Restrict PostgreSQL listen_addresses to localhost and IOP gateway

Author: Alleny244

development/playbooks/deploy-dev/deploy-dev.yaml

@@ -45,6 +45,9 @@
     - role: pre_install
     - role: systemd_target
     - role: certificates
+    - role: iop_network
+      when:
+        - "enabled_features | has_feature('iop')"
     - role: postgresql
     - role: valkey
     - role: candlepin

development/playbooks/remote-database/remote-database.yaml

@@ -10,6 +10,9 @@
     certificates_ca_password: "CHANGEME"
     postgresql_ssl_crt: "{{ certificates_ca_directory }}/certs/{{ ansible_facts['fqdn'] }}.crt"
     postgresql_ssl_key: "{{ certificates_ca_directory }}/private/{{ ansible_facts['fqdn'] }}.key"
+    # Dedicated DB host must accept connections from the application host.
+    postgresql_publish:
+      - "5432:5432"
   vars_files:
     - "../../../src/vars/defaults.yml"
     - "../../../src/vars/flavors/{{ flavor }}.yml"

docs/iop.md

@@ -96,7 +96,8 @@ Advisor and vulnerability frontend assets are extracted from container images an
 
 ### Databases
 
-IOP creates five PostgreSQL databases, all accessible to containers via `host.containers.internal:5432`:
+IOP creates five PostgreSQL databases, all accessible to containers via the
+`postgresql` container on `iop-core-network` (`postgresql:5432`):
 
 | Database | User |
 |----------|------|

src/playbooks/deploy/deploy.yaml

@@ -26,6 +26,11 @@
         certificate_checks_certificate: "{{ server_certificate }}"
         certificate_checks_key: "{{ server_key }}"
         certificate_checks_ca: "{{ server_ca_certificate }}"
+    # IOP network must exist before Postgres joins it when IOP is enabled.
+    - role: iop_network
+      when:
+        - "enabled_features | has_feature('iop')"
+        - database_mode == 'internal'
     - role: postgresql
       when:
         - database_mode == 'internal'

src/roles/iop_advisor/defaults/main.yaml

@@ -5,5 +5,5 @@ iop_advisor_container_tag: "foreman-3.18"
 iop_advisor_database_name: advisor_db
 iop_advisor_database_user: advisor_user
 iop_advisor_database_password: "{{ undef(hint='Set a secure database password') }}"
-iop_advisor_database_host: host.containers.internal
+iop_advisor_database_host: "{{ iop_database_host | default('postgresql') }}"
 iop_advisor_database_port: 5432

src/roles/iop_inventory/defaults/main.yaml

@@ -5,5 +5,5 @@ iop_inventory_container_tag: "foreman-3.18"
 iop_inventory_database_name: inventory_db
 iop_inventory_database_user: inventory_admin
 iop_inventory_database_password: "{{ undef(hint='Set a secure database password') }}"
-iop_inventory_database_host: host.containers.internal
+iop_inventory_database_host: "{{ iop_database_host | default('postgresql') }}"
 iop_inventory_database_port: 5432

src/roles/iop_remediation/defaults/main.yaml

@@ -5,5 +5,5 @@ iop_remediation_container_tag: "foreman-3.18"
 iop_remediation_database_name: remediations_db
 iop_remediation_database_user: remediations_user
 iop_remediation_database_password: "{{ undef(hint='Set a secure database password') }}"
-iop_remediation_database_host: "host.containers.internal"
+iop_remediation_database_host: "{{ iop_database_host | default('postgresql') }}"
 iop_remediation_database_port: "5432"

src/roles/iop_vmaas/defaults/main.yaml

@@ -5,7 +5,7 @@ iop_vmaas_container_tag: "foreman-3.18"
 iop_vmaas_database_name: vmaas_db
 iop_vmaas_database_user: vmaas_admin
 iop_vmaas_database_password: "{{ undef(hint='Set a secure database password') }}"
-iop_vmaas_database_host: "host.containers.internal"
+iop_vmaas_database_host: "{{ iop_database_host | default('postgresql') }}"
 iop_vmaas_database_port: "5432"
 
 iop_vmaas_client_ca_certificate: "/var/lib/foremanctl/certs/certs/ca.crt"

src/roles/iop_vulnerability/defaults/main.yaml

@@ -5,7 +5,7 @@ iop_vulnerability_container_tag: "foreman-3.18"
 iop_vulnerability_database_name: vulnerability_db
 iop_vulnerability_database_user: vulnerability_admin
 iop_vulnerability_database_password: "{{ undef(hint='Set a secure database password') }}"
-iop_vulnerability_database_host: "host.containers.internal"
+iop_vulnerability_database_host: "{{ iop_database_host | default('postgresql') }}"
 iop_vulnerability_database_port: "5432"
 
 # Taskomatic configuration

src/roles/postgresql/defaults/main.yml

@@ -2,7 +2,6 @@
 postgresql_container_image: quay.io/sclorg/postgresql-16-c10s
 postgresql_container_tag: "latest"
 postgresql_container_name: postgresql
-postgresql_network: host
 postgresql_restart_policy: always
 
 postgresql_data_dir: /var/lib/pgsql/data
@@ -13,4 +12,11 @@ postgresql_max_connections: 500
 postgresql_shared_buffers: 512MB
 postgresql_effective_cache_size: 1GB
 
+# Bridge networking + localhost publish keeps 5432 off the LAN. When IOP is
+# enabled, also join iop-core-network so IOP containers can reach this
+# container by name instead of host.containers.internal.
+postgresql_networks: "{{ [iop_network_name | default('iop-core-network')] if (enabled_features | default([]) | has_feature('iop')) else [] }}"
+postgresql_publish:
+  - "127.0.0.1:5432:5432"
+
 postgresql_upgrade: "hardlink"