Change database to PostgreSQL

Remove all configuration for MySQL and configure PostgreSQL as the main
database.

All *_mysql_* options have been changed to *_db_* options.

Postgres requires the database user to have a password in order to
connect via localhost. The db_admin_password option is used to set the
password of the admin user (usually postgres).

roles/mailserver/handlers/main.yml

@@ -10,7 +10,7 @@
 - name: restart solr
   service: name=tomcat6 state=restarted
 
-- name: import mysql postfix
-  mysql_db: name={{ mail_mysql_database }} state=import target=/etc/postfix/import.sql
+- name: import sql postfix
+  action: shell PGPASSWORD={{ mail_db_password }} psql -h localhost -d {{ mail_db_database }} -U {{ mail_db_username }} -f /etc/postfix/import.sql --set ON_ERROR_STOP=1
   notify: restart postfix
 

roles/mailserver/tasks/dovecot.yml

@@ -3,10 +3,10 @@
   with_items:
     - dovecot-core
     - dovecot-imapd
-    - mysql-server
-    - dovecot-mysql
     - dovecot-lmtpd
     - dovecot-managesieved
+    - postgresql-9.1
+    - dovecot-pgsql
 
 - name: Create vmail group
   group: name=vmail state=present gid=5000

roles/mailserver/tasks/postfix.yml

@@ -2,24 +2,28 @@
   apt: pkg={{ item }} state=installed
   with_items:
     - postfix
-    - mysql-server
-    - postfix-mysql
-    - python-mysqldb
     - libsasl2-modules
     - sasl2-bin
     - postgrey
+    - postgresql-9.1
+    - postfix-pgsql
+    - python-psycopg2
+
+- name: Set postgres password
+  command: sudo -u {{ db_admin_username }} psql -d {{ db_admin_username }} -c "ALTER USER postgres with  password '{{ db_admin_password }}';"
+  notify: import sql postfix
 
 - name: Create database user for mail server
-  mysql_user: user={{ mail_mysql_username }} password={{ mail_mysql_password }} state=present priv="mailserver.*:ALL"
-  notify: import mysql postfix
+  postgresql_user: login_host=localhost login_user={{ db_admin_username }} login_password={{ db_admin_password }} name={{ mail_db_username }} password={{ mail_db_password }} state=present
+  notify: import sql postfix
 
 - name: Create database for mail server
-  mysql_db: name={{ mail_mysql_database }} state=present
-  notify: import mysql postfix
+  postgresql_db: login_host=localhost login_user={{ db_admin_username }} login_password={{ db_admin_password }} name={{ mail_db_database }} state=present owner={{ mail_db_username }}
+  notify: import sql postfix
 
 - name: Copy import.sql
   template: src=mailserver.sql.j2 dest=/etc/postfix/import.sql owner=root group=root mode=0600
-  notify: import mysql postfix
+  notify: import sql postfix
 
 - name: Copy main.cf
   template: src=etc_postfix_main.cf.j2 dest=/etc/postfix/main.cf owner=root group=root
@@ -32,7 +36,7 @@
 - name: Copy additional postfix configuration files
   template: src=etc_postfix_{{ item }}.j2 dest=/etc/postfix/{{ item }} owner=root group=root
   with_items:
-    - mysql-virtual-mailbox-domains.cf
-    - mysql-virtual-mailbox-maps.cf
-    - mysql-virtual-alias-maps.cf
+    - pgsql-virtual-mailbox-domains.cf
+    - pgsql-virtual-mailbox-maps.cf
+    - pgsql-virtual-alias-maps.cf
   notify: restart postfix

roles/mailserver/templates/etc_dovecot_dovecot-sql.conf.ext.j2

@@ -26,7 +26,7 @@
 # );
 
 # Database driver: mysql, pgsql, sqlite
-driver = mysql
+driver = pgsql
 
 # Database connection string. This is driver-specific setting.
 #
@@ -63,7 +63,7 @@ driver = mysql
 #   connect = host=sql.example.com dbname=virtual user=virtual password=blarg
 #   connect = /etc/dovecot/authdb.sqlite
 #
-connect = host=127.0.0.1 dbname={{ mail_mysql_database }} user={{ mail_mysql_username }} password={{ mail_mysql_password }}
+connect = host=127.0.0.1 dbname={{ mail_db_database }} user={{ mail_db_username }} password={{ mail_db_password }}
 
 # Default password scheme.
 #

roles/mailserver/templates/etc_postfix_main.cf.j2

@@ -79,12 +79,12 @@ mailbox_size_limit = 0
 recipient_delimiter = +
 inet_interfaces = all
 
-# dovecot mysql
+# dovecot db
 virtual_transport = dovecot
 dovecot_destination_recipient_limit = 1
-virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf
-virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf
-virtual_alias_maps = mysql:/etc/postfix/mysql-virtual-alias-maps.cf
+virtual_mailbox_domains = pgsql:/etc/postfix/pgsql-virtual-mailbox-domains.cf
+virtual_mailbox_maps = pgsql:/etc/postfix/pgsql-virtual-mailbox-maps.cf
+virtual_alias_maps = pgsql:/etc/postfix/pgsql-virtual-alias-maps.cf
 local_recipient_maps = $virtual_mailbox_maps
 
 # OpenDKIM

roles/mailserver/templates/etc_postfix_mysql-virtual-alias-maps.cf.j2

@@ -1,5 +1,5 @@
-user = {{ mail_mysql_username }}
-password = {{ mail_mysql_password }}
+user = {{ mail_db_username }}
+password = {{ mail_db_password }}
 hosts = 127.0.0.1
-dbname = {{ mail_mysql_database }}
-query = SELECT destination FROM virtual_aliases WHERE source='%s'
+dbname = {{ mail_db_database }}
+query = SELECT destination FROM virtual_aliases WHERE source='%s'

roles/mailserver/templates/etc_postfix_mysql-virtual-mailbox-domains.cf.j2

@@ -1,5 +1,5 @@
-user = {{ mail_mysql_username }}
-password = {{ mail_mysql_password }}
+user = {{ mail_db_username }}
+password = {{ mail_db_password }}
 hosts = 127.0.0.1
-dbname = {{ mail_mysql_database }}
+dbname = {{ mail_db_database }}
 query = SELECT 1 FROM virtual_domains WHERE name='%s'

roles/mailserver/templates/etc_postfix_mysql-virtual-mailbox-maps.cf.j2

@@ -1,5 +1,5 @@
-user = {{ mail_mysql_username }}
-password = {{ mail_mysql_password }}
+user = {{ mail_db_username }}
+password = {{ mail_db_password }}
 hosts = 127.0.0.1
-dbname = {{ mail_mysql_database }}
+dbname = {{ mail_db_database }}
 query = SELECT 1 FROM virtual_users WHERE email='%s'

roles/mailserver/templates/etc_postfix_pgsql-virtual-alias-maps.cf.j2

@@ -0,0 +1,5 @@
+user = {{ mail_db_username }}
+password = {{ mail_db_password }}
+hosts = 127.0.0.1
+dbname = {{ mail_db_database }}
+query = SELECT destination FROM virtual_aliases WHERE source='%s'

roles/mailserver/templates/etc_postfix_pgsql-virtual-mailbox-domains.cf.j2

@@ -0,0 +1,5 @@
+user = {{ mail_db_username }}
+password = {{ mail_db_password }}
+hosts = 127.0.0.1
+dbname = {{ mail_db_database }}
+query = SELECT 1 FROM virtual_domains WHERE name='%s'

roles/mailserver/templates/etc_postfix_pgsql-virtual-mailbox-maps.cf.j2

@@ -0,0 +1,5 @@
+user = {{ mail_db_username }}
+password = {{ mail_db_password }}
+hosts = 127.0.0.1
+dbname = {{ mail_db_database }}
+query = SELECT 1 FROM virtual_users WHERE email='%s'

roles/mailserver/templates/mailserver.sql.j2

@@ -1,47 +1,47 @@
 -- If tables are not dropped, have to truncate before insert or use "insert or replace" (not postgres compatible)
 
-DROP TABLE IF EXISTS `virtual_users`;
-DROP TABLE IF EXISTS `virtual_aliases`;
-DROP TABLE IF EXISTS `virtual_domains`;
+DROP TABLE IF EXISTS "virtual_users";
+DROP TABLE IF EXISTS "virtual_aliases";
+DROP TABLE IF EXISTS "virtual_domains";
 
-CREATE TABLE IF NOT EXISTS `virtual_domains` (
-	`id` int(11) NOT NULL auto_increment,
-	`name` varchar(50) NOT NULL,
-	PRIMARY KEY (`id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+CREATE TABLE IF NOT EXISTS "virtual_domains" (
+        "id" SERIAL,
+        "name" varchar(50) NOT NULL,
+        PRIMARY KEY ("id")
+);
 
 CREATE UNIQUE INDEX name_idx ON virtual_domains (name);
 
-CREATE TABLE IF NOT EXISTS `virtual_users` (
-	`id` int(11) NOT NULL auto_increment,
-	`domain_id` int(11) NOT NULL,
-	`password` varchar(106) NOT NULL,
-	`email` varchar(100) NOT NULL,
-	PRIMARY KEY (`id`),
-	UNIQUE KEY `email` (`email`),
-	FOREIGN KEY (domain_id) REFERENCES virtual_domains(id) ON DELETE CASCADE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+CREATE TABLE IF NOT EXISTS "virtual_users" (
+        "id" SERIAL,
+        "domain_id" int NOT NULL,
+        "password" varchar(106) NOT NULL,
+        "email" varchar(100) NOT NULL UNIQUE,
+        PRIMARY KEY ("id"),
+        FOREIGN KEY (domain_id) REFERENCES virtual_domains(id) ON DELETE CASCADE
+);
+
 
 CREATE UNIQUE INDEX email_idx ON virtual_users (email);
 
-CREATE TABLE IF NOT EXISTS `virtual_aliases` (
-	`id` int(11) NOT NULL auto_increment,
-	`domain_id` int(11) NOT NULL,
-	`source` varchar(100) NOT NULL,
-	`destination` varchar(100) NOT NULL,
-	PRIMARY KEY (`id`),
-	FOREIGN KEY (domain_id) REFERENCES virtual_domains(id) ON DELETE CASCADE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+CREATE TABLE IF NOT EXISTS "virtual_aliases" (
+        "id" SERIAL,
+        "domain_id" int NOT NULL,
+        "source" varchar(100) NOT NULL,
+        "destination" varchar(100) NOT NULL,
+        PRIMARY KEY ("id"),
+        FOREIGN KEY (domain_id) REFERENCES virtual_domains(id) ON DELETE CASCADE
+);
 
 CREATE INDEX source_idx ON virtual_aliases (source);
 
 {% for virtual_domain in mail_virtual_domains %}
-INSERT INTO {{ mail_mysql_database }}.`virtual_domains` (`id`, `name`)
+INSERT INTO "virtual_domains" ("id", "name")
         VALUES ('{{ virtual_domain.pk_id }}', '{{ virtual_domain.name }}');
 {% endfor %}
 
 {% for virtual_user in mail_virtual_users %}
-INSERT INTO {{ mail_mysql_database }}.`virtual_users`  (`domain_id`, `password` , `email`)
+INSERT INTO "virtual_users"  ("domain_id", "password" , "email")
 	VALUES (
 		'{{ virtual_user.domain_pk_id }}',
 		'{{ virtual_user.password_hash }}',
@@ -51,7 +51,7 @@ INSERT INTO {{ mail_mysql_database }}.`virtual_users`  (`domain_id`, `password`
 
 {% if mail_virtual_aliases is defined %}
 {% for virtual_alias in mail_virtual_aliases %}
-INSERT INTO {{ mail_mysql_database }}.`virtual_aliases` (`domain_id`, `source`, `destination`)
+INSERT INTO "virtual_aliases" ("domain_id", "source", "destination")
     VALUES ('{{ virtual_alias.domain_pk_id }}', '{{ virtual_alias.source }}', '{{virtual_alias.destination }}');
 {% endfor %}
 {% endif %}

roles/monitoring/files/etc_monit_conf.d_mysql

@@ -1,6 +0,0 @@
-check process mysqld with pidfile /var/run/mysqld/mysqld.pid
-  group database
-  start program = "/etc/init.d/mysql start"
-  stop program = "/etc/init.d/mysql stop"
-  if failed host localhost port 3306 protocol mysql then restart
-  if 5 restarts within 5 cycles then timeout

roles/monitoring/files/etc_monit_conf.d_pgsql

@@ -0,0 +1,6 @@
+check process postgres with pidfile /opt/postgresql/9.2/main/postmaster.pid
+  group database
+  start program = "/etc/init.d/postgresql start"
+  stop program = "/etc/init.d/postgresql stop"
+  if failed host localhost port 5432 protocol pgsql then restart
+  if 5 restarts within 5 cycles then timeout

roles/monitoring/tasks/monit.yml

@@ -8,8 +8,8 @@
   copy: src=etc_monit_conf.d_{{ item }} dest=/etc/monit/conf.d/{{ item }}
   with_items:
     - apache2
+    - pgsql
     - dovecot
-    - mysql
     - postfix
     - sshd
     - tomcat

roles/news/tasks/selfoss.yml

@@ -6,10 +6,10 @@
   action: file owner=www-data group=www-data path=/var/www/selfoss recurse=yes state=directory
 
 - name: Create database user for selfoss
-  mysql_user: user={{ selfoss_mysql_username }} password={{ selfoss_mysql_password }} state=present priv="selfoss.*:ALL"
+  postgresql_user: login_host=localhost login_user={{ db_admin_username }} login_password={{ db_admin_password }} name={{ selfoss_db_username }} password={{ selfoss_db_password }} state=present
 
 - name: Create database for selfoss
-  mysql_db: name={{ selfoss_mysql_database }} state=present
+  postgresql_db: login_host=localhost login_user={{ db_admin_username }} login_password={{ db_admin_password }} name={{ selfoss_db_database }} state=present owner={{ selfoss_db_username }}
 
 - name: Install selfoss config.ini
   template: src=var_www_selfoss_config.ini.j2 dest=/var/www/selfoss/config.ini group=www-data owner=www-data

roles/news/templates/var_www_selfoss_config.ini.j2

@@ -1,9 +1,9 @@
 ; see https://github.com/SSilence/selfoss/wiki/Configuration for more information about the configuration parameters
 [globals]
-db_type=mysql
-db_database={{selfoss_mysql_database}}
-db_username={{selfoss_mysql_username}}
-db_password={{selfoss_mysql_password}}
+db_type=pgsql
+db_database={{selfoss_db_database}}
+db_username={{selfoss_db_username}}
+db_password={{selfoss_db_password}}
 db_port=3306
 db_prefix=
 logger_level=DEBUG
@@ -25,4 +25,4 @@ use_system_font=1
 readability=
 share=gtfprde
 allow_public_update_access=0
-unread_order=
+unread_order=

roles/owncloud/tasks/owncloud.yml

@@ -3,10 +3,10 @@
 # as per http://www.debiantutorials.com/how-to-install-owncloud-on-wheezy/
 
 - name: Create database user for ownCloud
-  mysql_user: user={{ owncloud_mysql_username }} password={{ owncloud_mysql_password }} state=present priv="owncloud.*:ALL"
+  postgresql_user: login_host=localhost login_user={{ db_admin_username }} login_password={{ db_admin_password }} name={{ owncloud_db_username }} password={{ owncloud_db_password }} state=present
 
 - name: Create database for ownCloud
-  mysql_db: name={{ owncloud_mysql_database }} state=present
+  postgresql_db: login_host=localhost login_user={{ db_admin_username }} login_password={{ db_admin_password }} name={{ owncloud_db_database }} state=present owner={{ owncloud_db_username }}
 
 - name: Ensure repository key for ownCloud is in place
   apt_key: url=http://download.opensuse.org/repositories/isv:ownCloud:community/Debian_7.0/Release.key state=present

roles/tarsnap/files/tarsnap.sh

@@ -4,7 +4,7 @@
 # Written by Tim Bishop, 2009.
 
 # Directories to backup (relative to /)
-DIRS="home root decrypted var/www var/lib/mysql"
+DIRS="home root decrypted var/www opt/postgresql/9.1/main"
 
 # Number of daily backups to keep
 DAILY=7

roles/webmail/tasks/roundcube.yml

@@ -3,6 +3,10 @@
   with_items:
     - roundcube
     - roundcube-plugins
+    - roundcube-pgsql
+
+- name: Configure Roundcube database
+  template: src=etc_dbconfig-common_roundcube.conf.j2 dest=/etc/dbconfig-common/roundcube.conf group=root owner=root force=yes
 
 - name: Configure the Apache HTTP server for roundcube
   template: src=etc_apache2_sites-available_roundcube.j2 dest=/etc/apache2/sites-available/roundcube group=www-data owner=www-data force=yes

roles/webmail/templates/etc_dbconfig-common_roundcube.conf.j2

@@ -0,0 +1,76 @@
+# automatically generated by the maintainer scripts of roundcube
+# any changes you make will be preserved, though your comments
+# will be lost!  to change your settings you should edit this
+# file and then run "dpkg-reconfigure roundcube"
+
+# dbc_install: configure database with dbconfig-common?
+#              set to anything but "true" to opt out of assistance
+dbc_install='true'
+
+# dbc_upgrade: upgrade database with dbconfig-common?
+#              set to anything but "true" to opt out of assistance
+dbc_upgrade='true'
+
+# dbc_remove: deconfigure database with dbconfig-common?
+#             set to anything but "true" to opt out of assistance
+dbc_remove=''
+
+# dbc_dbtype: type of underlying database to use
+#	this exists primarily to let dbconfig-common know what database
+#	type to use when a package supports multiple database types.
+#	don't change this value unless you know for certain that this
+#	package supports multiple database types
+dbc_dbtype='pgsql'
+
+# dbc_dbuser: database user
+#	the name of the user who we will use to connect to the database.
+dbc_dbuser='{{ webmail_db_username }}'
+
+# dbc_dbpass: database user password
+#	the password to use with the above username when connecting
+#	to a database, if one is required
+dbc_dbpass='{{ webmail_db_password }}'
+
+# dbc_dbserver: database host.
+#	leave unset to use localhost (or a more efficient local method
+#	if it exists).
+dbc_dbserver=''
+
+# dbc_dbport: remote database port
+#	leave unset to use the default.  only applicable if you are
+#	using a remote database.
+dbc_dbport=''
+
+# dbc_dbname: name of database
+#	this is the name of your application's database.
+dbc_dbname='{{ webmail_db_database }}'
+
+# dbc_dbadmin: name of the administrative user
+#	this is the administrative user that is used to create all of the above
+dbc_dbadmin='{{ db_admin_username }}'
+
+# dbc_basepath: base directory to hold database files
+#	leave unset to use the default.  only applicable if you are
+#	using a local (filesystem based) database.
+dbc_basepath=''
+
+##
+## postgresql specific settings.  if you don't use postgresql,
+## you can safely ignore all of these
+##
+
+# dbc_ssl: should we require ssl?
+#	set to "true" to require that connections use ssl
+dbc_ssl=''
+
+# dbc_authmethod_admin: authentication method for admin
+# dbc_authmethod_user: authentication method for dbuser
+#	see the section titled "AUTHENTICATION METHODS" in
+#	/usr/share/doc/dbconfig-common/README.pgsql for more info
+dbc_authmethod_admin=''
+dbc_authmethod_user=''
+
+##
+## end postgresql specific settings
+##
+

vars/defaults.yml

@@ -12,6 +12,10 @@ admin_email: "{{ main_user_name }}@{{ domain }}"
 friendly_networks:
   - ""
 
+# database
+db_admin_username: 'postgres'
+# db_admin_password: (required)
+
 # ircbouncer
 znc_version: 1.0
 # irc_nick: (required)
@@ -22,9 +26,9 @@ znc_version: 1.0
 
 # mailserver
 mail_server_hostname: "mail.{{ domain }}"
-mail_mysql_username: mailuser
-# mail_mysql_password: (required)
-mail_mysql_database: mailserver
+mail_db_username: mailuser
+# mail_db_password: (required)
+mail_db_database: mailserver
 # mail_virtual_domains: (required)
 # mail_virtual_users: (required)
 # mail_virtual_aliases: (required)
@@ -34,9 +38,9 @@ zpush_version: 2.1.1-1788
 
 # owncloud
 owncloud_domain: "cloud.{{ domain }}"
-owncloud_mysql_username: owncloud
-# owncloud_mysql_password: (required)
-owncloud_mysql_database: owncloud
+owncloud_db_username: owncloud
+# owncloud_db_password: (required)
+owncloud_db_database: owncloud
 
 # tarsnap
 tarsnap_version: 1.0.35
@@ -61,6 +65,9 @@ openvpn_server: "{{ domain }}"
 
 # webmail
 webmail_domain: "mail.{{ domain }}"
+webmail_db_username: "roundcube"
+# webmail_db_password: (required)
+webmail_db_database: "roundcube"
 
 # xmpp
 prosody_admin: "{{ admin_email }}"
@@ -69,6 +76,6 @@ prosody_virtual_domain: "{{ domain }}"
 
 # news
 selfoss_domain: "news.{{ domain }}"
-selfoss_mysql_username: selfoss
-# selfoss_mysql_password: (required)
-selfoss_mysql_database: selfoss
+selfoss_db_username: selfoss
+# selfoss_db_password: (required)
+selfoss_db_database: selfoss

vars/testing.yml

@@ -11,6 +11,9 @@ encfs_password: testPassword
 friendly_networks:
   - "172.16.100.0/24"
 
+db_admin_username: postgres
+db_admin_password: postgres
+
 # ircbouncer
 irc_nick: sovereign
 irc_ident: sovereign
@@ -19,7 +22,7 @@ irc_quitmsg: Bye
 irc_password_hash: "sha256#4bfc209c5e19874337fd89c80675ad194836efea5efd4189b7f73cd9e0a6094f#,i*Msa0B;w9yR23nm1ZB#" #foo
 
 # mailserver
-mail_mysql_password: testPassword
+mail_db_password: testPassword
 mail_virtual_domains:
   - name: "{{ domain }}"
     pk_id: 1
@@ -43,7 +46,7 @@ mail_virtual_aliases:
 zpush_timezone: "America/New_York"  #Example: "America/New_York"
 
 # owncloud
-owncloud_mysql_password: testPassword
+owncloud_db_password: testPassword
 
 # vpn
 openvpn_key_country:  "US"
@@ -56,14 +59,17 @@ openvpn_clients:
   - phone
   - tablet
 
+# webmail
+webmail_db_password: testPassword
+
 # xmpp
 prosody_accounts:
   - name: "{{ main_user_name }}"
     password: foo
 
 # selfoss
-selfoss_mysql_password: testPassword
+selfoss_db_password: testPassword
 selfoss_username: "{{ main_user_name }}"
 # this is the sha512 hash of the desired password
 selfoss_password_hash: "f7fbba6e0636f890e56fbbf3283e524c6fa3204ae298382d624741d0dc6638326e282c41be5e4254d8820772c5518a2c5a8c0c7f7eda19594a7eb539453e1ed7"
-# foo
+# foo

vars/user.yml

@@ -9,6 +9,10 @@ domain: TODO.com
 main_user_name: TODO
 encfs_password: TODO
 
+# database
+db_admin_username: postgres
+db_admin_password: TODO
+
 # ircbouncer
 irc_nick: TODO
 irc_ident: TODO
@@ -17,7 +21,7 @@ irc_quitmsg: TODO
 irc_password_hash: TODO
 
 # mailserver
-mail_mysql_password: TODO
+mail_db_password: TODO
 mail_virtual_domains:
   - name: "{{ domain }}"
     pk_id: 1
@@ -47,7 +51,7 @@ mail_virtual_aliases:
 zpush_timezone: "TODO"  #Example: "America/New_York"
 
 # owncloud
-owncloud_mysql_password: TODO
+owncloud_db_password: TODO
 
 # vpn
 openvpn_key_country:  "US"
@@ -60,6 +64,9 @@ openvpn_clients:
   - phone
   - tablet
 
+# webmail
+webmail_db_password: TODO
+
 # xmpp
 prosody_admin: "{{ admin_email }}"
 prosody_virtual_domain: "{{ domain }}"
@@ -68,7 +75,7 @@ prosody_accounts:
     password: TODO
 
 # selfoss
-selfoss_mysql_password: "TODO"
+selfoss_db_password: "TODO"
 selfoss_username: "{{ main_user_name }}"
 # this is the sha512 hash of the desired password
-selfoss_password_hash: "TODO"
+selfoss_password_hash: "TODO"