Merge "Add default CA store to use when haproxy_backend_ca is true"

doc/source/configure-haproxy.rst

@@ -278,6 +278,8 @@ An example HTTP service could look like:
           # If backend connections should be secured with SSL (default False)
           haproxy_backend_ssl: True
           haproxy_backend_ca: /path/to/ca/cert.pem
+          # Or to use system CA for validation
+          # haproxy_backend_ca: True
           # Or if certificate validation should be disabled
           # haproxy_backend_ca: False
 

templates/service.j2

@@ -132,7 +132,7 @@ backend {{ item.service.haproxy_service_name }}-back
 {% endif %}
 {% if item.service.haproxy_backend_ca %}
 {% set _ = entry.append("ca-file") %}
-{% set _ = entry.append(item.service.haproxy_backend_ca) %}
+{% set _ = entry.append(item.service.haproxy_backend_ca is string | ternary(item.service.haproxy_backend_ca, haproxy_system_ca)) %}
 {% else %}
 {% set _ = entry.append("verify none") %}
 {% endif %}
@@ -173,7 +173,7 @@ backend {{ item.service.haproxy_service_name }}-back
 {% endif %}
 {% if item.service.haproxy_backend_ca %}
 {% set _ = entry.append("ca-file") %}
-{% set _ = entry.append(item.service.haproxy_backend_ca) %}
+{% set _ = entry.append(item.service.haproxy_backend_ca is string | ternary(item.service.haproxy_backend_ca, haproxy_system_ca)) %}
 {% else %}
 {% set _ = entry.append("verify none") %}
 {% endif %}

vars/debian.yml

@@ -24,3 +24,6 @@ haproxy_distro_packages:
 
 haproxy_distro_certbot_packages:
   - certbot
+
+# Set system CA store which can be used to verify backends
+haproxy_system_ca: /etc/ssl/certs/ca-certificates.crt

vars/redhat.yml

@@ -16,3 +16,6 @@
 haproxy_distro_packages:
   - haproxy
   - nc # Used for the Ansible haproxy module
+
+# Set system CA store which can be used to verify backends
+haproxy_system_ca: /etc/pki/tls/certs/ca-bundle.crt

vars/ubuntu.yml

@@ -24,3 +24,6 @@ haproxy_distro_packages:
 
 haproxy_distro_certbot_packages:
   - certbot
+
+# Set system CA store which can be used to verify backends
+haproxy_system_ca: /etc/ssl/certs/ca-certificates.crt