slfhst/ansible
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

⚡: remove the mandatory gather_subsets for loadbalancing & web servers
All checks were successful
ansible-lint / lint-everything (push) Successful in 1m17s
Details

Browse Source
This commit is contained in:
VC
2025-03-31 11:45:34 +02:00
parent 8fa63cddfb
commit b81d9f0b35
5 changed files with 16 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
roles/haproxy/defaults/main.yml Normal file
View File

@@ -0,0 +1,6 @@
---
haproxy_backend_servers: "{{ groups['webservers']
| difference(groups['proxmox_all_stopped'])
| difference(groups['disabled_loadbalanced_webservers'])
| sort }}"

12
roles/haproxy/templates/haproxy.cfg.j2
View File

@@ -41,7 +41,7 @@ frontend http
tcp-request inspect-delay 3s
acl letsencrypt path_beg /.well-known/acme-challenge
redirect scheme https code 301 if !letsencrypt
{% for server in groups['webservers'] | difference(groups['disabled_loadbalanced_webservers']) | sort %}
{% for server in haproxy_backend_servers %}
{% for hostname in hostvars[server]['web_hostname'] | sort(attribute='host') %}
## {{ hostname.host }} configuration
acl host_{{ hostname.host }} hdr(host) -i {{ hostname.host }}
@@ -56,7 +56,7 @@ frontend https
bind *:443 name frontend-https
tcp-request inspect-delay 3s
tcp-request content accept if { req.ssl_hello_type 1 }
{% for server in groups['webservers'] | difference(groups['disabled_loadbalanced_webservers']) | sort %}
{% for server in haproxy_backend_servers %}
{% for hostname in hostvars[server]['web_hostname'] | sort(attribute='host') %}
## {{ hostname.host }} configuration
acl host_{{ hostname.host }} req.ssl_sni -i {{ hostname.host }}
@@ -70,15 +70,17 @@ frontend https
{% endfor %}
{% endfor %}
{% for server in groups['webservers'] | difference(groups['disabled_loadbalanced_webservers']) | sort %}
{% for server in haproxy_backend_servers %}
## {{ hostvars[server].ansible_host }} configuration
backend http_{{ hostvars[server].ansible_host }}
mode http
server host_{{ hostvars[server].ansible_host.split('.')|join('_') }} {{ hostvars[server]['ansible_default_ipv4']['address'] }}:80
{% set hostname_slug = hostvars[server].ansible_host.split('.')|join('_') %}
{% set hostname_ipaddr = hostvars[server]['ansible_default_ipv4']['address'] | default(hostvars[server].proxmox_net0.ip | ansible.utils.ipaddr('address')) %}
server host_{{ hostname_slug }} {{ hostname_ipaddr }}:80
backend https_{{ hostvars[server].ansible_host }}
mode tcp
server host_{{ hostvars[server].ansible_host.split('.')|join('_') }} {{ hostvars[server]['ansible_default_ipv4']['address'] }}:443
server host_{{ hostname_slug }} {{ hostname_ipaddr }}:443
{% endfor %}

4
roles/nginx/templates/header.conf.j2
View File

@@ -9,7 +9,9 @@
error_log /var/log/nginx/{{ item.host }}.error.log;
error_log syslog:server=unix:/dev/log;
{% if item.allowlistv4 is defined %}
allow {{ hostvars['haproxy']['ansible_default_ipv4']['address'] }};
{% for host in groups['lbservers'] %}
allow {{ hostvars[host].proxmox_net0.ip | ansible.utils.ipaddr('address') }};
{% endfor %}
{% endif %}
{% if item.allowlistv6 is defined %}
{% for addrv6 in item.allowlistv6 %}