client-authentication

#!/usr/bin/env ansible-playbook
# (c) 2016 DataNexus Inc.  All Rights Reserved.
#
# allow hosts on the same subnet
---     
- name: discovering all {{ application }} nodes
  vars_files:
    - "{{ configuration }}"
    - vars/postgresql.yml
  hosts: localhost
  tasks:
    - ec2_instance_facts:
        region: "{{ region }}"
        filters:
          instance-state-name: running
          "tag:Application": "{{ application }}"
          "tag:Domain": "{{ domain }}"
          "tag:Project": "{{ project }}"
          "tag:Tenant": "{{ tenant }}"
          "tag:Cluster": "{{ cluster | default ('a') }}"
          "tag:Role": "{{ role | default ('none') }}"
      register: postgresql_instances
      when:
        - cloud == 'aws'

    - name: building postgresql host group
      add_host: hostname="{{ item }}" groupname=postgresql ansible_user="{{ user }}" ansible_ssh_private_key_file="./{{cloud }}-{{ region }}-{{ project }}-{{ application }}-private-key.pem"
      with_items: "{{ postgresql_instances.instances | map (attribute='private_ip_address') | list }}"
      when:
        - cloud == 'aws'
        - postgresql_instances is defined
        - postgresql_instances.instances|length > 0

- name: updating {{ application }} connetion rules
  hosts: "{{ application }}"
  vars_files:
    - "{{ configuration }}"
    - vars/postgresql.yml
  gather_facts: no
  roles:
     - { role: allow-private-external }