ansible-taler-exchange

commit 0dedd91f6c4c3ff1e862c762c11f180497396355
parent b36fe93ed7a6cd274d5303314009b612e2986152
Author: Florian Dold <dold@taler.net>
Date:   Fri,  4 Sep 2026 18:07:22 +0200

monitoring: revoke legacy access from all databases

Diffstat:
M
roles/monitoring/tasks/remove.yml
 | 
26
+++++++++-----------------

1 file changed, 9 insertions(+), 17 deletions(-)
diff --git a/roles/monitoring/tasks/remove.yml b/roles/monitoring/tasks/remove.yml
@@ -104,35 +104,27 @@
   register: monitoring_prometheus_role
   changed_when: false
 
-- name: Find databases that received legacy monitoring access
+- name: Find all databases in the PostgreSQL cluster
   become: true
   become_user: postgres
   community.postgresql.postgresql_query:
     login_user: postgres
     login_db: postgres
-    query: >-
-      SELECT datname
-      FROM pg_database
-      WHERE datname IN (
-        'libeufin',
-        'postgres',
-        'taler-auditor',
-        'taler-exchange',
-        'challenger-email',
-        'challenger-postal',
-        'challenger-sms'
-      )
+    query: SELECT datname FROM pg_database
   register: monitoring_databases
   changed_when: false
 
-- name: Revoke database access granted to the Prometheus user
+- name: Revoke all database privileges granted to the Prometheus user
   become: true
   become_user: postgres
-  community.postgresql.postgresql_query:
+  community.postgresql.postgresql_privs:
     login_user: postgres
     login_db: postgres
-    query: >-
-      REVOKE CONNECT ON DATABASE "{{ item }}" FROM prometheus
+    type: database
+    objs: "{{ item }}"
+    roles: prometheus
+    privs: ALL
+    state: absent
   loop: >-
     {{ monitoring_databases.query_result | map(attribute='datname') | list }}
   when: monitoring_prometheus_role.rowcount > 0