95 lines
2.8 KiB
YAML
95 lines
2.8 KiB
YAML
---
|
|
# ansible/roles/haproxy/tasks/configure.yml
|
|
|
|
- name: Fetch services from NetBox
|
|
when: haproxy_netbox_integration
|
|
block:
|
|
- name: Query NetBox for service configurations
|
|
ansible.builtin.uri:
|
|
url: "{{ haproxy_netbox_url }}/api/ipam/services/"
|
|
method: GET
|
|
headers:
|
|
Authorization: "Token {{ haproxy_netbox_token }}"
|
|
Accept: "application/json"
|
|
return_content: true
|
|
register: netbox_services
|
|
changed_when: false
|
|
|
|
- name: Parse NetBox services
|
|
ansible.builtin.set_fact:
|
|
haproxy_frontends: "{{ haproxy_frontends | default([]) + netbox_parsed_frontends }}"
|
|
haproxy_backends: "{{ haproxy_backends | default([]) + netbox_parsed_backends }}"
|
|
vars:
|
|
netbox_parsed_frontends: "{{ netbox_services.json.results | map(attribute='custom_fields') | list }}"
|
|
netbox_parsed_backends: "{{ netbox_services.json.results | map(attribute='custom_fields') | list }}"
|
|
when: netbox_services.json.results is defined
|
|
|
|
- name: Generate HAProxy main configuration
|
|
ansible.builtin.template:
|
|
src: haproxy.cfg.j2
|
|
dest: "{{ haproxy_config_dir }}/haproxy.cfg"
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
backup: true
|
|
validate: 'haproxy -c -f %s'
|
|
notify: reload haproxy
|
|
|
|
- name: Configure rsyslog for HAProxy
|
|
when: haproxy_rsyslog_config
|
|
block:
|
|
- name: Create rsyslog configuration for HAProxy
|
|
ansible.builtin.copy:
|
|
content: |
|
|
# HAProxy logging configuration
|
|
$ModLoad imudp
|
|
$UDPServerRun 514
|
|
|
|
# Create separate log files for HAProxy
|
|
local0.* {{ haproxy_log_dir }}/haproxy.log
|
|
local0.info {{ haproxy_log_dir }}/haproxy-info.log
|
|
local0.notice {{ haproxy_log_dir }}/haproxy-notice.log
|
|
local0.err {{ haproxy_log_dir }}/haproxy-error.log
|
|
|
|
# Stop processing HAProxy logs
|
|
& stop
|
|
dest: /etc/rsyslog.d/49-haproxy.conf
|
|
mode: '0644'
|
|
notify: restart rsyslog
|
|
|
|
- name: Configure logrotate for HAProxy
|
|
when: haproxy_log_rotation
|
|
ansible.builtin.template:
|
|
src: logrotate.j2
|
|
dest: /etc/logrotate.d/haproxy
|
|
mode: '0644'
|
|
|
|
- name: Create HAProxy systemd override directory
|
|
ansible.builtin.file:
|
|
path: /etc/systemd/system/haproxy.service.d
|
|
state: directory
|
|
mode: '0755'
|
|
|
|
- name: Configure HAProxy systemd service overrides
|
|
ansible.builtin.copy:
|
|
content: |
|
|
[Service]
|
|
# Increase file descriptor limits
|
|
LimitNOFILE=65536
|
|
|
|
# Runtime directory
|
|
RuntimeDirectory=haproxy
|
|
RuntimeDirectoryMode=0755
|
|
|
|
# Security hardening
|
|
NoNewPrivileges=true
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
PrivateTmp=true
|
|
ReadWritePaths={{ haproxy_log_dir }}
|
|
dest: /etc/systemd/system/haproxy.service.d/override.conf
|
|
mode: '0644'
|
|
notify:
|
|
- Reload systemd
|
|
- Restart haproxy
|