From b81d9f0b356ef6d59a71c89b180368076915ec22 Mon Sep 17 00:00:00 2001 From: VC Date: Mon, 31 Mar 2025 11:45:34 +0200 Subject: [PATCH] =?UTF-8?q?=E2=9A=A1:=20remove=20the=20mandatory=20gather?= =?UTF-8?q?=5Fsubsets=20for=20loadbalancing=20&=20web=20servers?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- playbooks/loadbalancinghttp.yml | 7 ------- playbooks/webservers.yml | 7 ------- roles/haproxy/defaults/main.yml | 6 ++++++ roles/haproxy/templates/haproxy.cfg.j2 | 12 +++++++----- roles/nginx/templates/header.conf.j2 | 4 +++- 5 files changed, 16 insertions(+), 20 deletions(-) create mode 100644 roles/haproxy/defaults/main.yml diff --git a/playbooks/loadbalancinghttp.yml b/playbooks/loadbalancinghttp.yml index fba04f5..885bcfc 100644 --- a/playbooks/loadbalancinghttp.yml +++ b/playbooks/loadbalancinghttp.yml @@ -1,12 +1,5 @@ --- -- name: Retrieve network info - hosts: webservers:!disabled_loadbalanced_webservers - gather_facts: true - gather_subset: - - network - tasks: [] - - name: Deploy haproxy hosts: lbservers diff: true diff --git a/playbooks/webservers.yml b/playbooks/webservers.yml index 97bac14..74d956a 100644 --- a/playbooks/webservers.yml +++ b/playbooks/webservers.yml @@ -1,12 +1,5 @@ --- -- name: Retrieve network info - hosts: lbservers - gather_facts: true - gather_subset: - - network - tasks: [] - - name: Deploy web servers hosts: webservers diff: true diff --git a/roles/haproxy/defaults/main.yml b/roles/haproxy/defaults/main.yml new file mode 100644 index 0000000..fcb929a --- /dev/null +++ b/roles/haproxy/defaults/main.yml @@ -0,0 +1,6 @@ +--- + +haproxy_backend_servers: "{{ groups['webservers'] + | difference(groups['proxmox_all_stopped']) + | difference(groups['disabled_loadbalanced_webservers']) + | sort }}" diff --git a/roles/haproxy/templates/haproxy.cfg.j2 b/roles/haproxy/templates/haproxy.cfg.j2 index 855282e..a8e1e51 100644 --- a/roles/haproxy/templates/haproxy.cfg.j2 +++ b/roles/haproxy/templates/haproxy.cfg.j2 @@ -41,7 +41,7 @@ frontend http tcp-request inspect-delay 3s acl letsencrypt path_beg /.well-known/acme-challenge redirect scheme https code 301 if !letsencrypt -{% for server in groups['webservers'] | difference(groups['disabled_loadbalanced_webservers']) | sort %} +{% for server in haproxy_backend_servers %} {% for hostname in hostvars[server]['web_hostname'] | sort(attribute='host') %} ## {{ hostname.host }} configuration acl host_{{ hostname.host }} hdr(host) -i {{ hostname.host }} @@ -56,7 +56,7 @@ frontend https bind *:443 name frontend-https tcp-request inspect-delay 3s tcp-request content accept if { req.ssl_hello_type 1 } -{% for server in groups['webservers'] | difference(groups['disabled_loadbalanced_webservers']) | sort %} +{% for server in haproxy_backend_servers %} {% for hostname in hostvars[server]['web_hostname'] | sort(attribute='host') %} ## {{ hostname.host }} configuration acl host_{{ hostname.host }} req.ssl_sni -i {{ hostname.host }} @@ -70,15 +70,17 @@ frontend https {% endfor %} {% endfor %} -{% for server in groups['webservers'] | difference(groups['disabled_loadbalanced_webservers']) | sort %} +{% for server in haproxy_backend_servers %} ## {{ hostvars[server].ansible_host }} configuration backend http_{{ hostvars[server].ansible_host }} mode http - server host_{{ hostvars[server].ansible_host.split('.')|join('_') }} {{ hostvars[server]['ansible_default_ipv4']['address'] }}:80 +{% set hostname_slug = hostvars[server].ansible_host.split('.')|join('_') %} +{% set hostname_ipaddr = hostvars[server]['ansible_default_ipv4']['address'] | default(hostvars[server].proxmox_net0.ip | ansible.utils.ipaddr('address')) %} + server host_{{ hostname_slug }} {{ hostname_ipaddr }}:80 backend https_{{ hostvars[server].ansible_host }} mode tcp - server host_{{ hostvars[server].ansible_host.split('.')|join('_') }} {{ hostvars[server]['ansible_default_ipv4']['address'] }}:443 + server host_{{ hostname_slug }} {{ hostname_ipaddr }}:443 {% endfor %} diff --git a/roles/nginx/templates/header.conf.j2 b/roles/nginx/templates/header.conf.j2 index aac21c2..aa0aa6d 100644 --- a/roles/nginx/templates/header.conf.j2 +++ b/roles/nginx/templates/header.conf.j2 @@ -9,7 +9,9 @@ error_log /var/log/nginx/{{ item.host }}.error.log; error_log syslog:server=unix:/dev/log; {% if item.allowlistv4 is defined %} - allow {{ hostvars['haproxy']['ansible_default_ipv4']['address'] }}; +{% for host in groups['lbservers'] %} + allow {{ hostvars[host].proxmox_net0.ip | ansible.utils.ipaddr('address') }}; +{% endfor %} {% endif %} {% if item.allowlistv6 is defined %} {% for addrv6 in item.allowlistv6 %}