Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

we have to use rich rules in firewalld to restict a specific port to a list of
specific ip addresses. when using rich rules, you have to specify the address
family (ipv4 or ipv6) which we can't do in an automated fashion with the ipv4
and ipv6 addresses of the clients dynamically generated into a single variable.
so this commit creates 2 variables; one for ipv4 clients and one for ipv6
clients which can be referred to as required when creating the rich rules.

we have to use rich rules in firewalld to restict a specific port to a list of
specific ip addresses. when using rich rules, you have to specify the address
family (ipv4 or ipv6) which we can't do in an automated fashion with the ipv4
and ipv6 addresses of the clients dynamically generated into a single variable.
so this commit creates 2 variables; one for ipv4 clients and one for ipv6
clients which can be referred to as required when creating the rich rules.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

roles/postgres: Create a new postgres_ssl_hosts variable that will be used to determine which hosts can login using ssl

roles/archweb: Memcached service.
roles/postgresql: Initial work on SSL support.

roles/postgres: Added default values to the max_connections and shared_buffers variables.

playbooks/apollo: Added the sudo role and the security_tracker role. Also changes the posgres to include the new variables.
roles/postgres: Merged the new configuration (from 9.6) and added two new variables for making it easier to test the role on a vm/container.

postgres must be able to connect to all databases,
else the postgres_db ansible module is broken.

Signed-off-by: Sven-Hendrik Haase <svenstaro@gmail.com>