Skip to content

feat: new variable postgresql_secure_logging defaulting to true #184

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
richm merged 1 commit into from
May 7, 2026
Merged

feat: new variable postgresql_secure_logging defaulting to true #184

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -150,6 +150,20 @@ container build is independent of the actual deployment.

See the [`examples/`](examples) for details.

### postgresql_secure_logging

If `true`, suppress potentially sensitive output from tasks that handle
credentials, secrets, and other sensitive data by setting `no_log: true` on
those tasks. This prevents passwords, API tokens, private keys, and similar
sensitive information from appearing in Ansible logs and console output.

If you need to debug issues with credential handling or secret management, you
can temporarily set `postgresql_secure_logging: false` to see the full output from
these tasks. However, be aware that this may expose sensitive information in
logs, so it should only be used in development or troubleshooting scenarios.

Default: `true`

## Idempotence

This section should cover role behavior for repeated runs.
Expand Down
1 change: 1 addition & 0 deletions defaults/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,3 +23,4 @@ postgresql_ssl_enable: false
# dns: ['localhost', 'www.example.com']
# ca: self-sign
postgresql_certificates: []
postgresql_secure_logging: true
3 changes: 2 additions & 1 deletion tasks/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@

- name: Gather the package facts
package_facts:
no_log: "{{ ansible_verbosity < 2 }}"

- name: Check if requested version is supported in the system (RHEL8)
fail:
Expand Down Expand Up @@ -133,7 +134,7 @@
cmd: >
psql -c "ALTER USER postgres WITH ENCRYPTED PASSWORD
'{{ postgresql_password }}';"
no_log: true
no_log: "{{ postgresql_secure_logging }}"

@sourcery-ai sourcery-ai Bot May 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nitpick: Avoid quoting the Jinja expression so no_log is treated as a native boolean.

Quoting here makes no_log a string ("True"/"False"), which Ansible will usually coerce, but it’s clearer and safer to keep it as a native boolean. Drop the quotes and rely on the template to yield a boolean:

no_log: {{ postgresql_secure_logging }}

Please apply the same change to the earlier no_log that depends on ansible_verbosity.

changed_when: false

- name: Enable logging in by password
Expand Down
Loading