92b2a9d609
- Move all roles from playbooks/roles/ to roles/ - Update roles_path in ansible.cfg - Add cast user to common role - Create standalone podman role - Add semaphore role with Podman + Quadlet support
129 lines
3.4 KiB
YAML
129 lines
3.4 KiB
YAML
---
|
|
# ansible/roles/haproxy/tasks/install.yml
|
|
|
|
- name: Install HAProxy repository (Ubuntu)
|
|
when: ansible_os_family == "Debian"
|
|
block:
|
|
- name: Add HAProxy PPA
|
|
ansible.builtin.apt_repository:
|
|
repo: "ppa:vbernat/haproxy-{{ haproxy_version }}"
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Install HAProxy
|
|
ansible.builtin.apt:
|
|
name: haproxy
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Install HAProxy (Fedora/RHEL)
|
|
when: ansible_os_family == "RedHat"
|
|
block:
|
|
- name: Install HAProxy
|
|
ansible.builtin.dnf:
|
|
name: haproxy
|
|
state: present
|
|
|
|
- name: Install additional packages
|
|
ansible.builtin.package:
|
|
name:
|
|
- rsyslog
|
|
- logrotate
|
|
- socat # For HAProxy socket communication
|
|
state: present
|
|
|
|
- name: Create HAProxy system user
|
|
ansible.builtin.user:
|
|
name: "{{ haproxy_user }}"
|
|
group: "{{ haproxy_group }}"
|
|
system: true
|
|
shell: /usr/sbin/nologin
|
|
home: "{{ haproxy_chroot_dir }}"
|
|
create_home: true
|
|
|
|
- name: Create required directories
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
owner: "{{ haproxy_user }}"
|
|
group: "{{ haproxy_group }}"
|
|
mode: '0755'
|
|
loop:
|
|
- "{{ haproxy_config_dir }}"
|
|
- "{{ haproxy_ssl_cert_dir }}"
|
|
- "{{ haproxy_log_dir }}"
|
|
- "{{ haproxy_chroot_dir }}"
|
|
- /var/lib/haproxy/dev
|
|
|
|
- name: Create HAProxy socket directory
|
|
ansible.builtin.file:
|
|
path: /run/haproxy
|
|
state: directory
|
|
owner: "{{ haproxy_user }}"
|
|
group: "{{ haproxy_group }}"
|
|
mode: '0755'
|
|
|
|
- name: Configure firewall rules
|
|
when: haproxy_configure_firewall
|
|
block:
|
|
- name: Open HAProxy ports (UFW)
|
|
when: ansible_os_family == "Debian"
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "{{ item.split('/')[0] }}"
|
|
proto: "{{ item.split('/')[1] }}"
|
|
loop: "{{ haproxy_firewall_allowed_ports }}"
|
|
|
|
- name: Open HAProxy ports (firewalld)
|
|
when: ansible_os_family == "RedHat"
|
|
ansible.posix.firewalld:
|
|
port: "{{ item }}"
|
|
permanent: true
|
|
state: enabled
|
|
immediate: true
|
|
loop: "{{ haproxy_firewall_allowed_ports }}"
|
|
|
|
- name: Install Prometheus HAProxy exporter
|
|
when: haproxy_prometheus_exporter
|
|
block:
|
|
- name: Download HAProxy exporter
|
|
ansible.builtin.get_url:
|
|
url: "https://github.com/prometheus/haproxy_exporter/releases/download/v0.15.0/haproxy_exporter-0.15.0.linux-amd64.tar.gz"
|
|
dest: /tmp/haproxy_exporter.tar.gz
|
|
mode: '0644'
|
|
|
|
- name: Extract HAProxy exporter
|
|
ansible.builtin.unarchive:
|
|
src: /tmp/haproxy_exporter.tar.gz
|
|
dest: /usr/local/bin/
|
|
remote_src: true
|
|
extra_opts:
|
|
- --strip-components=1
|
|
- --wildcards
|
|
- '*/haproxy_exporter'
|
|
|
|
- name: Create HAProxy exporter systemd service
|
|
ansible.builtin.copy:
|
|
content: |
|
|
[Unit]
|
|
Description=HAProxy Exporter
|
|
After=network.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User={{ haproxy_user }}
|
|
ExecStart=/usr/local/bin/haproxy_exporter --haproxy.scrape-uri=unix:/run/haproxy/admin.sock
|
|
Restart=on-failure
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
dest: /etc/systemd/system/haproxy-exporter.service
|
|
mode: '0644'
|
|
|
|
- name: Enable and start HAProxy exporter
|
|
ansible.builtin.systemd:
|
|
name: haproxy-exporter
|
|
state: started
|
|
enabled: true
|
|
daemon_reload: true
|