901523ddbb
In some user scenarious (like implementing DNS RR) it might be useful to bind on 0.0.0.0 but at the same time do not conflict with other services that are binded to the same ports. For that, we can specify a specific interface, on which haproxy will be binded to 0.0.0.0. In netstat it would be represented like `0.0.0.0%br-mgmt:5000`. With that we also allow to fully override `vip_binds` if assumtions that role make are not valid for some reason. Change-Id: Ic4c58ef53abc5f454b6fbebbd87292a932d173ae
85 lines
3.5 KiB
YAML
85 lines
3.5 KiB
YAML
---
|
|
# Copyright 2021, City Network International AB
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
_haproxy_tls_vip_binds: |
|
|
{% set vip_binds = [{'address': haproxy_bind_external_lb_vip_address, 'interface': haproxy_bind_external_lb_vip_interface}] %}
|
|
{% if haproxy_bind_internal_lb_vip_address != haproxy_bind_external_lb_vip_address or haproxy_bind_external_lb_vip_interface != haproxy_bind_internal_lb_vip_interface %}
|
|
{% set _ = vip_binds.append({'address': haproxy_bind_internal_lb_vip_address, 'interface': haproxy_bind_internal_lb_vip_interface}) %}
|
|
{% endif %}
|
|
{% for vip_address in extra_lb_tls_vip_addresses %}
|
|
{% set _ = vip_binds.append({'address': vip_address}) %}
|
|
{% endfor %}
|
|
{{ vip_binds }}
|
|
|
|
_haproxy_pki_certificates: |
|
|
{% set _pki_certs = [] %}
|
|
{% for vip in haproxy_tls_vip_binds %}
|
|
{% set _ = _pki_certs.append(
|
|
{
|
|
'name': 'haproxy_' ~ ansible_facts['hostname'] ~ '-' ~ ('interface' in vip and vip['interface'] is truthy) | ternary(vip['address'] ~ '-' ~ vip['interface'], vip['address']),
|
|
'provider': 'ownca',
|
|
'cn': ansible_facts['hostname'],
|
|
'san': 'DNS:' ~ ansible_facts['hostname'] ~ ',DNS:' ~ ansible_facts['fqdn'] ~ ',' ~ (vip['address'] | ansible.utils.ipaddr) | ternary('IP:', 'DNS:') ~ vip['address'],
|
|
'signed_by': haproxy_pki_intermediate_cert_name,
|
|
}
|
|
) %}
|
|
{% endfor %}
|
|
{{ _pki_certs }}
|
|
|
|
_haproxy_pki_install_certificates: |
|
|
{% set _pki_install = [] %}
|
|
{% for vip in haproxy_tls_vip_binds %}
|
|
{% set _cert_basename = '/haproxy_' ~ ansible_facts['hostname'] ~ '-' ~ ('interface' in vip and vip['interface'] is truthy) | ternary(vip['address'] ~ '-' ~ vip['interface'], vip['address']) %}
|
|
{% set _ = _pki_install.append(
|
|
{
|
|
'src': haproxy_user_ssl_cert | default(haproxy_pki_certs_path ~ _cert_basename ~ '.crt'),
|
|
'dest': haproxy_ssl_cert_path ~ _cert_basename ~ '.crt',
|
|
'owner': 'root',
|
|
'group': 'root',
|
|
'mode': '0644'
|
|
}
|
|
)
|
|
%}
|
|
{% set _ = _pki_install.append(
|
|
{
|
|
'src': haproxy_user_ssl_key | default(haproxy_pki_keys_path ~ _cert_basename ~ '.key.pem'),
|
|
'dest': haproxy_ssl_cert_path ~ _cert_basename ~ '.key',
|
|
'owner': 'root',
|
|
'group': 'root',
|
|
'mode': '0644'
|
|
}
|
|
)
|
|
%}
|
|
{# We need to put CA only when it's provided by user or internal CA is used and user certs are not provided #}
|
|
{% if (haproxy_user_ssl_cert is not defined and haproxy_user_ssl_key is not defined) or haproxy_user_ssl_ca_cert is defined %}
|
|
{% set _ = _pki_install.append(
|
|
{
|
|
'src': haproxy_user_ssl_ca_cert | default(haproxy_pki_intermediate_cert_path),
|
|
'dest': haproxy_ssl_cert_path ~ _cert_basename ~ '-ca.crt',
|
|
'owner': 'root',
|
|
'group': 'root',
|
|
'mode': '0644'
|
|
})
|
|
%}
|
|
{% endif %}
|
|
{% endfor %}
|
|
{{ _pki_install }}
|
|
|
|
# In case CSP is enabled, on newer haproxy versions, header size
|
|
# fill more than bufsize-maxrewrite, which results in 500
|
|
# See: https://github.com/haproxy/haproxy/issues/1597
|
|
_haproxy_default_tuning_params:
|
|
tune.maxrewrite: 1280
|