openstack/openstack-ansible-haproxy_server
Code Issues Proposed changes

Do not define TLS for frontend with mode tcp

Browse Source 
In case frontend/backend are configured in TCP mode there is no reason
to supply a SSL configuration for such frontend.

With that we also align usage of `request_option` variable which is
anyway defined out of `service.haproxy_balance_type` but with provided
default value.

Change-Id: I5dff5aadc546d2984c1295e89b67b35a34254237
This commit is contained in:
Dmitriy Rabotyagov
2024-11-10 16:31:24 +01:00
parent ec0066e06c
commit 7e30567f02
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
templates/service.j2
View File

@@ -53,7 +53,7 @@ bind {{ vip_address }}:{{ service.haproxy_redirect_http_port }}{{ (vip_interface
{% else %} {% else %}
{% set haproxy_ssl_path=haproxy_ssl_cert_path + "/haproxy_" + (haproxy_host | default(ansible_facts['hostname'])) + "-" + ((vip_interface is truthy) | ternary(vip_address ~ '-' ~ vip_interface, vip_address)) + ".pem" %} {% set haproxy_ssl_path=haproxy_ssl_cert_path + "/haproxy_" + (haproxy_host | default(ansible_facts['hostname'])) + "-" + ((vip_interface is truthy) | ternary(vip_address ~ '-' ~ vip_interface, vip_address)) + ".pem" %}
frontend {{ service.haproxy_service_name }}-front-{{ loop.index }} frontend {{ service.haproxy_service_name }}-front-{{ loop.index }}
bind {{ vip_address }}:{{ service.haproxy_port }}{{ (vip_interface is truthy) | ternary(' interface ' ~ vip_interface, '') }} {% if (service.haproxy_ssl | default(false) | bool) and (loop.index == 1 or vip_address in extra_lb_tls_vip_addresses or (service.haproxy_ssl_all_vips | default(false) | bool and vip_address not in extra_lb_vip_addresses)) %}ssl crt {{ service.haproxy_ssl_path | default(haproxy_ssl_path) }}{% if service.haproxy_frontend_h2 | default(haproxy_frontend_h2) and request_option == "http" %} alpn h2,http/1.1{% endif %}{% endif %} bind {{ vip_address }}:{{ service.haproxy_port }}{{ (vip_interface is truthy) | ternary(' interface ' ~ vip_interface, '') }} {% if (service.haproxy_ssl | default(false) | bool) and (request_option == "http") and (loop.index == 1 or vip_address in extra_lb_tls_vip_addresses or (service.haproxy_ssl_all_vips | default(false) | bool and vip_address not in extra_lb_vip_addresses)) %}ssl crt {{ service.haproxy_ssl_path | default(haproxy_ssl_path) }}{% if service.haproxy_frontend_h2 | default(haproxy_frontend_h2) %} alpn h2,http/1.1{% endif %}{% endif %}
{% if request_option == "http" %} {% if request_option == "http" %}
option httplog option httplog
@@ -86,7 +86,7 @@ frontend {{ service.haproxy_service_name }}-front-{{ loop.index }}
{% if (service.haproxy_ssl | default(false) | bool) and request_option == 'http' and (loop.index == 1 or vip_address in extra_lb_tls_vip_addresses or (service.haproxy_ssl_all_vips | default(false) | bool and vip_address not in extra_lb_vip_addresses)) %} {% if (service.haproxy_ssl | default(false) | bool) and request_option == 'http' and (loop.index == 1 or vip_address in extra_lb_tls_vip_addresses or (service.haproxy_ssl_all_vips | default(false) | bool and vip_address not in extra_lb_vip_addresses)) %}
http-request add-header X-Forwarded-Proto https http-request add-header X-Forwarded-Proto https
{% endif %} {% endif %}
mode {{ service.haproxy_balance_type }} mode {{ request_option }}
{% if (not service.haproxy_frontend_only | default(false)) or ((service.haproxy_default_backend is defined) and (service.haproxy_default_backend | length > 0)) %} {% if (not service.haproxy_frontend_only | default(false)) or ((service.haproxy_default_backend is defined) and (service.haproxy_default_backend | length > 0)) %}
default_backend {{ service.haproxy_default_backend | default(service.haproxy_service_name) }}-back default_backend {{ service.haproxy_default_backend | default(service.haproxy_service_name) }}-back
{% endif %} {% endif %}
@@ -102,7 +102,7 @@ frontend {{ service.haproxy_service_name }}-front-{{ loop.index }}
{% set backend_arguments = service.haproxy_backend_arguments|default([]) %} {% set backend_arguments = service.haproxy_backend_arguments|default([]) %}
backend {{ service.haproxy_service_name }}-back backend {{ service.haproxy_service_name }}-back
mode {{ service.haproxy_balance_type }} mode {{ request_option }}
balance {{ service.haproxy_balance_alg|default("leastconn") }} balance {{ service.haproxy_balance_alg|default("leastconn") }}
{% if service.haproxy_timeout_server is defined %} {% if service.haproxy_timeout_server is defined %}
timeout server {{ service.haproxy_timeout_server }} timeout server {{ service.haproxy_timeout_server }}