112 lines
4.0 KiB
YAML
112 lines
4.0 KiB
YAML
---
|
|
#--------------------------------------------------------------#
|
|
# Install Haproxy [haproxy_install]
|
|
#--------------------------------------------------------------#
|
|
- name: install haproxy
|
|
tags: haproxy_install
|
|
when: haproxy_enabled|bool
|
|
ignore_errors: "{{ not haproxy_enabled|bool }}" # ignore errors if not enabled
|
|
block:
|
|
|
|
- name: install haproxy
|
|
environment: "{{ proxy_env | default({}) }}"
|
|
package: name=haproxy state=present
|
|
|
|
- name: create haproxy config dir
|
|
file: path=/etc/haproxy state=directory owner=root mode=0700
|
|
|
|
- name: create haproxy environment file
|
|
file: path=/etc/default/haproxy state=touch mode=0644
|
|
|
|
- name: create haproxy systemd service
|
|
copy: src=haproxy.svc dest={{ systemd_dir }}/haproxy.service
|
|
|
|
|
|
#--------------------------------------------------------------#
|
|
# Config Haproxy [haproxy_config]
|
|
#--------------------------------------------------------------#
|
|
- name: render haproxy config
|
|
tags: haproxy_config
|
|
when: haproxy_enabled|bool
|
|
block:
|
|
|
|
- name: wipe haproxy config dir
|
|
when: haproxy_clean|bool
|
|
shell: "mkdir -p /etc/haproxy; rm -f /etc/haproxy/* ; /bin/true"
|
|
args: { executable: /bin/bash }
|
|
|
|
- name: render haproxy default config
|
|
template: src=haproxy.cfg.j2 dest=/etc/haproxy/haproxy.cfg owner=root mode=0644
|
|
|
|
- name: render haproxy service config
|
|
when: haproxy_services is defined and haproxy_services|length > 0
|
|
template: src=service.j2 dest=/etc/haproxy/{{ item.name }}.cfg owner=root mode=0644
|
|
vars: { service: "{{ item }}" }
|
|
with_items: "{{ haproxy_services }}"
|
|
|
|
- name: setup selinux for haproxy
|
|
tags: haproxy_firewall
|
|
ignore_errors: true
|
|
shell: |
|
|
command -v semanage &>/dev/null || exit 0
|
|
setsebool -P haproxy_connect_any 1 2>/dev/null
|
|
cd /tmp
|
|
cat > haproxy_proc.te <<'EOF'
|
|
module haproxy_proc 1.0;
|
|
|
|
require {
|
|
type haproxy_t;
|
|
type proc_t;
|
|
type kernel_t;
|
|
class file { open read getattr };
|
|
class dir { search getattr };
|
|
}
|
|
|
|
allow haproxy_t proc_t:dir { search getattr };
|
|
allow haproxy_t proc_t:file { open read getattr };
|
|
allow haproxy_t kernel_t:dir { search getattr };
|
|
allow haproxy_t kernel_t:file { open read getattr };
|
|
EOF
|
|
checkmodule -M -m -o haproxy_proc.mod haproxy_proc.te 2>/dev/null && \
|
|
semodule_package -o haproxy_proc.pp -m haproxy_proc.mod 2>/dev/null && \
|
|
semodule -i haproxy_proc.pp 2>/dev/null
|
|
rm -f haproxy_proc.te haproxy_proc.mod haproxy_proc.pp
|
|
/bin/true
|
|
args: { executable: /bin/bash }
|
|
|
|
|
|
#--------------------------------------------------------------#
|
|
# Launch Haproxy [haproxy_launch]
|
|
#--------------------------------------------------------------#
|
|
- name: launch haproxy
|
|
tags: haproxy_launch
|
|
when: haproxy_enabled|bool
|
|
block:
|
|
|
|
- name: launch haproxy systemd service
|
|
systemd: name=haproxy state=restarted enabled=yes daemon_reload=yes
|
|
|
|
- name: wait for haproxy service online
|
|
wait_for: host=127.0.0.1 port={{ haproxy_exporter_port|default(9101) }} state=started timeout=10
|
|
|
|
|
|
#--------------------------------------------------------------#
|
|
# Reload Haproxy [haproxy_reload]
|
|
#--------------------------------------------------------------#
|
|
- name: reload haproxy to register node services
|
|
tags: [ haproxy_reload , haproxy_config ]
|
|
when: haproxy_enabled|bool and haproxy_reload|bool
|
|
block:
|
|
|
|
# if the check fails on this step, haproxy will not be reloaded
|
|
- name: check haproxy config before reload
|
|
ignore_errors: false
|
|
command: /usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg -c -q
|
|
|
|
# even if you perform haproxy reload on junk config, it will not fail
|
|
- name: reload haproxy
|
|
ignore_errors: false
|
|
systemd: name=haproxy state=reloaded enabled=yes daemon_reload=yes
|
|
|
|
|
|
... |