Switching over to using unix sockets for ICP

roles/postgresql/defaults/main.yml

@@ -13,10 +13,14 @@
 postgresql_service_enabled: true
 postgresql_service_state: "started"
 
-# Network Security (localhost only)
-postgresql_listen_addresses: "localhost"
+# Network Security (Unix socket only - no network listening)
+postgresql_listen_addresses: ""  # Empty string = no TCP/IP connections
 postgresql_port: 5432
 
+# Unix socket configuration
+postgresql_unix_socket_directories: "/run/postgresql"
+postgresql_unix_socket_permissions: 0777  # Allows container access
+
 # Authentication
 postgresql_auth_method: "scram-sha-256"
 

roles/postgresql/tasks/main.yml

@@ -25,7 +25,7 @@
     --auth-local=peer
     --auth-host={{ postgresql_auth_method }}
     {{ '--data-checksums' if postgresql_data_checksums else '' }}
-  become: yes
+  become: true
   become_user: postgres
   when: not postgresql_initialized.stat.exists
   notify: restart postgresql
@@ -74,19 +74,29 @@
     state: "{{ postgresql_service_state }}"
     daemon_reload: yes
 
-- name: Wait for PostgreSQL to be ready
+- name: Wait for PostgreSQL Unix socket to be ready
+  wait_for:
+    path: "{{ postgresql_unix_socket_directories }}/.s.PGSQL.{{ postgresql_port }}"
+    timeout: 30
+  when: 
+    - postgresql_service_state == "started"
+    - postgresql_listen_addresses == ""  # Socket-only mode
+
+- name: Wait for PostgreSQL TCP to be ready
   wait_for:
     port: "{{ postgresql_port }}"
     host: "{{ postgresql_listen_addresses }}"
     timeout: 30
-  when: postgresql_service_state == "started"
+  when: 
+    - postgresql_service_state == "started"
+    - postgresql_listen_addresses != ""  # TCP mode
 
 - name: Display PostgreSQL infrastructure status
   debug:
     msg: |
       ✅ PostgreSQL infrastructure ready!
       
-      📡 Service: {{ postgresql_listen_addresses }}:{{ postgresql_port }}
+      📡 Service: {% if postgresql_listen_addresses == "" %}Unix socket only at {{ postgresql_unix_socket_directories }}{% else %}{{ postgresql_listen_addresses }}:{{ postgresql_port }}{% endif %}
       🔒 Auth: {{ postgresql_auth_method }}
       📊 Checksums: {{ 'Enabled' if postgresql_data_checksums else 'Disabled' }}
       

roles/postgresql/templates/postgresql.conf.j2

@@ -6,6 +6,10 @@
 listen_addresses = '{{ postgresql_listen_addresses }}'
 port = {{ postgresql_port }}
 
+# Unix socket configuration
+unix_socket_directories = '{{ postgresql_unix_socket_directories | default("/run/postgresql") }}'
+unix_socket_permissions = {{ postgresql_unix_socket_permissions | default("0777") }}
+
 # Basic Performance (only override if needed)
 max_connections = {{ postgresql_max_connections }}
 shared_buffers = {{ postgresql_shared_buffers }}