib-13
         - python-psycopg2 # required for postgresql ansible management
@@ -33,104 +36,93 @@
 
 # Extension packages need to be installed first to be able to process PostgreSQL config
 - name: Install extension packages
-  include_tasks: extensions/{{ data.name }}/packages.yml
+  include_tasks: extensions/{{ extension.name }}/packages.yml
   loop_control:
-    loop_var: data
+    loop_var: extension
   loop: "{{ enabled_extensions }}"
 
 - name: Create directories and ensure correct permissions
   file:
-    path: "{{ item }}"
+    path: "{{ path }}"
     state: directory
     owner: postgres
     group: postgres
     mode: u=rwx,g=,o=
+  loop_control:
+    loop_var: path
   loop:
     - /var/log/postgresql
     - "{{ pg.data_dir[ansible_os_family] }}" # Permissions should be u=rwx (0700) or u=rwx,g=rx (0750)
 
 - name: RedHat | Initialize database
+  when: ansible_os_family == 'RedHat'
   block:
-    - name: Check initialization status (RedHat)
+    - name: RedHat | Check initialization status
       stat:
         path: "{{ pg.config_dir[ansible_os_family] }}/pg_hba.conf"
       register: pg_hba_conf_stat
 
-    - name: Initialize database (RedHat)
+    - name: RedHat | Initialize database
+      when: not pg_hba_conf_stat.stat.exists
       command: /usr/pgsql-13/bin/postgresql-13-setup initdb {{ pg.service_name[ansible_os_family] }}
-      when:
-        - not pg_hba_conf_stat.stat.exists
-  when:
-    - ansible_os_family == 'RedHat'
 
-- name: Copy pg_hba.conf
-  template:
-    src: pg_hba.conf.j2
-    dest: "{{ pg.config_dir[ansible_os_family] }}/pg_hba.conf"
-    owner: postgres
-    group: postgres
-    mode: u=rw,g=,o=
-    backup: true
-  register: change_pg_hba_conf
+- name: Ensure that postgresql service is started
+  block:
+    - name: Ensure that postgresql service is started
+      systemd:
+        name: "{{ pg.service_name[ansible_os_family] }}"
+        state: started
+        enabled: true
+
+    - &check-debian-service
+      name: Debian | Check that the main service is started
+      when: ansible_os_family == 'Debian'
+      systemd:
+        name: "{{ pg.instantiated_service_name[ansible_os_family] }}"
+        state: started
+        enabled: true
 
 # Used in postgresql-epiphany.conf.j2
 - name: Set runtime_shared_preload_libraries fact
   block:
-    - name: Collect facts about system services
-      service_facts:
-      register: services_state
-
     - name: Get PostgreSQL settings
       become: true
       become_user: postgres
-      vars:
-        _service: "{{ pg.service_name[ansible_os_family] }}.service"
-        _state: "{{ ansible_facts.services[_service] }}"
       postgresql_info:
         filter: settings
       register: postgresql_info
-      when:
-        - "_service|string in ansible_facts.services"
-        - "_state|string == 'started'"
 
     - name: Set runtime_shared_preload_libraries fact
       set_fact:
         runtime_shared_preload_libraries: "{{ postgresql_info.settings.shared_preload_libraries.setting }}"
-      when:
-        - postgresql_info.settings is defined
 
-- name: Create Epiphany managed configuration sub-file
+- name: Copy PostgreSQL configuration files
+  vars:
+    _files:
+      - pg_hba.conf
+      - postgresql-epiphany.conf
+      - postgresql.conf
   template:
-    src: postgresql-epiphany.conf.j2
-    dest: "{{ pg.config_dir[ansible_os_family] }}/postgresql-epiphany.conf"
-    owner: postgres
-    group: postgres
-    mode: u=rw,g=,o=
-  register: change_postgresql_epiphany_conf
-
-- name: Copy postgresql.conf
-  copy:
-    src: postgresql.conf
-    dest: "{{ pg.config_dir[ansible_os_family] }}/postgresql.conf"
+    src: "{{ file_name }}.j2"
+    dest: "{{ pg.config_dir[ansible_os_family] }}/{{ file_name }}"
     owner: postgres
     group: postgres
     mode: u=rw,g=,o=
     backup: true
-  register: change_postgresql_conf
+  loop_control:
+    loop_var: file_name
+  loop: "{{ _files }}"
+  register: change_pg_config
 
 - name: Restart postgresql service if configuration changed
-  systemd:
-    name: "{{ pg.service_name[ansible_os_family] }}"
-    state: restarted
-  when: change_pg_hba_conf
-    or change_postgresql_epiphany_conf
-    or change_postgresql_conf
-
-# This is a separate task as service restart runs not each time
-- name: Enable postgresql service
-  systemd:
-    name: "{{ pg.service_name[ansible_os_family] }}"
-    enabled: true
+  block:
+    - name: Restart postgresql service if configuration changed
+      systemd:
+        name: "{{ pg.service_name[ansible_os_family] }}"
+        state: restarted
+
+    - *check-debian-service
+  when: (change_pg_config.results | map(attribute='changed') | list) is any
 
 - name: Configure postgresql logrotate
   block:
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/files/postgresql.conf b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/postgresql.conf.j2
similarity index 99%
rename from core/src/epicli/data/common/ansible/playbooks/roles/postgresql/files/postgresql.conf
rename to core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/postgresql.conf.j2
index 6d23f04021..58723ba70c 100755
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/files/postgresql.conf
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/postgresql.conf.j2
@@ -1,3 +1,4 @@
+# {{ ansible_managed }}
 # -----------------------------
 # PostgreSQL configuration file
 # -----------------------------
@@ -38,7 +39,7 @@
 # The default values of these variables are driven from the -D command-line
 # option or PGDATA environment variable, represented here as ConfigDir.
 
-#data_directory = 'ConfigDir'		# use data in another directory
+data_directory = '{{ pg.data_dir[ansible_os_family] }}'		# use data in another directory
 					# (change requires restart)
 #hba_file = 'ConfigDir/pg_hba.conf'	# host-based authentication file
 					# (change requires restart)
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/preflight/tasks/apply.yml b/core/src/epicli/data/common/ansible/playbooks/roles/preflight/tasks/apply.yml
index 4f3ae70beb..1fd1f5b2ac 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/preflight/tasks/apply.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/preflight/tasks/apply.yml
@@ -11,7 +11,7 @@
         that: _unsupported_enabled_apps | length == 0
         fail_msg: >-
           Following application(s) are not supported for {{ _k8s_arch }} and cannot be installed:
-            {{ _unsupported_enabled_apps | map(attribute='name') | join(', ') }}
+            {{ _unsupported_enabled_apps | map(attribute='name') | list | join(', ') }}
         success_msg: "All enabled applications are supported for {{ _k8s_arch }}"
         quiet: true
       vars:
@@ -43,8 +43,8 @@
       assert:
         that: _unsupported_enabled_extensions | length == 0
         fail_msg: >-
-          {{ unsupported_postgres_extensions[_pg_arch] | join(', ') }} extensions are not supported for {{ _pg_arch }}
-            and cannot be installed
+          {{ _unsupported_enabled_extensions | map(attribute='name') | list | join(', ') }} extensions are not supported
+            for {{ _pg_arch }} and cannot be installed
         success_msg: "All enabled PostgreSQL extensions are supported for current architecture"
       vars:
         _pg_arch: >-
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/centos-7/requirements.x86_64.txt b/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/centos-7/requirements.x86_64.txt
index a9ac52e734..3f07b9a821 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/centos-7/requirements.x86_64.txt
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/centos-7/requirements.x86_64.txt
@@ -98,7 +98,7 @@ rabbitmq-server-3.8.9
 rh-haproxy18
 rh-haproxy18-haproxy-syspaths
 postgresql13-server
-repmgr13
+repmgr13-5.2.1
 samba-client
 samba-client-libs # for samba-client
 samba-common
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/redhat-7/requirements.x86_64.txt b/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/redhat-7/requirements.x86_64.txt
index 1575fdd1e3..6cda295928 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/redhat-7/requirements.x86_64.txt
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/redhat-7/requirements.x86_64.txt
@@ -94,7 +94,7 @@ rabbitmq-server-3.8.9
 rh-haproxy18
 rh-haproxy18-haproxy-syspaths
 postgresql13-server
-repmgr13
+repmgr13-5.2.1
 samba-client
 samba-client-libs # for samba-client
 samba-common
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/ubuntu-18.04/add-repositories.sh b/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/ubuntu-18.04/add-repositories.sh
index f42a63c356..24f9f8d691 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/ubuntu-18.04/add-repositories.sh
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/ubuntu-18.04/add-repositories.sh
@@ -24,6 +24,9 @@ echo "deb https://artifacts.elastic.co/packages/oss-7.x/apt stable main" | tee /
 wget -qO - https://d3g5vo6xdbdb9a.cloudfront.net/GPG-KEY-opendistroforelasticsearch | sudo apt-key add -
 echo "deb https://d3g5vo6xdbdb9a.cloudfront.net/apt stable main" | tee -a /etc/apt/sources.list.d/opendistroforelasticsearch.list
 
+wget -qO - https://www.postgresql.org/media/keys/ACCC4CF8.asc | sudo apt-key add -
+echo "deb http://apt.postgresql.org/pub/repos/apt bionic-pgdg main" | tee /etc/apt/sources.list.d/pgdg.list
+
 wget -qO - https://dl.2ndquadrant.com/gpg-key.asc | apt-key add -
 echo "deb https://dl.2ndquadrant.com/default/release/apt bionic-2ndquadrant main" | tee -a /etc/apt/sources.list.d/2ndquadrant-dl-default-release.list
 
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/ubuntu-18.04/requirements.x86_64.txt b/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/ubuntu-18.04/requirements.x86_64.txt
index 6b833624d0..be5db23470 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/ubuntu-18.04/requirements.x86_64.txt
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/ubuntu-18.04/requirements.x86_64.txt
@@ -143,9 +143,11 @@ libsmbclient
 # for postgres
 postgresql-client-13
 postgresql-13-pgaudit
-postgresql-13-repmgr
+postgresql-13-repmgr 5.2.1
 postgresql-common
+postgresql-client-common
 pgbouncer 1.15.*
+pgdg-keyring
 
 # for firewalld
 ipset

From 6aee0019b13ee3287757012f1dc2eee4f9698ebc Mon Sep 17 00:00:00 2001
From: atsikham <atsikham@users.noreply.github.com>
Date: Mon, 24 May 2021 00:47:32 +0200
Subject: [PATCH 09/28] Updated components

---
 .../playbooks/roles/postgresql/templates/pg_hba.conf.j2   | 2 +-
 docs/home/COMPONENTS.md                                   | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/pg_hba.conf.j2 b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/pg_hba.conf.j2
index 4e6397586c..1f4a35bee1 100755
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/pg_hba.conf.j2
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/pg_hba.conf.j2
@@ -95,4 +95,4 @@ host    replication     all             ::1/128                 scram-sha-256
 
 {% if specification.extensions.replication.enabled is defined and specification.extensions.replication.enabled %}
 host    replication     {{ specification.extensions.replication.replication_user_name }}      0.0.0.0/0               scram-sha-256
-{% endif %}
\ No newline at end of file
+{% endif %}
diff --git a/docs/home/COMPONENTS.md b/docs/home/COMPONENTS.md
index 0fb893f38e..b95dd32fe7 100644
--- a/docs/home/COMPONENTS.md
+++ b/docs/home/COMPONENTS.md
@@ -31,12 +31,12 @@ Note that versions are default versions and can be changed in certain cases thro
 | HAProxy Exporter           | 0.10.0   | https://github.com/prometheus/haproxy_exporter        | [Apache License 2.0](https://www.apache.org/licenses/LICENSE-2.0) |
 | JMX Exporter               | 0.12.0   | https://github.com/prometheus/jmx_exporter            | [Apache License 2.0](https://www.apache.org/licenses/LICENSE-2.0) |
 | Postgres Exporter          | 0.9.0    | https://github.com/prometheus-community/postgres_exporter | [Apache License 2.0](https://www.apache.org/licenses/LICENSE-2.0) |
-| PostgreSQL                 | 10       | https://www.postgresql.org/                           | https://opensource.org/licenses/postgresql                        |
+| PostgreSQL                 | 13       | https://www.postgresql.org/                           | [PostgreSQL license](http://www.postgresql.org/about/licence/)    |
 | HAProxy                    | 2.2.2    | https://www.haproxy.org/                              | [GNU General Public License 2.0](https://www.gnu.org/licenses/old-licenses/gpl-2.0.html) |
-| PGAudit                    | 1.2.2    | https://github.com/pgaudit/pgaudit                    | [PostgreSQL license](http://www.postgresql.org/about/licence/)    |
+| PgAudit                    | 1.5.0    | https://github.com/pgaudit/pgaudit                    | [PostgreSQL license](http://www.postgresql.org/about/licence/)    |
 | PgBouncer                  | 1.10.0   | https://github.com/pgbouncer/pgbouncer                | [ISC License](https://opensource.org/licenses/isc)                |
-| repmgr                     | 4.0.6    | https://github.com/2ndQuadrant/repmgr                 | [Apache License 2.0](https://github.com/2ndQuadrant/repmgr/blob/master/LICENSE) |
-| PGPool                     | 4.1.1    | https://www.pgpool.net/                               | [License](https://www.pgpool.net/mediawiki/index.php/pgpool-II_License) |
+| Repmgr                     | 5.2.1    | https://github.com/2ndQuadrant/repmgr                 | [GNU General Public License 3.0](https://github.com/EnterpriseDB/repmgr/blob/master/LICENSE) |
+| PgPool                     | 4.2.2    | https://www.pgpool.net/                               | [License](https://www.pgpool.net/mediawiki/index.php/pgpool-II_License) |
 | Alertmanager               | 0.17.0   | https://github.com/prometheus/alertmanager            | [Apache License 2.0](https://github.com/prometheus/alertmanager/blob/master/LICENSE) |
 | Apache Ignite              | 2.9.1    | https://github.com/apache/ignite                      | [Apache License 2.0](https://www.apache.org/licenses/LICENSE-2.0) |
 | Apache2                    | 2.4.29   | https://httpd.apache.org/                             | [Apache License 2.0](https://www.apache.org/licenses/LICENSE-2.0) |

From e70b123879aea59d19c92ac5836eff48760e843b Mon Sep 17 00:00:00 2001
From: atsikham <atsikham@users.noreply.github.com>
Date: Mon, 24 May 2021 21:34:54 +0200
Subject: [PATCH 10/28] Added molecule tests and documentation

---
 .../roles/postgresql/molecule/README.adoc     |  34 +++++
 .../postgresql/molecule/add-repos-debian.sh   |  11 ++
 .../postgresql/molecule/add-repos-redhat.sh   | 143 ++++++++++++++++++
 .../molecule/debian-repmgr/converge.yml       |  19 +++
 .../molecule/debian-repmgr/molecule.yml       |  45 ++++++
 .../molecule/debian-repmgr/prepare.yml        |   6 +
 .../molecule/debian-repmgr/verify.yml         |  53 +++++++
 .../molecule/debian-single-node/converge.yml  |  19 +++
 .../molecule/debian-single-node/molecule.yml  |  45 ++++++
 .../molecule/debian-single-node/prepare.yml   |   6 +
 .../molecule/debian-single-node/verify.yml    |  40 +++++
 .../molecule/redhat-repmgr/converge.yml       |  16 ++
 .../molecule/redhat-repmgr/molecule.yml       |  41 +++++
 .../molecule/redhat-repmgr/prepare.yml        |   6 +
 .../molecule/redhat-repmgr/verify.yml         |  46 ++++++
 .../molecule/redhat-single-node/converge.yml  |  16 ++
 .../molecule/redhat-single-node/molecule.yml  |  28 ++++
 .../molecule/redhat-single-node/prepare.yml   |   6 +
 .../molecule/redhat-single-node/verify.yml    |  33 ++++
 .../roles/postgresql/molecule/vars-repmgr.yml | 107 +++++++++++++
 .../postgresql/molecule/vars-single-node.yml  | 107 +++++++++++++
 21 files changed, 827 insertions(+)
 create mode 100644 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/README.adoc
 create mode 100644 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/add-repos-debian.sh
 create mode 100644 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/add-repos-redhat.sh
 create mode 100644 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/converge.yml
 create mode 100644 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/molecule.yml
 create mode 100644 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/prepare.yml
 create mode 100644 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/verify.yml
 create mode 100644 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-single-node/converge.yml
 create mode 100644 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-single-node/molecule.yml
 create mode 100644 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-single-node/prepare.yml
 create mode 100644 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-single-node/verify.yml
 create mode 100644 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-repmgr/converge.yml
 create mode 100644 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-repmgr/molecule.yml
 create mode 100644 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-repmgr/prepare.yml
 create mode 100644 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-repmgr/verify.yml
 create mode 100644 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-single-node/converge.yml
 create mode 100644 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-single-node/molecule.yml
 create mode 100644 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-single-node/prepare.yml
 create mode 100644 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-single-node/verify.yml
 create mode 100644 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/vars-repmgr.yml
 create mode 100644 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/vars-single-node.yml

diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/README.adoc b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/README.adoc
new file mode 100644
index 0000000000..fe6ce785ff
--- /dev/null
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/README.adoc
@@ -0,0 +1,34 @@
+= Installation guide
+
+== Requirements
+
+* Internet connection
+* General molecule link:https://molecule.readthedocs.io/en/latest/installation.html[dependencies]
+* Docker
+* ansible-lint
+
+== Installation
+
+[source:bash]
+----
+pip install 'molecule[docker]'
+pip install ansible-lint
+----
+
+== Execution
+
+=== General
+
+[source:bash]
+----
+molecule test -s <scenario-name>
+----
+
+=== Separate steps
+[source:bash]
+----
+molecule lint -s <scenario-name>
+molecule converge -s <scenario-name>
+molecule idempotence -s <scenario-name>
+molecule verify -s <scenario-name>
+----
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/add-repos-debian.sh b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/add-repos-debian.sh
new file mode 100644
index 0000000000..a6104ea62c
--- /dev/null
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/add-repos-debian.sh
@@ -0,0 +1,11 @@
+#!/bin/bash -eu
+
+apt update && apt -y install wget gpg-agent
+
+wget -qO - https://www.postgresql.org/media/keys/ACCC4CF8.asc | sudo apt-key add -
+echo "deb http://apt.postgresql.org/pub/repos/apt bionic-pgdg main" | tee /etc/apt/sources.list.d/pgdg.list
+
+wget -qO - https://dl.2ndquadrant.com/gpg-key.asc | apt-key add -
+echo "deb https://dl.2ndquadrant.com/default/release/apt bionic-2ndquadrant main" | tee /etc/apt/sources.list.d/2ndquadrant-dl-default-release.list
+
+apt update
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/add-repos-redhat.sh b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/add-repos-redhat.sh
new file mode 100644
index 0000000000..a3e4e51021
--- /dev/null
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/add-repos-redhat.sh
@@ -0,0 +1,143 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+CREATE_LOGFILE='no'
+
+# params: <repo_id> <config_file_content>
+add_repo_as_file() {
+    local repo_id="$1"
+    local config_file_content="$2"
+    local config_file_name="$repo_id.repo"
+
+    if ! is_repo_enabled "$repo_id"; then
+        echol "Adding repository: $repo_id"
+        cat <<<"$config_file_content" >"/etc/yum.repos.d/$config_file_name" ||
+            exit_with_error "Function add_repo_as_file failed for repo: $repo_id"
+        local -a gpg_key_urls
+        IFS=" " read -r -a gpg_key_urls \
+            <<<"$(grep -i --only-matching --perl-regexp '(?<=^gpgkey=)http[^#\n]+' <<<"$config_file_content")"
+        if ((${#gpg_key_urls[@]} > 0)); then
+            import_repo_gpg_keys "${gpg_key_urls[@]}" 3
+        fi
+        # to accept import of repo's GPG key (for repo_gpgcheck=1)
+        yum -y repolist >/dev/null || exit_with_error "Command failed: yum -y repolist"
+    fi
+}
+
+# params: <script_url>
+add_repo_from_script() {
+    local script_url="$1"
+
+    echol "Running: curl $script_url | bash"
+    curl $script_url | bash
+}
+
+# params: <repo_id>
+disable_repo() {
+    local repo_id="$1"
+
+    if yum repolist enabled | grep --quiet "$repo_id"; then
+        echol "Disabling repository: $repo_id"
+        yum-config-manager --disable "$repo_id" ||
+            exit_with_error "Command failed: yum-config-manager --disable \"$repo_id\""
+    fi
+}
+
+echol() {
+    echo -e "$@"
+    if [[ $CREATE_LOGFILE == 'yes' ]]; then
+        local timestamp=$(date +"%b %e %H:%M:%S")
+        echo -e "${timestamp}: $@" >>"$LOG_FILE_PATH"
+    fi
+}
+
+# params: <url(s)> <retries>
+import_repo_gpg_keys() {
+    local retries=${!#}        # get last arg
+    local urls=("${@:1:$#-1}") # remove last arg
+
+    for url in "${urls[@]}"; do
+        run_cmd_with_retries rpm --import "$url" "$retries"
+    done
+}
+
+# params: <repo_id>
+is_repo_enabled() {
+    local repo_id="$1"
+
+    if yum repolist | grep --quiet "$repo_id"; then
+        echol "Repository $repo_id already enabled"
+        return 0
+    else
+        return 1
+    fi
+}
+
+# Runs command as array with printing it, doesn't support commands with shell operators (such as pipe or redirection)
+# params: <command to execute> [--no-exit-on-error]
+run_cmd() {
+    local cmd_arr=("$@")
+
+    local exit_on_error=1
+    if [[ ${cmd_arr[-1]} == '--no-exit-on-error' ]]; then
+        exit_on_error=0
+        cmd_arr=("${cmd_arr[@]:0:$#-1}") # remove last item
+    fi
+
+    local escaped_string return_code
+    escaped_string=$(_print_array_as_shell_escaped_string "${cmd_arr[@]}")
+    echol "Executing: ${escaped_string}"
+    "${cmd_arr[@]}"
+    return_code=$?
+    if ((return_code != 0)) && ((exit_on_error)); then
+        exit_with_error "Command failed: ${escaped_string}"
+    else
+        return $return_code
+    fi
+}
+
+# Runs command with retries, doesn't support commands with shell operators (such as pipe or redirection)
+# params: <command to execute> <retries>
+run_cmd_with_retries() {
+    # pop 'retries' argument
+    local retries=${!#}  # get last arg (indirect expansion)
+    set -- "${@:1:$#-1}" # set new "$@"
+
+    local cmd_arr=("$@")
+    (# sub-shell is used to limit scope for 'set +e'
+        set +e
+        trap - ERR # disable global trap locally
+        for ((i = 0; i <= retries; i++)); do
+            run_cmd "${cmd_arr[@]}" '--no-exit-on-error'
+            return_code=$?
+            if ((return_code == 0)); then
+                break
+            elif ((i < retries)); then
+                sleep 1
+                echol "retrying ($((i + 1))/${retries})"
+            else
+                echol "ERROR: all attempts failed"
+                local escaped_string
+                escaped_string=$(_print_array_as_shell_escaped_string "${cmd_arr[@]}")
+                exit_with_error "Command failed: ${escaped_string}"
+            fi
+        done
+        return $return_code
+    )
+}
+
+POSTGRESQL_REPO_CONF=$(
+    cat <<'EOF'
+[pgdg13]
+name=PostgreSQL 13 for RHEL/CentOS $releasever - $basearch
+baseurl=https://download.postgresql.org/pub/repos/yum/13/redhat/rhel-$releasever-$basearch
+enabled=1
+gpgcheck=1
+gpgkey=https://download.postgresql.org/pub/repos/yum/RPM-GPG-KEY-PGDG
+EOF
+)
+
+add_repo_as_file 'postgresql-13' "$POSTGRESQL_REPO_CONF"
+add_repo_from_script 'https://dl.2ndquadrant.com/default/release/get/13/rpm' # for repmgr
+disable_repo '2ndquadrant-dl-default-release-pg13-debug'                     # script adds 2 repositories, only 1 is required
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/converge.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/converge.yml
new file mode 100644
index 0000000000..9ba579eb42
--- /dev/null
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: Converge
+  hosts: postgresql
+  become: true
+  become_method: sudo
+  module_defaults:
+    shell:
+      executable: /bin/bash
+  tasks:
+    - name: Include 'configuration/postgresql' variables
+      include_vars:
+        file: ../vars-repmgr.yml
+
+    - name: Include postgresql role
+      include_role:
+        name: postgresql
+      vars:
+        yum_lock_timeout: 300 # https://github.com/ansible/ansible/issues/57189
+        roles_with_generated_vars: [ ] # don't execute PgPool related tasks
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/molecule.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/molecule.yml
new file mode 100644
index 0000000000..6d1dbdbdc4
--- /dev/null
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/molecule.yml
@@ -0,0 +1,45 @@
+---
+dependency:
+  enabled: false
+lint: ansible-lint --exclude molecule
+driver:
+  name: docker
+platforms:
+  - name: instance-1
+    groups:
+      - postgresql
+    image: geerlingguy/docker-ubuntu1804-ansible:python2
+    pre_build_image: true
+    capabilities:
+      - SYS_ADMIN
+    command: /lib/systemd/systemd
+    tmpfs:
+      - /run
+      - /tmp
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+  - name: instance-2
+    groups:
+      - postgresql
+    image: geerlingguy/docker-ubuntu1804-ansible:python2
+    pre_build_image: true
+    capabilities:
+      - SYS_ADMIN
+    command: /lib/systemd/systemd
+    tmpfs:
+      - /run
+      - /tmp
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+provisioner:
+  name: ansible
+  playbooks:
+    prepare: prepare.yml
+    converge: converge.yml
+    verify: verify.yml
+  inventory:
+    group_vars:
+      postgresql:
+        ansible_python_interpreter: /usr/bin/python2
+verifier:
+  name: ansible
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/prepare.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/prepare.yml
new file mode 100644
index 0000000000..eb2780ae7f
--- /dev/null
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/prepare.yml
@@ -0,0 +1,6 @@
+---
+- name: Converge
+  hosts: postgresql
+  tasks:
+    - name: Add repositories for dependencies downloading
+      script: ../add-repos-debian.sh
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/verify.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/verify.yml
new file mode 100644
index 0000000000..edebb3f39e
--- /dev/null
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/verify.yml
@@ -0,0 +1,53 @@
+---
+- name: Verify
+  hosts: postgresql
+  gather_facts: false
+  tasks:
+    - name: Check that DB port is open
+      block:
+        - name: Ensure that DB port is open
+          wait_for:
+            host: 0.0.0.0
+            port: 5432
+            state: started
+            delay: 0
+            timeout: 3
+          register: port_status
+
+        - name: Verify that port status is not changed
+          assert:
+            that:
+              - not port_status.changed
+
+    - name: Check that PostgreSQL services are started and enabled
+      block:
+        - name: Ensure that postgresql service is started and enabled
+          systemd:
+            name: postgresql
+            enabled: true
+          register: svc_status
+
+        - name: Ensure that postgresql@13-main service is started and enabled
+          systemd:
+            name: postgresql
+            enabled: true
+          register: svc_main_status
+
+        - name: Verify that service statuses are not changed
+          assert:
+            that:
+              - not svc_status.changed
+              - not svc_main_status.changed
+
+    - name: Check that repmgrd service is started and enabled
+      block:
+        - name: Ensure that repmgrd service is started and enabled
+          systemd:
+            name: repmgrd
+            enabled: true
+          register: svc_repmgr_status
+
+        - name: Verify that service status is not changed
+          assert:
+            that:
+              - not svc_repmgr_status.changed
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-single-node/converge.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-single-node/converge.yml
new file mode 100644
index 0000000000..c3d366c48e
--- /dev/null
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-single-node/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: Converge
+  hosts: postgresql
+  become: true
+  become_method: sudo
+  module_defaults:
+    shell:
+      executable: /bin/bash
+  tasks:
+    - name: Include 'configuration/postgresql' variables
+      include_vars:
+        file: ../vars-single-node.yml
+
+    - name: Include postgresql role
+      include_role:
+        name: postgresql
+      vars:
+        yum_lock_timeout: 300 # https://github.com/ansible/ansible/issues/57189
+        roles_with_generated_vars: [ ] # don't execute PgPool related tasks
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-single-node/molecule.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-single-node/molecule.yml
new file mode 100644
index 0000000000..6d1dbdbdc4
--- /dev/null
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-single-node/molecule.yml
@@ -0,0 +1,45 @@
+---
+dependency:
+  enabled: false
+lint: ansible-lint --exclude molecule
+driver:
+  name: docker
+platforms:
+  - name: instance-1
+    groups:
+      - postgresql
+    image: geerlingguy/docker-ubuntu1804-ansible:python2
+    pre_build_image: true
+    capabilities:
+      - SYS_ADMIN
+    command: /lib/systemd/systemd
+    tmpfs:
+      - /run
+      - /tmp
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+  - name: instance-2
+    groups:
+      - postgresql
+    image: geerlingguy/docker-ubuntu1804-ansible:python2
+    pre_build_image: true
+    capabilities:
+      - SYS_ADMIN
+    command: /lib/systemd/systemd
+    tmpfs:
+      - /run
+      - /tmp
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+provisioner:
+  name: ansible
+  playbooks:
+    prepare: prepare.yml
+    converge: converge.yml
+    verify: verify.yml
+  inventory:
+    group_vars:
+      postgresql:
+        ansible_python_interpreter: /usr/bin/python2
+verifier:
+  name: ansible
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-single-node/prepare.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-single-node/prepare.yml
new file mode 100644
index 0000000000..eb2780ae7f
--- /dev/null
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-single-node/prepare.yml
@@ -0,0 +1,6 @@
+---
+- name: Converge
+  hosts: postgresql
+  tasks:
+    - name: Add repositories for dependencies downloading
+      script: ../add-repos-debian.sh
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-single-node/verify.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-single-node/verify.yml
new file mode 100644
index 0000000000..ab7f05e55e
--- /dev/null
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-single-node/verify.yml
@@ -0,0 +1,40 @@
+---
+- name: Verify
+  hosts: postgresql
+  gather_facts: false
+  tasks:
+    - name: Check that DB port is open
+      block:
+        - name: Ensure that DB port is open
+          wait_for:
+            host: 0.0.0.0
+            port: 5432
+            state: started
+            delay: 0
+            timeout: 3
+          register: port_status
+
+        - name: Verify that port status is not changed
+          assert:
+            that:
+              - not port_status.changed
+
+    - name: Check that PostgreSQL services are started and enabled
+      block:
+        - name: Ensure that postgresql service is started and enabled
+          systemd:
+            name: postgresql
+            enabled: true
+          register: svc_status
+
+        - name: Ensure that postgresql@13-main service is started and enabled
+          systemd:
+            name: postgresql
+            enabled: true
+          register: svc_main_status
+
+        - name: Verify that service statuses are not changed
+          assert:
+            that:
+              - not svc_status.changed
+              - not svc_main_status.changed
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-repmgr/converge.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-repmgr/converge.yml
new file mode 100644
index 0000000000..92c97d6f34
--- /dev/null
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-repmgr/converge.yml
@@ -0,0 +1,16 @@
+---
+- name: Converge
+  hosts: postgresql
+  become: true
+  become_method: sudo
+  tasks:
+    - name: Include 'configuration/postgresql' variables
+      include_vars:
+        file: ../vars-repmgr.yml
+
+    - name: Include postgresql role
+      include_role:
+        name: postgresql
+      vars:
+        yum_lock_timeout: 300 # https://github.com/ansible/ansible/issues/57189
+        roles_with_generated_vars: [ ] # don't execute PgPool related tasks
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-repmgr/molecule.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-repmgr/molecule.yml
new file mode 100644
index 0000000000..c08478a60d
--- /dev/null
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-repmgr/molecule.yml
@@ -0,0 +1,41 @@
+---
+dependency:
+  enabled: false
+lint: ansible-lint --exclude molecule
+driver:
+  name: docker
+platforms:
+  - name: instance-1
+    groups:
+      - postgresql
+    image: geerlingguy/docker-centos7-ansible
+    pre_build_image: true
+    capabilities:
+      - SYS_ADMIN
+    command: /lib/systemd/systemd
+    tmpfs:
+      - /run
+      - /tmp
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+  - name: instance-2
+    groups:
+      - postgresql
+    image: geerlingguy/docker-centos7-ansible
+    pre_build_image: true
+    capabilities:
+      - SYS_ADMIN
+    command: /lib/systemd/systemd
+    tmpfs:
+      - /run
+      - /tmp
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+provisioner:
+  name: ansible
+  playbooks:
+    prepare: prepare.yml
+    converge: converge.yml
+    verify: verify.yml
+verifier:
+  name: ansible
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-repmgr/prepare.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-repmgr/prepare.yml
new file mode 100644
index 0000000000..50bd6c1f35
--- /dev/null
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-repmgr/prepare.yml
@@ -0,0 +1,6 @@
+---
+- name: Converge
+  hosts: postgresql
+  tasks:
+    - name: Add repositories for dependencies downloading
+      script: ../add-repos-redhat.sh
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-repmgr/verify.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-repmgr/verify.yml
new file mode 100644
index 0000000000..63ec39ad26
--- /dev/null
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-repmgr/verify.yml
@@ -0,0 +1,46 @@
+---
+- name: Verify
+  hosts: postgresql
+  gather_facts: false
+  tasks:
+    - name: Check that DB port is open
+      block:
+        - name: Ensure that DB port is open
+          wait_for:
+            host: 0.0.0.0
+            port: 5432
+            state: started
+            delay: 0
+            timeout: 3
+          register: port_status
+
+        - name: Verify that port status is not changed
+          assert:
+            that:
+              - not port_status.changed
+
+    - name: Check that postgresql service is started and enabled
+      block:
+        - name: Ensure that postgresql service is started and enabled
+          systemd:
+            name: postgresql-13
+            enabled: true
+          register: svc_status
+
+        - name: Verify that service status is not changed
+          assert:
+            that:
+              - not svc_status.changed
+
+    - name: Check that repmgrd service is started and enabled
+      block:
+        - name: Ensure that repmgrd service is started and enabled
+          systemd:
+            name: repmgr13
+            enabled: true
+          register: svc_repmgr_status
+
+        - name: Verify that service status is not changed
+          assert:
+            that:
+              - not svc_repmgr_status.changed
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-single-node/converge.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-single-node/converge.yml
new file mode 100644
index 0000000000..5977feecce
--- /dev/null
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-single-node/converge.yml
@@ -0,0 +1,16 @@
+---
+- name: Converge
+  hosts: postgresql
+  become: true
+  become_method: sudo
+  tasks:
+    - name: Include 'configuration/postgresql' variables
+      include_vars:
+        file: ../vars-single-node.yml
+
+    - name: Include postgresql role
+      include_role:
+        name: postgresql
+      vars:
+        yum_lock_timeout: 300 # https://github.com/ansible/ansible/issues/57189
+        roles_with_generated_vars: [ ] # don't execute PgPool related tasks
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-single-node/molecule.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-single-node/molecule.yml
new file mode 100644
index 0000000000..0aebf483b5
--- /dev/null
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-single-node/molecule.yml
@@ -0,0 +1,28 @@
+---
+dependency:
+  enabled: false
+lint: ansible-lint --exclude molecule
+driver:
+  name: docker
+platforms:
+  - name: instance-1
+    groups:
+      - postgresql
+    image: geerlingguy/docker-centos7-ansible
+    pre_build_image: true
+    capabilities:
+      - SYS_ADMIN
+    command: /lib/systemd/systemd
+    tmpfs:
+      - /run
+      - /tmp
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+provisioner:
+  name: ansible
+  playbooks:
+    prepare: prepare.yml
+    converge: converge.yml
+    verify: verify.yml
+verifier:
+  name: ansible
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-single-node/prepare.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-single-node/prepare.yml
new file mode 100644
index 0000000000..50bd6c1f35
--- /dev/null
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-single-node/prepare.yml
@@ -0,0 +1,6 @@
+---
+- name: Converge
+  hosts: postgresql
+  tasks:
+    - name: Add repositories for dependencies downloading
+      script: ../add-repos-redhat.sh
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-single-node/verify.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-single-node/verify.yml
new file mode 100644
index 0000000000..d54e6e6510
--- /dev/null
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-single-node/verify.yml
@@ -0,0 +1,33 @@
+---
+- name: Verify
+  hosts: postgresql
+  gather_facts: false
+  tasks:
+    - name: Check that DB port is open
+      block:
+        - name: Ensure that DB port is open
+          wait_for:
+            host: 0.0.0.0
+            port: 5432
+            state: started
+            delay: 0
+            timeout: 3
+          register: port_status
+
+        - name: Verify that port status is not changed
+          assert:
+            that:
+              - not port_status.changed
+
+    - name: Check that postgresql service is started and enabled
+      block:
+        - name: Ensure that postgresql service is started and enabled
+          systemd:
+            name: postgresql-13
+            enabled: true
+          register: svc_status
+
+        - name: Verify that service status is not changed
+          assert:
+            that:
+              - not svc_status.changed
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/vars-repmgr.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/vars-repmgr.yml
new file mode 100644
index 0000000000..b863648a3c
--- /dev/null
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/vars-repmgr.yml
@@ -0,0 +1,107 @@
+---
+kind: configuration/postgresql
+title: PostgreSQL
+specification:
+  config_file:
+    parameter_groups:
+      - name: CONNECTIONS AND AUTHENTICATION
+        subgroups:
+          - name: Connection Settings
+            parameters:
+              - name: listen_addresses
+                value: "'*'"
+                comment: listen on all addresses
+          - name: Security and Authentication
+            parameters:
+              - name: ssl
+                value: off
+                comment: to have the default value also on Ubuntu
+      - name: RESOURCE USAGE (except WAL)
+        subgroups:
+          - name: Kernel Resource Usage
+            parameters:
+              - name: shared_preload_libraries
+                value: AUTOCONFIGURED
+                comment: set by automation
+      - name: ERROR REPORTING AND LOGGING
+        subgroups:
+          - name: Where to Log
+            parameters:
+              - name: log_directory
+                value: "'/var/log/postgresql'"
+                comment: to have standard location for Filebeat and logrotate
+              - name: log_filename
+                value: "'postgresql.log'"
+                comment: to use logrotate with common configuration
+      - name: WRITE AHEAD LOG
+        subgroups:
+          - name: Settings
+            parameters:
+              - name: wal_level
+                value: replica
+                when: replication
+      - name: REPLICATION
+        subgroups:
+          - name: Sending Server(s)
+            parameters:
+              - name: max_wal_senders
+                value: 10
+                comment: maximum number of simultaneously running WAL sender processes
+                when: replication
+              - name: wal_keep_size
+                value: 500
+                comment: the size of WAL files held for standby servers (MB)
+                when: replication
+          - name: Standby Servers
+            parameters:
+              - name: hot_standby
+                value: on
+                comment: must be 'on' for repmgr needs, ignored on primary but recommended
+                  in case primary becomes standby
+                when: replication
+  extensions:
+    pgaudit:
+      enabled: true
+      shared_preload_libraries:
+        - pgaudit
+      config_file_parameters:
+        log_connections: off
+        log_disconnections: off
+        log_statement: none
+        log_line_prefix: "'%m [%p] %q%u@%d,host=%h '"
+        pgaudit.log: "'write, function, role, ddl, misc_set'"
+        pgaudit.log_catalog: 'off # to reduce overhead of logging'
+        pgaudit.log_relation: 'on # separate log entry for each relation'
+        pgaudit.log_statement_once: off
+        pgaudit.log_parameter: on
+    pgbouncer:
+      enabled: false
+    replication:
+      enabled: true
+      replication_user_name: epi_repmgr
+      replication_user_password: PASSWORD_TO_CHANGE
+      privileged_user_name: epi_repmgr_admin
+      privileged_user_password: PASSWORD_TO_CHANGE
+      repmgr_database: epi_repmgr
+      shared_preload_libraries:
+        - repmgr
+  logrotate:
+    pgbouncer:
+      period: weekly
+      rotations: 5
+    postgresql: |-
+      /var/log/postgresql/postgresql*.log {
+          maxsize 10M
+          daily
+          rotate 6
+          copytruncate
+          # delaycompress is for Filebeat
+          delaycompress
+          compress
+          notifempty
+          missingok
+          su root root
+          nomail
+          # to have multiple unique filenames per day when dateext option is set
+          dateformat -%Y%m%dH%H
+      }
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/vars-single-node.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/vars-single-node.yml
new file mode 100644
index 0000000000..dac251858b
--- /dev/null
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/vars-single-node.yml
@@ -0,0 +1,107 @@
+---
+kind: configuration/postgresql
+title: PostgreSQL
+specification:
+  config_file:
+    parameter_groups:
+      - name: CONNECTIONS AND AUTHENTICATION
+        subgroups:
+          - name: Connection Settings
+            parameters:
+              - name: listen_addresses
+                value: "'*'"
+                comment: listen on all addresses
+          - name: Security and Authentication
+            parameters:
+              - name: ssl
+                value: off
+                comment: to have the default value also on Ubuntu
+      - name: RESOURCE USAGE (except WAL)
+        subgroups:
+          - name: Kernel Resource Usage
+            parameters:
+              - name: shared_preload_libraries
+                value: AUTOCONFIGURED
+                comment: set by automation
+      - name: ERROR REPORTING AND LOGGING
+        subgroups:
+          - name: Where to Log
+            parameters:
+              - name: log_directory
+                value: "'/var/log/postgresql'"
+                comment: to have standard location for Filebeat and logrotate
+              - name: log_filename
+                value: "'postgresql.log'"
+                comment: to use logrotate with common configuration
+      - name: WRITE AHEAD LOG
+        subgroups:
+          - name: Settings
+            parameters:
+              - name: wal_level
+                value: replica
+                when: replication
+      - name: REPLICATION
+        subgroups:
+          - name: Sending Server(s)
+            parameters:
+              - name: max_wal_senders
+                value: 10
+                comment: maximum number of simultaneously running WAL sender processes
+                when: replication
+              - name: wal_keep_size
+                value: 500
+                comment: the size of WAL files held for standby servers (MB)
+                when: replication
+          - name: Standby Servers
+            parameters:
+              - name: hot_standby
+                value: on
+                comment: must be 'on' for repmgr needs, ignored on primary but recommended
+                  in case primary becomes standby
+                when: replication
+  extensions:
+    pgaudit:
+      enabled: true
+      shared_preload_libraries:
+        - pgaudit
+      config_file_parameters:
+        log_connections: off
+        log_disconnections: off
+        log_statement: none
+        log_line_prefix: "'%m [%p] %q%u@%d,host=%h '"
+        pgaudit.log: "'write, function, role, ddl, misc_set'"
+        pgaudit.log_catalog: 'off # to reduce overhead of logging'
+        pgaudit.log_relation: 'on # separate log entry for each relation'
+        pgaudit.log_statement_once: off
+        pgaudit.log_parameter: on
+    pgbouncer:
+      enabled: false
+    replication:
+      enabled: false
+      replication_user_name: epi_repmgr
+      replication_user_password: PASSWORD_TO_CHANGE
+      privileged_user_name: epi_repmgr_admin
+      privileged_user_password: PASSWORD_TO_CHANGE
+      repmgr_database: epi_repmgr
+      shared_preload_libraries:
+        - repmgr
+  logrotate:
+    pgbouncer:
+      period: weekly
+      rotations: 5
+    postgresql: |-
+      /var/log/postgresql/postgresql*.log {
+          maxsize 10M
+          daily
+          rotate 6
+          copytruncate
+          # delaycompress is for Filebeat
+          delaycompress
+          compress
+          notifempty
+          missingok
+          su root root
+          nomail
+          # to have multiple unique filenames per day when dateext option is set
+          dateformat -%Y%m%dH%H
+      }

From da57e0c32d3cff11e5b71e71fb5fb410d86ed2e8 Mon Sep 17 00:00:00 2001
From: atsikham <atsikham@users.noreply.github.com>
Date: Mon, 24 May 2021 21:38:27 +0200
Subject: [PATCH 11/28] Modified vars

---
 .../roles/backup/tasks/postgresql.yml         |  2 +-
 .../roles/postgresql/defaults/main.yml        |  6 +--
 .../roles/postgresql/molecule/README.adoc     |  3 +-
 .../tasks/extensions/pgbouncer/extension.yml  |  1 +
 .../extensions/replication/extension.yml      | 41 +++++++----------
 .../playbooks/roles/postgresql/tasks/main.yml | 44 ++++++++++++-------
 .../roles/postgresql/templates/repmgr.conf.j2 |  6 +--
 7 files changed, 55 insertions(+), 48 deletions(-)

diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/backup/tasks/postgresql.yml b/core/src/epicli/data/common/ansible/playbooks/roles/backup/tasks/postgresql.yml
index d4bd207245..8ba1acf0d6 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/backup/tasks/postgresql.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/backup/tasks/postgresql.yml
@@ -10,7 +10,7 @@
 - name: Check if database is running on node0 database server
   become: true
   become_user: postgres
-  command: "{{ repmgr.pg_bindir[ansible_os_family] }}/pg_isready"
+  command: "{{ pg.bindir[ansible_os_family] }}/pg_isready"
   register: node0
   ignore_errors: True
   when: groups['postgresql'][0] == inventory_hostname
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/defaults/main.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/defaults/main.yml
index cd340fd42b..f810ed2015 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/defaults/main.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/defaults/main.yml
@@ -1,5 +1,8 @@
 ---
 pg:
+  bindir:
+    RedHat: /usr/pgsql-13/bin
+    Debian: /usr/lib/postgresql/13/bin
   service_name:
     RedHat: postgresql-13
     Debian: postgresql
@@ -20,9 +23,6 @@ repmgr:
   bindir:
     RedHat: /usr/pgsql-13/bin
     Debian: /usr/bin
-  pg_bindir:
-    RedHat: /usr/pgsql-13/bin
-    Debian: /usr/lib/postgresql/13/bin
   service_name:
     RedHat: repmgr13
     Debian: repmgrd
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/README.adoc b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/README.adoc
index fe6ce785ff..f30bbb1a58 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/README.adoc
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/README.adoc
@@ -3,7 +3,7 @@
 == Requirements
 
 * Internet connection
-* General molecule link:https://molecule.readthedocs.io/en/latest/installation.html[dependencies]
+* Molecule link:https://molecule.readthedocs.io/en/latest/installation.html[dependencies]
 * Docker
 * ansible-lint
 
@@ -25,6 +25,7 @@ molecule test -s <scenario-name>
 ----
 
 === Separate steps
+
 [source:bash]
 ----
 molecule lint -s <scenario-name>
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/pgbouncer/extension.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/pgbouncer/extension.yml
index dfcb3df49b..70b04a2046 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/pgbouncer/extension.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/pgbouncer/extension.yml
@@ -20,6 +20,7 @@
         path: /etc/pgbouncer/userlist.txt
         line: '"postgres" "*"'
         create: true
+        mode: u=rw,g=,o=
         backup: true
 
     - name: Extensions | PgBouncer | Create pgbouncer logrotate configuration file
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml
index 8c4010c70c..bccc8a0129 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml
@@ -1,7 +1,7 @@
 ---
-- name: Extensions | Repmgr | RedHat | Create repmgr symlink
+- name: Extensions | Repmgr | RedHat | Create Repmgr symlink
   file:
-    src: "{{ repmgr.pg_bindir['RedHat'] }}/repmgr"
+    src: "{{ pg.bindir['RedHat'] }}/repmgr"
     dest: "/usr/bin/repmgr"
     state: link
   when:
@@ -46,22 +46,15 @@
     group: postgres
     mode: u=rw,g=,o=
 
-# --- Configure repmgr ---
+# --- Configure Repmgr ---
 
-- name: Extensions | Repmgr | Create database for repmgr
+- name: Extensions | Repmgr | Create database for Repmgr
   become_user: postgres
   postgresql_db:
     name: "{{ specification.extensions.replication.repmgr_database }}"
     owner: "{{ specification.extensions.replication.replication_user_name }}"
 
-# Node id is a constant value independent on order in Ansible host group
-- name: Extensions | Repmgr | Set node id
-  set_fact:
-    pg_repmgr_node_id: >-
-      {{ pg_repmgr_node_id | default(groups.postgresql.index(inventory_hostname) + 1) }}
-    cacheable: true
-
-- name: Extensions | Repmgr | Create repmgr config file
+- name: Extensions | Repmgr | Create Repmgr config file
   template:
     src: repmgr.conf.j2
     dest: "{{ repmgr.config_dir[ansible_os_family] }}/repmgr.conf"
@@ -70,10 +63,10 @@
     mode: u=rw,g=,o=
   register: template_repmgr_conf
   vars:
-    node_id: "{{ pg_repmgr_node_id }}"
+    node_id: "{{ pg_node_id }}"
 
 # On Ubuntu config file location is not set by package (see https://repmgr.org/docs/5.2/packages-debian-ubuntu.html).
-# Create symlink to allow using repmgr commands without specifying config file location (which is custom).
+# Create symlink to allow using Repmgr commands without specifying config file location (which is custom).
 # See https://repmgr.org/docs/5.2/configuration-file.html
 - name: Extensions | Repmgr | Debian specific tasks
   when: ansible_os_family == 'Debian'
@@ -87,7 +80,7 @@
         group: postgres
       when: template_repmgr_conf.dest != '/etc/repmgr.conf'
 
-    # For repmgr installed from Ubuntu package additional configuration is required before repmgrd is started as daemon
+    # For Repmgr installed from Ubuntu package additional configuration is required before repmgrd is started as daemon
     - name: Extensions | Repmgr | Set repmgr.conf file in /etc/default/repmgrd
       replace:
         path: /etc/default/repmgrd
@@ -135,9 +128,9 @@
         # on system) and postgresql@.service (service template for clusters). The latter is 'PartOf' the former.
         # Ansible seems to not wait for dependent service to be stopped so we need to stop both to avoid error
         # from 'repmgr standby clone'.
-        - name: Extensions | Repmgr | Stop postgresql service
+        - name: Extensions | Repmgr | Stop PostgreSQL service
           systemd:
-            name: "{{ item }}"
+            name: "{{ service_name }}"
             state: stopped
           vars:
             _services:
@@ -146,9 +139,11 @@
                 - "{{ pg.instantiated_service_name['Debian'] }}"
               RedHat:
                 - "{{ pg.service_name['RedHat'] }}"
+          loop_control:
+            loop_var: service_name
           loop: "{{ _services[ansible_os_family] }}"
 
-        - name: Extensions | Repmgr | Clone standby node with repmgr
+        - name: Extensions | Repmgr | Clone standby node with Repmgr
           become_user: postgres
           command: >-
             {{ repmgr.bindir[ansible_os_family] }}/repmgr standby clone
@@ -156,12 +151,12 @@
               -U {{ specification.extensions.replication.privileged_user_name }}
               -d {{ specification.extensions.replication.repmgr_database }} -p 5432 --force
 
-        - name: Extensions | Repmgr | Start postgresql service
+        - name: Extensions | Repmgr | Start PostgreSQL service
           systemd:
             name: "{{ pg.service_name[ansible_os_family] }}"
             state: started
 
-        - name: Extensions | Repmgr | Register node with repmgr
+        - name: Extensions | Repmgr | Register node with Repmgr
           become_user: postgres
           command: >-
             {{ repmgr.bindir[ansible_os_family] }}/repmgr standby register --force
@@ -171,7 +166,7 @@
                   connect_timeout=2'
               --upstream-node-id 1
 
-    - name: Extensions | Repmgr | Restart and enable repmgr service
+    - name: Extensions | Repmgr | Restart and enable Repmgr service
       systemd:
         name: "{{ repmgr.service_name[ansible_os_family] }}"
         state: restarted
@@ -193,7 +188,7 @@
     - name: Extensions | Repmgr | Tasks to run only on standby node
       when: pg_node_primary_found.stdout != inventory_hostname
       block:
-        - name: Extensions | Repmgr | Check if node is not attached to repmgr
+        - name: Extensions | Repmgr | Check if node is not attached to Repmgr
           become_user: postgres
           command: "{{ repmgr.bindir[ansible_os_family] }}/repmgr cluster show"
           changed_when: false
@@ -202,7 +197,5 @@
 
         - name: Extensions | Repmgr | Attach active standby to current primary node
           when: "'not attached to its upstream node' in pg_cluster_status.stdout|lower"
-          become: true
           become_user: postgres
-          become_method: sudo
           command: "{{ repmgr.bindir[ansible_os_family] }}/repmgr standby follow"
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/main.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/main.yml
index 639263cd90..2d57054131 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/main.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/main.yml
@@ -2,19 +2,29 @@
 - name: Set 'enabled_extensions' fact
   set_fact:
     enabled_extensions: >-
-      {{ (_defined_extensions | selectattr('config.enabled') | list) + _undefined_extensions }}
+      {{ _defined_enabled_extensions + _undefined_extensions }}
   vars:
-    _defined_extensions: >-
+    _defined_enabled_extensions: >-
       {{ specification.extensions
           | dict2items(key_name='name', value_name='config')
           | selectattr('config.enabled', 'defined')
+          | selectattr('config.enabled')
+          | map(attribute='name')
           | list }}
     _undefined_extensions: >-
       {{ specification.extensions
           | dict2items(key_name='name', value_name='config')
           | selectattr('config.enabled', 'undefined')
+          | map(attribute='name')
           | list }}
 
+# Node id is a constant value independent on order in Ansible host group
+- name: Set 'pg_node_id' fact
+  set_fact:
+    pg_node_id: >-
+      {{ pg_node_id | default(groups.postgresql.index(inventory_hostname) + 1) }}
+    cacheable: true
+
 - name: Install OS-specific packages
   package:
     name: "{{ _packages[ansible_os_family] }}"
@@ -27,16 +37,16 @@
         - postgresql-client-13
         - postgresql-13
         - postgresql-contrib-13
-        - python-psycopg2 # required for postgresql ansible management
+        - python-psycopg2 # required for PostgreSQL ansible management
       RedHat:
         - postgresql13-server
-        - python-psycopg2 # required for postgresql ansible management
+        - python-psycopg2 # required for PostgreSQL ansible management
   module_defaults:
     yum: { lock_timeout: "{{ yum_lock_timeout }}" }
 
 # Extension packages need to be installed first to be able to process PostgreSQL config
 - name: Install extension packages
-  include_tasks: extensions/{{ extension.name }}/packages.yml
+  include_tasks: extensions/{{ extension }}/packages.yml
   loop_control:
     loop_var: extension
   loop: "{{ enabled_extensions }}"
@@ -63,12 +73,15 @@
       register: pg_hba_conf_stat
 
     - name: RedHat | Initialize database
+      become_user: postgres
       when: not pg_hba_conf_stat.stat.exists
-      command: /usr/pgsql-13/bin/postgresql-13-setup initdb {{ pg.service_name[ansible_os_family] }}
+      command: "{{ pg.bindir[ansible_os_family] }}/initdb"
+      environment:
+        PGDATA: "{{ pg.data_dir[ansible_os_family] }}"
 
-- name: Ensure that postgresql service is started
+- name: Ensure that PostgreSQL service is started
   block:
-    - name: Ensure that postgresql service is started
+    - name: Ensure that PostgreSQL service is started
       systemd:
         name: "{{ pg.service_name[ansible_os_family] }}"
         state: started
@@ -86,7 +99,6 @@
 - name: Set runtime_shared_preload_libraries fact
   block:
     - name: Get PostgreSQL settings
-      become: true
       become_user: postgres
       postgresql_info:
         filter: settings
@@ -114,9 +126,9 @@
   loop: "{{ _files }}"
   register: change_pg_config
 
-- name: Restart postgresql service if configuration changed
+- name: Restart PostgreSQL service if configuration changed
   block:
-    - name: Restart postgresql service if configuration changed
+    - name: Restart PostgreSQL service if configuration changed
       systemd:
         name: "{{ pg.service_name[ansible_os_family] }}"
         state: restarted
@@ -124,7 +136,7 @@
     - *check-debian-service
   when: (change_pg_config.results | map(attribute='changed') | list) is any
 
-- name: Configure postgresql logrotate
+- name: Configure PostgreSQL logrotate
   block:
     - name: Remove logrotate configuration provided by 'postgresql-common' package
       file:
@@ -132,7 +144,7 @@
         state: absent
       when: ansible_os_family == 'Debian'
 
-    - name: Create postgresql logrotate configuration file
+    - name: Create PostgreSQL logrotate configuration file
       template:
         src: logrotate-postgresql.conf.j2
         dest: /etc/logrotate.d/postgresql
@@ -141,9 +153,9 @@
         mode: u=rw,g=r,o=r
 
 - name: Include extensions
-  include_tasks: extensions/{{ data.name }}/extension.yml
+  include_tasks: extensions/{{ extension }}/extension.yml
   loop_control:
-    loop_var: data
+    loop_var: extension
   loop: "{{ enabled_extensions }}"
 
 # PgPool is configured only if such K8s application is enabled
@@ -169,4 +181,4 @@
                                                                  | default({}) }}
       when:
         - pgpool.env is defined
-        - groups['postgresql'][0] == inventory_hostname
+        - pg_node_id|int == 1
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/repmgr.conf.j2 b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/repmgr.conf.j2
index 88925e69ed..f940aa1468 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/repmgr.conf.j2
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/repmgr.conf.j2
@@ -4,14 +4,14 @@ conninfo='host={{ ansible_default_ipv4.address }} user={{ specification.extensio
 data_directory='{{ pg.data_dir[ansible_os_family] }}'
 
 failover=automatic
-promote_command='{{ repmgr.pg_bindir[ansible_os_family] }}/repmgr standby promote --log-to-file'
-follow_command='{{ repmgr.pg_bindir[ansible_os_family] }}/repmgr standby follow --log-to-file --upstream-node-id=%n'
+promote_command='{{ pg.bindir[ansible_os_family] }}/repmgr standby promote --log-to-file'
+follow_command='{{ pg.bindir[ansible_os_family] }}/repmgr standby follow --log-to-file --upstream-node-id=%n'
 monitoring_history=yes
 monitor_interval_secs=10
 
 log_file='/var/log/postgresql/repmgr.log'
 
-pg_bindir='{{ repmgr.pg_bindir[ansible_os_family] }}/'
+pg_bindir='{{ pg.bindir[ansible_os_family] }}/'
 service_start_command='sudo /bin/systemctl start {{ pg.service_name[ansible_os_family] }}'
 service_stop_command='sudo /bin/systemctl stop {{ pg.service_name[ansible_os_family] }}'
 service_restart_command='sudo /bin/systemctl restart {{ pg.service_name[ansible_os_family] }}'

From 6938d72f28d6c07b4740178a9b7230f092cef7b9 Mon Sep 17 00:00:00 2001
From: atsikham <atsikham@users.noreply.github.com>
Date: Thu, 27 May 2021 15:08:49 +0200
Subject: [PATCH 12/28] Asciidoc to markdown

---
 .../roles/postgresql/molecule/README.adoc     | 35 -------------------
 .../roles/postgresql/molecule/README.md       | 32 +++++++++++++++++
 2 files changed, 32 insertions(+), 35 deletions(-)
 delete mode 100644 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/README.adoc
 create mode 100644 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/README.md

diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/README.adoc b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/README.adoc
deleted file mode 100644
index f30bbb1a58..0000000000
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/README.adoc
+++ /dev/null
@@ -1,35 +0,0 @@
-= Installation guide
-
-== Requirements
-
-* Internet connection
-* Molecule link:https://molecule.readthedocs.io/en/latest/installation.html[dependencies]
-* Docker
-* ansible-lint
-
-== Installation
-
-[source:bash]
-----
-pip install 'molecule[docker]'
-pip install ansible-lint
-----
-
-== Execution
-
-=== General
-
-[source:bash]
-----
-molecule test -s <scenario-name>
-----
-
-=== Separate steps
-
-[source:bash]
-----
-molecule lint -s <scenario-name>
-molecule converge -s <scenario-name>
-molecule idempotence -s <scenario-name>
-molecule verify -s <scenario-name>
-----
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/README.md b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/README.md
new file mode 100644
index 0000000000..aebec936dd
--- /dev/null
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/README.md
@@ -0,0 +1,32 @@
+# Installation guide
+
+## Requirements
+
+- Internet connection
+- Molecule [dependencies](https://molecule.readthedocs.io/en/latest/installation.html)
+- Docker
+- ansible-lint
+
+## Installation
+
+```bash
+pip install 'molecule[docker]'
+pip install ansible-lint
+```
+
+## Execution
+
+### General
+
+```bash
+molecule test -s <scenario-name>
+```
+
+### Separate steps
+
+```bash
+molecule lint -s <scenario-name>
+molecule converge -s <scenario-name>
+molecule idempotence -s <scenario-name>
+molecule verify -s <scenario-name>
+```

From f313962c9ee4dbf646e0e373df32ddf533364d64 Mon Sep 17 00:00:00 2001
From: Anatoli Tsikhamirau <anatoliytihomirov@yahoo.com>
Date: Tue, 1 Jun 2021 21:00:37 +0200
Subject: [PATCH 13/28] Update
 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/prepare.yml

Co-authored-by: to-bar <46519524+to-bar@users.noreply.github.com>
---
 .../roles/postgresql/molecule/debian-repmgr/prepare.yml         | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/prepare.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/prepare.yml
index eb2780ae7f..06ff261f2a 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/prepare.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/prepare.yml
@@ -1,5 +1,5 @@
 ---
-- name: Converge
+- name: Prepare
   hosts: postgresql
   tasks:
     - name: Add repositories for dependencies downloading

From 33f5fe8ef31879719f6c3e951c1eb72beaaf106d Mon Sep 17 00:00:00 2001
From: Anatoli Tsikhamirau <anatoliytihomirov@yahoo.com>
Date: Tue, 1 Jun 2021 21:04:34 +0200
Subject: [PATCH 14/28] Update
 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/verify.yml

Co-authored-by: to-bar <46519524+to-bar@users.noreply.github.com>
---
 .../roles/postgresql/molecule/debian-repmgr/verify.yml          | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/verify.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/verify.yml
index edebb3f39e..067f00443c 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/verify.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/verify.yml
@@ -29,7 +29,7 @@
 
         - name: Ensure that postgresql@13-main service is started and enabled
           systemd:
-            name: postgresql
+            name: postgresql@13-main
             enabled: true
           register: svc_main_status
 

From 717bfa84cca3255caab1d4d2affd075459354a84 Mon Sep 17 00:00:00 2001
From: Anatoli Tsikhamirau <anatoliytihomirov@yahoo.com>
Date: Tue, 1 Jun 2021 21:16:37 +0200
Subject: [PATCH 15/28] Update
 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-repmgr/prepare.yml

Co-authored-by: to-bar <46519524+to-bar@users.noreply.github.com>
---
 .../roles/postgresql/molecule/redhat-repmgr/prepare.yml         | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-repmgr/prepare.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-repmgr/prepare.yml
index 50bd6c1f35..5bb8babcdc 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-repmgr/prepare.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-repmgr/prepare.yml
@@ -1,5 +1,5 @@
 ---
-- name: Converge
+- name: Prepare
   hosts: postgresql
   tasks:
     - name: Add repositories for dependencies downloading

From 67f355013ea7b63f5d6b29f78059a3b228a13d17 Mon Sep 17 00:00:00 2001
From: Anatoli Tsikhamirau <anatoliytihomirov@yahoo.com>
Date: Tue, 1 Jun 2021 21:16:57 +0200
Subject: [PATCH 16/28] Update
 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/pg_hba.conf.j2

Co-authored-by: to-bar <46519524+to-bar@users.noreply.github.com>
---
 .../ansible/playbooks/roles/postgresql/templates/pg_hba.conf.j2 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/pg_hba.conf.j2 b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/pg_hba.conf.j2
index 1f4a35bee1..51edffaf65 100755
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/pg_hba.conf.j2
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/pg_hba.conf.j2
@@ -93,6 +93,6 @@ local   replication     all                                     peer
 host    replication     all             127.0.0.1/32            scram-sha-256
 host    replication     all             ::1/128                 scram-sha-256
 
-{% if specification.extensions.replication.enabled is defined and specification.extensions.replication.enabled %}
+{% if specification.extensions.replication.enabled | default(False) %}
 host    replication     {{ specification.extensions.replication.replication_user_name }}      0.0.0.0/0               scram-sha-256
 {% endif %}

From e01b89f09dc9629386a58908f2bdbf918302ca30 Mon Sep 17 00:00:00 2001
From: Anatoli Tsikhamirau <anatoliytihomirov@yahoo.com>
Date: Tue, 1 Jun 2021 22:40:37 +0200
Subject: [PATCH 17/28] Update
 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml

Co-authored-by: to-bar <46519524+to-bar@users.noreply.github.com>
---
 .../roles/postgresql/tasks/extensions/replication/extension.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml
index bccc8a0129..fdcf5044da 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml
@@ -21,7 +21,7 @@
       {{ repmgr.bindir[ansible_os_family] }}/repmgr standby follow
     validate: 'visudo -cf %s'
 
-- name: Extensions | Repmgr | Create replication and super users in PostgreSQL
+- name: Extensions | Repmgr | Create super user and replication user in PostgreSQL
   become_user: postgres
   vars:
     _users:

From d72a72bc81c0ca3d7b36be6dd152a01991c445de Mon Sep 17 00:00:00 2001
From: Anatoli Tsikhamirau <anatoliytihomirov@yahoo.com>
Date: Tue, 1 Jun 2021 22:56:34 +0200
Subject: [PATCH 18/28] Update
 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml

Co-authored-by: to-bar <46519524+to-bar@users.noreply.github.com>
---
 .../roles/postgresql/tasks/extensions/replication/extension.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml
index fdcf5044da..318522c4b2 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml
@@ -109,7 +109,7 @@
     pg_is_clustered: "{{ pg_cluster_status.rc in [0, 25] and pg_cluster_status.stdout_lines | length  > 1 }}"
 
 - name: Extensions | Repmgr | Configure PostgreSQL cluster
-  when: not pg_is_clustered|bool
+  when: not pg_is_clustered
   vars:
     pg_node_primary: "{{ groups.postgresql[0] }}" # the first node in the group is primary
   block:

From 66278d9d3592acddcbaccde5304f1f63bd0ff550 Mon Sep 17 00:00:00 2001
From: Anatoli Tsikhamirau <anatoliytihomirov@yahoo.com>
Date: Wed, 2 Jun 2021 00:03:26 +0200
Subject: [PATCH 19/28] Update
 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml

Co-authored-by: to-bar <46519524+to-bar@users.noreply.github.com>
---
 .../roles/postgresql/tasks/extensions/replication/extension.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml
index 318522c4b2..0abc357931 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml
@@ -173,7 +173,7 @@
         enabled: true
 
 - name: Extensions | Repmgr | Check already configured cluster
-  when: pg_is_clustered|bool
+  when: pg_is_clustered
   block:
     - name: Extensions | Repmgr | Search for a primary node
       become_user: postgres

From 808e9323f6120d299905bebd355c704a0adc926b Mon Sep 17 00:00:00 2001
From: atsikham <atsikham@users.noreply.github.com>
Date: Wed, 2 Jun 2021 00:16:09 +0200
Subject: [PATCH 20/28] Applied requested changes after review

---
 .../molecule/debian-repmgr/molecule.yml       |  2 +-
 .../molecule/debian-repmgr/verify.yml         | 53 -------------------
 .../molecule/debian-single-node/molecule.yml  |  2 +-
 .../molecule/debian-single-node/prepare.yml   |  2 +-
 .../molecule/debian-single-node/verify.yml    | 40 --------------
 .../molecule/redhat-repmgr/molecule.yml       |  2 +-
 .../molecule/redhat-repmgr/verify.yml         | 46 ----------------
 .../molecule/redhat-single-node/molecule.yml  |  2 +-
 .../molecule/redhat-single-node/prepare.yml   |  2 +-
 .../molecule/redhat-single-node/verify.yml    | 33 ------------
 .../postgresql/molecule/verify-common.yml     | 31 +++++++++++
 .../postgresql/molecule/verify-repmgr.yml     | 20 +++++++
 .../molecule/verify-single-node.yml           |  7 +++
 .../extensions/replication/extension.yml      |  2 +-
 .../roles/postgresql/templates/pg_hba.conf.j2 |  2 +-
 .../centos-7/requirements.x86_64.txt          |  2 +
 .../redhat-7/requirements.x86_64.txt          |  2 +
 .../defaults/configuration/postgresql.yml     | 11 ++++
 18 files changed, 81 insertions(+), 180 deletions(-)
 delete mode 100644 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/verify.yml
 delete mode 100644 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-single-node/verify.yml
 delete mode 100644 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-repmgr/verify.yml
 delete mode 100644 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-single-node/verify.yml
 create mode 100644 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/verify-common.yml
 create mode 100644 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/verify-repmgr.yml
 create mode 100644 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/verify-single-node.yml

diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/molecule.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/molecule.yml
index 6d1dbdbdc4..69fc7ccd31 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/molecule.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/molecule.yml
@@ -36,7 +36,7 @@ provisioner:
   playbooks:
     prepare: prepare.yml
     converge: converge.yml
-    verify: verify.yml
+    verify: ../verify-repmgr.yml
   inventory:
     group_vars:
       postgresql:
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/verify.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/verify.yml
deleted file mode 100644
index 067f00443c..0000000000
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/verify.yml
+++ /dev/null
@@ -1,53 +0,0 @@
----
-- name: Verify
-  hosts: postgresql
-  gather_facts: false
-  tasks:
-    - name: Check that DB port is open
-      block:
-        - name: Ensure that DB port is open
-          wait_for:
-            host: 0.0.0.0
-            port: 5432
-            state: started
-            delay: 0
-            timeout: 3
-          register: port_status
-
-        - name: Verify that port status is not changed
-          assert:
-            that:
-              - not port_status.changed
-
-    - name: Check that PostgreSQL services are started and enabled
-      block:
-        - name: Ensure that postgresql service is started and enabled
-          systemd:
-            name: postgresql
-            enabled: true
-          register: svc_status
-
-        - name: Ensure that postgresql@13-main service is started and enabled
-          systemd:
-            name: postgresql@13-main
-            enabled: true
-          register: svc_main_status
-
-        - name: Verify that service statuses are not changed
-          assert:
-            that:
-              - not svc_status.changed
-              - not svc_main_status.changed
-
-    - name: Check that repmgrd service is started and enabled
-      block:
-        - name: Ensure that repmgrd service is started and enabled
-          systemd:
-            name: repmgrd
-            enabled: true
-          register: svc_repmgr_status
-
-        - name: Verify that service status is not changed
-          assert:
-            that:
-              - not svc_repmgr_status.changed
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-single-node/molecule.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-single-node/molecule.yml
index 6d1dbdbdc4..ab6569cbc2 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-single-node/molecule.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-single-node/molecule.yml
@@ -36,7 +36,7 @@ provisioner:
   playbooks:
     prepare: prepare.yml
     converge: converge.yml
-    verify: verify.yml
+    verify: ../verify-single-node.yml
   inventory:
     group_vars:
       postgresql:
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-single-node/prepare.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-single-node/prepare.yml
index eb2780ae7f..06ff261f2a 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-single-node/prepare.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-single-node/prepare.yml
@@ -1,5 +1,5 @@
 ---
-- name: Converge
+- name: Prepare
   hosts: postgresql
   tasks:
     - name: Add repositories for dependencies downloading
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-single-node/verify.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-single-node/verify.yml
deleted file mode 100644
index ab7f05e55e..0000000000
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-single-node/verify.yml
+++ /dev/null
@@ -1,40 +0,0 @@
----
-- name: Verify
-  hosts: postgresql
-  gather_facts: false
-  tasks:
-    - name: Check that DB port is open
-      block:
-        - name: Ensure that DB port is open
-          wait_for:
-            host: 0.0.0.0
-            port: 5432
-            state: started
-            delay: 0
-            timeout: 3
-          register: port_status
-
-        - name: Verify that port status is not changed
-          assert:
-            that:
-              - not port_status.changed
-
-    - name: Check that PostgreSQL services are started and enabled
-      block:
-        - name: Ensure that postgresql service is started and enabled
-          systemd:
-            name: postgresql
-            enabled: true
-          register: svc_status
-
-        - name: Ensure that postgresql@13-main service is started and enabled
-          systemd:
-            name: postgresql
-            enabled: true
-          register: svc_main_status
-
-        - name: Verify that service statuses are not changed
-          assert:
-            that:
-              - not svc_status.changed
-              - not svc_main_status.changed
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-repmgr/molecule.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-repmgr/molecule.yml
index c08478a60d..439f71a3d3 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-repmgr/molecule.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-repmgr/molecule.yml
@@ -36,6 +36,6 @@ provisioner:
   playbooks:
     prepare: prepare.yml
     converge: converge.yml
-    verify: verify.yml
+    verify: ../verify-repmgr.yml
 verifier:
   name: ansible
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-repmgr/verify.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-repmgr/verify.yml
deleted file mode 100644
index 63ec39ad26..0000000000
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-repmgr/verify.yml
+++ /dev/null
@@ -1,46 +0,0 @@
----
-- name: Verify
-  hosts: postgresql
-  gather_facts: false
-  tasks:
-    - name: Check that DB port is open
-      block:
-        - name: Ensure that DB port is open
-          wait_for:
-            host: 0.0.0.0
-            port: 5432
-            state: started
-            delay: 0
-            timeout: 3
-          register: port_status
-
-        - name: Verify that port status is not changed
-          assert:
-            that:
-              - not port_status.changed
-
-    - name: Check that postgresql service is started and enabled
-      block:
-        - name: Ensure that postgresql service is started and enabled
-          systemd:
-            name: postgresql-13
-            enabled: true
-          register: svc_status
-
-        - name: Verify that service status is not changed
-          assert:
-            that:
-              - not svc_status.changed
-
-    - name: Check that repmgrd service is started and enabled
-      block:
-        - name: Ensure that repmgrd service is started and enabled
-          systemd:
-            name: repmgr13
-            enabled: true
-          register: svc_repmgr_status
-
-        - name: Verify that service status is not changed
-          assert:
-            that:
-              - not svc_repmgr_status.changed
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-single-node/molecule.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-single-node/molecule.yml
index 0aebf483b5..2cd6eee736 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-single-node/molecule.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-single-node/molecule.yml
@@ -23,6 +23,6 @@ provisioner:
   playbooks:
     prepare: prepare.yml
     converge: converge.yml
-    verify: verify.yml
+    verify: ../verify-single-node.yml
 verifier:
   name: ansible
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-single-node/prepare.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-single-node/prepare.yml
index 50bd6c1f35..5bb8babcdc 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-single-node/prepare.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-single-node/prepare.yml
@@ -1,5 +1,5 @@
 ---
-- name: Converge
+- name: Prepare
   hosts: postgresql
   tasks:
     - name: Add repositories for dependencies downloading
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-single-node/verify.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-single-node/verify.yml
deleted file mode 100644
index d54e6e6510..0000000000
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-single-node/verify.yml
+++ /dev/null
@@ -1,33 +0,0 @@
----
-- name: Verify
-  hosts: postgresql
-  gather_facts: false
-  tasks:
-    - name: Check that DB port is open
-      block:
-        - name: Ensure that DB port is open
-          wait_for:
-            host: 0.0.0.0
-            port: 5432
-            state: started
-            delay: 0
-            timeout: 3
-          register: port_status
-
-        - name: Verify that port status is not changed
-          assert:
-            that:
-              - not port_status.changed
-
-    - name: Check that postgresql service is started and enabled
-      block:
-        - name: Ensure that postgresql service is started and enabled
-          systemd:
-            name: postgresql-13
-            enabled: true
-          register: svc_status
-
-        - name: Verify that service status is not changed
-          assert:
-            that:
-              - not svc_status.changed
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/verify-common.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/verify-common.yml
new file mode 100644
index 0000000000..fda6aa2084
--- /dev/null
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/verify-common.yml
@@ -0,0 +1,31 @@
+---
+# required for netstat
+- name: Ensure net-tools package is installed
+  package:
+    name: net-tools
+    state: present
+
+- name: Gather facts on listening ports
+  listen_ports_facts:
+
+- name: Verify that address, port and user are correct
+  assert:
+    that:
+      - "{{ ansible_facts.tcp_listen
+            | selectattr('port', 'equalto', 5432)
+            | selectattr('address', 'equalto', '0.0.0.0')
+            | length == 1 }}"
+
+- name: Gather facts on listening ports
+  service_facts:
+
+# status is reported as 'unknown', so not checked
+- name: Verify that PostgreSQL service exists and running
+  vars:
+    _services:
+      Debian: postgresql@13-main.service
+      RedHat: postgresql-13.service
+  assert:
+    that:
+      - "{{ _services[ansible_os_family] in ansible_facts.services }}"
+      - "{{ ansible_facts.services[_services[ansible_os_family]].state == 'running' }}"
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/verify-repmgr.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/verify-repmgr.yml
new file mode 100644
index 0000000000..781612f547
--- /dev/null
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/verify-repmgr.yml
@@ -0,0 +1,20 @@
+---
+- name: Verify
+  hosts: postgresql
+  gather_facts: true
+  tasks:
+    - name: Include common tasks
+      include_tasks: verify-common.yml
+
+    - name: Verify that Repmgr service exists, enabled and running
+      vars:
+        _services:
+          Debian: repmgrd
+          RedHat: repmgr13
+      assert:
+        that:
+          - "{{ ansible_facts.services
+                | selectattr('name', 'equalto', _services[ansible_os_family])
+                | selectattr('state', 'equalto', 'running')
+                | selectattr('status', 'equalto', 'enabled')
+                | length== 1 }}"
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/verify-single-node.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/verify-single-node.yml
new file mode 100644
index 0000000000..0af8a10db9
--- /dev/null
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/verify-single-node.yml
@@ -0,0 +1,7 @@
+---
+- name: Verify
+  hosts: postgresql
+  gather_facts: true
+  tasks:
+    - name: Include common tasks
+      include_tasks: verify-common.yml
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml
index bccc8a0129..392dad94fe 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml
@@ -106,7 +106,7 @@
 #    sometimes 'repmgr cluster show' returns 25 code with empty stderr and no explanation
 - name: Extensions | Repmgr | Set 'pg_is_clustered' fact
   set_fact:
-    pg_is_clustered: "{{ pg_cluster_status.rc in [0, 25] and pg_cluster_status.stdout_lines | length  > 1 }}"
+    pg_is_clustered: "{{ pg_cluster_status.rc in [0, 25] and pg_cluster_status.stdout_lines | length > 1 }}"
 
 - name: Extensions | Repmgr | Configure PostgreSQL cluster
   when: not pg_is_clustered|bool
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/pg_hba.conf.j2 b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/pg_hba.conf.j2
index 51edffaf65..9cb0772589 100755
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/pg_hba.conf.j2
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/pg_hba.conf.j2
@@ -93,6 +93,6 @@ local   replication     all                                     peer
 host    replication     all             127.0.0.1/32            scram-sha-256
 host    replication     all             ::1/128                 scram-sha-256
 
-{% if specification.extensions.replication.enabled | default(False) %}
+{% if specification.extensions.replication.enabled | default(false) %}
 host    replication     {{ specification.extensions.replication.replication_user_name }}      0.0.0.0/0               scram-sha-256
 {% endif %}
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/centos-7/requirements.x86_64.txt b/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/centos-7/requirements.x86_64.txt
index 3f07b9a821..81368c54f5 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/centos-7/requirements.x86_64.txt
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/centos-7/requirements.x86_64.txt
@@ -79,6 +79,8 @@ perl-Pod-Perldoc # for vim
 perl-Pod-Simple # for vim
 perl-Pod-Usage # for vim
 pgaudit15_13
+# should be uncommented in the task #2076
+# absent in configured repository, but latest version requires python3 binary
 #pgbouncer-1.10.*
 policycoreutils-python # for container-selinux
 pyldb # for cifs-utils
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/redhat-7/requirements.x86_64.txt b/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/redhat-7/requirements.x86_64.txt
index 6cda295928..9253cf9bdc 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/redhat-7/requirements.x86_64.txt
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/repository/files/download-requirements/redhat-7/requirements.x86_64.txt
@@ -77,6 +77,8 @@ perl-Pod-Perldoc # for vim
 perl-Pod-Simple # for vim
 perl-Pod-Usage # for vim
 pgaudit15_13
+# should be uncommented in the task #2076
+# absent in configured repository, but latest version requires python3 binary
 #pgbouncer-1.10.*
 policycoreutils-python # for container-selinux
 pyldb # for cifs-utils
diff --git a/core/src/epicli/data/common/defaults/configuration/postgresql.yml b/core/src/epicli/data/common/defaults/configuration/postgresql.yml
index 7cd1dc6009..f4fe3ee4b6 100644
--- a/core/src/epicli/data/common/defaults/configuration/postgresql.yml
+++ b/core/src/epicli/data/common/defaults/configuration/postgresql.yml
@@ -40,6 +40,17 @@ specification:
               - name: wal_level
                 value: replica
                 when: replication
+          # Changes to archive_mode require a full PostgreSQL server restart,
+          # while archive_command changes can be applied via a normal configuration reload.
+          # See https://repmgr.org/docs/repmgr.html#CONFIGURATION-POSTGRESQL
+          - name: Archiving
+            parameters:
+              - name: archive_mode
+                value: 'on'
+                when: replication
+              - name: archive_command
+                value: "'/bin/true'"
+                when: replication
       - name: REPLICATION
         subgroups:
           - name: Sending Server(s)

From 1e7a1df968505f3c53932fdaa2cc848a1d6887d4 Mon Sep 17 00:00:00 2001
From: Anatoli Tsikhamirau <anatoliytihomirov@yahoo.com>
Date: Wed, 2 Jun 2021 00:32:16 +0200
Subject: [PATCH 21/28] Update
 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/main.yml

Co-authored-by: to-bar <46519524+to-bar@users.noreply.github.com>
---
 .../common/ansible/playbooks/roles/postgresql/tasks/main.yml     | 1 -
 1 file changed, 1 deletion(-)

diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/main.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/main.yml
index 2d57054131..2e6525ad60 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/main.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/main.yml
@@ -36,7 +36,6 @@
         - postgresql-common
         - postgresql-client-13
         - postgresql-13
-        - postgresql-contrib-13
         - python-psycopg2 # required for PostgreSQL ansible management
       RedHat:
         - postgresql13-server

From 7924b3f407ee0944ecfe4e6fd77d1c9ec5dc3dd6 Mon Sep 17 00:00:00 2001
From: atsikham <atsikham@users.noreply.github.com>
Date: Wed, 2 Jun 2021 00:51:54 +0200
Subject: [PATCH 22/28] Fixed repmgr check

---
 .../roles/postgresql/molecule/verify-repmgr.yml    | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/verify-repmgr.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/verify-repmgr.yml
index 781612f547..40a7be2970 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/verify-repmgr.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/verify-repmgr.yml
@@ -6,15 +6,13 @@
     - name: Include common tasks
       include_tasks: verify-common.yml
 
-    - name: Verify that Repmgr service exists, enabled and running
+    # status is reported as 'unknown', so not checked
+    - name: Verify that Repmgr service exists and running
       vars:
         _services:
-          Debian: repmgrd
-          RedHat: repmgr13
+          Debian: repmgrd.service
+          RedHat: repmgr13.service
       assert:
         that:
-          - "{{ ansible_facts.services
-                | selectattr('name', 'equalto', _services[ansible_os_family])
-                | selectattr('state', 'equalto', 'running')
-                | selectattr('status', 'equalto', 'enabled')
-                | length== 1 }}"
+          - "{{ _services[ansible_os_family] in ansible_facts.services }}"
+          - "{{ ansible_facts.services[_services[ansible_os_family]].state == 'running' }}"

From 6709b9ca8a7698b763331de9abb3d56431eedde9 Mon Sep 17 00:00:00 2001
From: to-bar <46519524+to-bar@users.noreply.github.com>
Date: Wed, 2 Jun 2021 15:54:03 +0200
Subject: [PATCH 23/28] Require 2 hosts for replication

---
 .../ansible/playbooks/roles/preflight/tasks/apply.yml     | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/preflight/tasks/apply.yml b/core/src/epicli/data/common/ansible/playbooks/roles/preflight/tasks/apply.yml
index 1fd1f5b2ac..c4f5d811fe 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/preflight/tasks/apply.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/preflight/tasks/apply.yml
@@ -64,12 +64,12 @@
         _unsupported_enabled_extensions: >-
           {{ _enabled_extensions | selectattr('name', 'in', unsupported_postgres_extensions[_pg_arch]) | list }}
 
-    - name: Check the number of PostgreSQL hosts for Repmgr
+    - name: Check the number of PostgreSQL hosts for replication
       when: postgresql.specification.extensions.replication.enabled | default(false)
       assert:
-        that: groups.postgresql | length <= 2
-        fail_msg: "Max number of PostgreSQL hosts with enabled replication is 2"
-        success_msg: "The number of PostgreSQL hosts is correct"
+        that: groups.postgresql | length == 2
+        fail_msg: The supported number of PostgreSQL hosts with enabled replication is 2  # TODO: issue 2346
+        success_msg: The number of PostgreSQL hosts is correct
   run_once: true
   delegate_to: localhost
   when:

From f1669cc0ea2cbc8c48a42531ce595810ee325d76 Mon Sep 17 00:00:00 2001
From: to-bar <46519524+to-bar@users.noreply.github.com>
Date: Wed, 2 Jun 2021 16:38:45 +0200
Subject: [PATCH 24/28] Improve molecule tests

---
 .../molecule/debian-repmgr/prepare.yml        |  2 +-
 .../molecule/debian-single-node/prepare.yml   |  2 +-
 .../molecule/redhat-repmgr/prepare.yml        |  2 +-
 .../molecule/redhat-single-node/prepare.yml   |  2 +-
 .../roles/postgresql/molecule/vars-repmgr.yml |  8 +++++
 .../postgresql/molecule/vars-single-node.yml  |  8 +++++
 .../postgresql/molecule/verify-common.yml     | 32 +++++++++----------
 .../postgresql/molecule/verify-repmgr.yml     |  2 +-
 8 files changed, 37 insertions(+), 21 deletions(-)

diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/prepare.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/prepare.yml
index 06ff261f2a..7352ac8f91 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/prepare.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-repmgr/prepare.yml
@@ -2,5 +2,5 @@
 - name: Prepare
   hosts: postgresql
   tasks:
-    - name: Add repositories for dependencies downloading
+    - name: Add repositories for downloading dependencies
       script: ../add-repos-debian.sh
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-single-node/prepare.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-single-node/prepare.yml
index 06ff261f2a..7352ac8f91 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-single-node/prepare.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/debian-single-node/prepare.yml
@@ -2,5 +2,5 @@
 - name: Prepare
   hosts: postgresql
   tasks:
-    - name: Add repositories for dependencies downloading
+    - name: Add repositories for downloading dependencies
       script: ../add-repos-debian.sh
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-repmgr/prepare.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-repmgr/prepare.yml
index 5bb8babcdc..94e9319c18 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-repmgr/prepare.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-repmgr/prepare.yml
@@ -2,5 +2,5 @@
 - name: Prepare
   hosts: postgresql
   tasks:
-    - name: Add repositories for dependencies downloading
+    - name: Add repositories for downloading dependencies
       script: ../add-repos-redhat.sh
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-single-node/prepare.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-single-node/prepare.yml
index 5bb8babcdc..94e9319c18 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-single-node/prepare.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/redhat-single-node/prepare.yml
@@ -2,5 +2,5 @@
 - name: Prepare
   hosts: postgresql
   tasks:
-    - name: Add repositories for dependencies downloading
+    - name: Add repositories for downloading dependencies
       script: ../add-repos-redhat.sh
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/vars-repmgr.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/vars-repmgr.yml
index b863648a3c..a85446a3fb 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/vars-repmgr.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/vars-repmgr.yml
@@ -40,6 +40,14 @@ specification:
               - name: wal_level
                 value: replica
                 when: replication
+          - name: Archiving
+            parameters:
+            - name: archive_mode
+              value: on
+              when: replication
+            - name: archive_command
+              value: "'/bin/true'"
+              when: replication
       - name: REPLICATION
         subgroups:
           - name: Sending Server(s)
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/vars-single-node.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/vars-single-node.yml
index dac251858b..a331ce8cfb 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/vars-single-node.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/vars-single-node.yml
@@ -40,6 +40,14 @@ specification:
               - name: wal_level
                 value: replica
                 when: replication
+          - name: Archiving
+            parameters:
+            - name: archive_mode
+              value: on
+              when: replication
+            - name: archive_command
+              value: "'/bin/true'"
+              when: replication
       - name: REPLICATION
         subgroups:
           - name: Sending Server(s)
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/verify-common.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/verify-common.yml
index fda6aa2084..85b2872f44 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/verify-common.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/verify-common.yml
@@ -1,5 +1,19 @@
 ---
-# required for netstat
+- name: Gather facts on services
+  service_facts:
+
+# status is reported as 'unknown', so not checked
+- name: Verify that PostgreSQL service exists and is running
+  vars:
+    _services:
+      Debian: postgresql@13-main.service
+      RedHat: postgresql-13.service
+  assert:
+    that:
+      - "{{ _services[ansible_os_family] in ansible_facts.services }}"
+      - "{{ ansible_facts.services[_services[ansible_os_family]].state == 'running' }}"
+
+# required for 'listen_ports_facts' module
 - name: Ensure net-tools package is installed
   package:
     name: net-tools
@@ -8,24 +22,10 @@
 - name: Gather facts on listening ports
   listen_ports_facts:
 
-- name: Verify that address, port and user are correct
+- name: Verify PostgreSQL port
   assert:
     that:
       - "{{ ansible_facts.tcp_listen
             | selectattr('port', 'equalto', 5432)
             | selectattr('address', 'equalto', '0.0.0.0')
             | length == 1 }}"
-
-- name: Gather facts on listening ports
-  service_facts:
-
-# status is reported as 'unknown', so not checked
-- name: Verify that PostgreSQL service exists and running
-  vars:
-    _services:
-      Debian: postgresql@13-main.service
-      RedHat: postgresql-13.service
-  assert:
-    that:
-      - "{{ _services[ansible_os_family] in ansible_facts.services }}"
-      - "{{ ansible_facts.services[_services[ansible_os_family]].state == 'running' }}"
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/verify-repmgr.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/verify-repmgr.yml
index 40a7be2970..66fa67b3a2 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/verify-repmgr.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/molecule/verify-repmgr.yml
@@ -7,7 +7,7 @@
       include_tasks: verify-common.yml
 
     # status is reported as 'unknown', so not checked
-    - name: Verify that Repmgr service exists and running
+    - name: Verify that Repmgr service exists and is running
       vars:
         _services:
           Debian: repmgrd.service

From 71e828244324196d68aaf1670ad52eac08579e67 Mon Sep 17 00:00:00 2001
From: to-bar <46519524+to-bar@users.noreply.github.com>
Date: Wed, 2 Jun 2021 18:37:54 +0200
Subject: [PATCH 25/28] Add {{ ansible_managed }} to templates

---
 .../ansible/playbooks/roles/postgresql/templates/pg_hba.conf.j2 | 1 +
 .../playbooks/roles/postgresql/templates/pgpass-repmgr.j2       | 2 ++
 .../ansible/playbooks/roles/postgresql/templates/repmgr.conf.j2 | 2 ++
 3 files changed, 5 insertions(+)

diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/pg_hba.conf.j2 b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/pg_hba.conf.j2
index 9cb0772589..877a04a32d 100755
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/pg_hba.conf.j2
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/pg_hba.conf.j2
@@ -1,4 +1,5 @@
 # {{ ansible_managed }}
+# ===================================================
 # PostgreSQL Client Authentication Configuration File
 # ===================================================
 #
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/pgpass-repmgr.j2 b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/pgpass-repmgr.j2
index e6009a74e6..1bd621a623 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/pgpass-repmgr.j2
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/pgpass-repmgr.j2
@@ -1,2 +1,4 @@
+# {{ ansible_managed }}
+
 *:*:*:{{ specification.extensions.replication.replication_user_name }}:{{ specification.extensions.replication.replication_user_password }}
 *:*:*:{{ specification.extensions.replication.privileged_user_name }}:{{ specification.extensions.replication.privileged_user_password }}
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/repmgr.conf.j2 b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/repmgr.conf.j2
index f940aa1468..408cc9e3f5 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/repmgr.conf.j2
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/repmgr.conf.j2
@@ -1,3 +1,5 @@
+# {{ ansible_managed }}
+
 node_id={{ node_id }}
 node_name={{ inventory_hostname }}
 conninfo='host={{ ansible_default_ipv4.address }} user={{ specification.extensions.replication.replication_user_name }} dbname={{ specification.extensions.replication.repmgr_database }} connect_timeout=2'

From 8a0aff366336c152d05dddcb8f637caa4e298176 Mon Sep 17 00:00:00 2001
From: to-bar <46519524+to-bar@users.noreply.github.com>
Date: Wed, 2 Jun 2021 18:54:13 +0200
Subject: [PATCH 26/28] Remove unused templates

---
 .../ansible/playbooks/roles/postgresql/templates/pgpass.j2     | 1 -
 .../playbooks/roles/postgresql/templates/recovery.conf.j2      | 3 ---
 2 files changed, 4 deletions(-)
 delete mode 100644 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/pgpass.j2
 delete mode 100644 core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/recovery.conf.j2

diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/pgpass.j2 b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/pgpass.j2
deleted file mode 100644
index 68136dabbf..0000000000
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/pgpass.j2
+++ /dev/null
@@ -1 +0,0 @@
-{{ hostvars[groups['postgresql'][0]]['ansible_default_ipv4']['address'] }}:5432:*:{{ specification.extensions.replication.replication_user_name }}:{{ specification.extensions.replication.replication_user_password }}
diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/recovery.conf.j2 b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/recovery.conf.j2
deleted file mode 100644
index 327c043cb3..0000000000
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/templates/recovery.conf.j2
+++ /dev/null
@@ -1,3 +0,0 @@
-standby_mode          = 'on'
-primary_conninfo      = 'host={{ hostvars[groups['postgresql'][0]]['ansible_default_ipv4']['address'] }} port=5432 user={{ specification.extensions.replication.replication_user_name }} password={{ specification.extensions.replication.replication_user_password }}'
-trigger_file = '/tmp/postgresql_trigger'

From 87d5d9c1b32203c2cec9cf5eb7bd9dfdd6c41afd Mon Sep 17 00:00:00 2001
From: to-bar <46519524+to-bar@users.noreply.github.com>
Date: Wed, 2 Jun 2021 19:19:43 +0200
Subject: [PATCH 27/28] Improve task names

---
 .../ansible/playbooks/roles/postgresql/tasks/main.yml | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/main.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/main.yml
index 2e6525ad60..2f7f135753 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/main.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/main.yml
@@ -78,21 +78,20 @@
       environment:
         PGDATA: "{{ pg.data_dir[ansible_os_family] }}"
 
-- name: Ensure that PostgreSQL service is started
+- name: Start and enable PostgreSQL service
   block:
-    - name: Ensure that PostgreSQL service is started
+    - name: Start and enable PostgreSQL service
       systemd:
         name: "{{ pg.service_name[ansible_os_family] }}"
         state: started
         enabled: true
 
-    - &check-debian-service
-      name: Debian | Check that the main service is started
+    - &ensure-debian-child-service-started
+      name: Debian | Ensure that instantiated service started
       when: ansible_os_family == 'Debian'
       systemd:
         name: "{{ pg.instantiated_service_name[ansible_os_family] }}"
         state: started
-        enabled: true
 
 # Used in postgresql-epiphany.conf.j2
 - name: Set runtime_shared_preload_libraries fact
@@ -132,7 +131,7 @@
         name: "{{ pg.service_name[ansible_os_family] }}"
         state: restarted
 
-    - *check-debian-service
+    - *ensure-debian-child-service-started
   when: (change_pg_config.results | map(attribute='changed') | list) is any
 
 - name: Configure PostgreSQL logrotate

From 57113a4962c040076e56fff38311779ac7b652f7 Mon Sep 17 00:00:00 2001
From: to-bar <46519524+to-bar@users.noreply.github.com>
Date: Wed, 2 Jun 2021 19:46:33 +0200
Subject: [PATCH 28/28] Do not hide all failures of "Get cluster status" task

---
 .../tasks/extensions/replication/extension.yml           | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml
index fe35d912e3..39b980281a 100644
--- a/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml
+++ b/core/src/epicli/data/common/ansible/playbooks/roles/postgresql/tasks/extensions/replication/extension.yml
@@ -93,13 +93,16 @@
         regexp: "^[#]?REPMGRD_ENABLED=no"
         replace: "REPMGRD_ENABLED=yes"
 
-- name: Extensions | Repmgr | Check cluster status
+- name: Extensions | Repmgr | Get cluster status
   become_user: postgres
   command: "{{ repmgr.bindir[ansible_os_family] }}/repmgr cluster show --csv"
   register: pg_cluster_status
   changed_when: false
-  failed_when: false
-  no_log: true
+  failed_when:
+    # rc = 25 means that there is an error with at least one registered node
+    - pg_cluster_status.rc not in [0, 25]
+    # do not fail when Repmgr is not initialized yet
+    - pg_cluster_status.stderr is not search("relation \"repmgr.nodes\" does not exist")
 
 # 1. There is a preflight check that no more than 2 cluster nodes are supported
 # 2. rc = 25 means that there is an error with at least one registered node