⚡: remove the mandatory gather_subsets for loadbalancing & web servers

playbooks/loadbalancinghttp.yml

@@ -1,12 +1,5 @@
 ---
 
-- name: Retrieve network info
-  hosts: webservers:!disabled_loadbalanced_webservers
-  gather_facts: true
-  gather_subset:
-    - network
-  tasks: []
-
 - name: Deploy haproxy
   hosts: lbservers
   diff: true

playbooks/webservers.yml

@@ -1,12 +1,5 @@
 ---
 
-- name: Retrieve network info
-  hosts: lbservers
-  gather_facts: true
-  gather_subset:
-    - network
-  tasks: []
-
 - name: Deploy web servers
   hosts: webservers
   diff: true

roles/haproxy/defaults/main.yml

@@ -0,0 +1,6 @@
+---
+
+haproxy_backend_servers: "{{ groups['webservers']
+    | difference(groups['proxmox_all_stopped'])
+    | difference(groups['disabled_loadbalanced_webservers'])
+    | sort }}"

roles/haproxy/templates/haproxy.cfg.j2

@@ -41,7 +41,7 @@ frontend http
 	tcp-request inspect-delay 3s
 	acl letsencrypt path_beg /.well-known/acme-challenge
 	redirect scheme https code 301 if !letsencrypt
-{% for server in groups['webservers'] | difference(groups['disabled_loadbalanced_webservers']) | sort %}
+{% for server in haproxy_backend_servers %}
 {% for hostname in hostvars[server]['web_hostname'] | sort(attribute='host') %}
 	## {{ hostname.host }} configuration
 	acl host_{{ hostname.host }} hdr(host) -i {{ hostname.host }}
@@ -56,7 +56,7 @@ frontend https
 	bind *:443 name frontend-https
 	tcp-request inspect-delay 3s
 	tcp-request content accept if { req.ssl_hello_type 1 }
-{% for server in groups['webservers'] | difference(groups['disabled_loadbalanced_webservers']) | sort %}
+{% for server in haproxy_backend_servers %}
 {% for hostname in hostvars[server]['web_hostname'] | sort(attribute='host') %}
 	## {{ hostname.host }} configuration
 	acl host_{{ hostname.host }} req.ssl_sni -i {{ hostname.host }}
@@ -70,15 +70,17 @@ frontend https
 {% endfor %}
 {% endfor %}
 
-{% for server in groups['webservers'] | difference(groups['disabled_loadbalanced_webservers']) | sort %}
+{% for server in haproxy_backend_servers %}
 ## {{ hostvars[server].ansible_host }} configuration
 backend http_{{ hostvars[server].ansible_host }}
 	mode http
-	server host_{{ hostvars[server].ansible_host.split('.')|join('_') }} {{ hostvars[server]['ansible_default_ipv4']['address'] }}:80
+{% set hostname_slug = hostvars[server].ansible_host.split('.')|join('_') %}
+{% set hostname_ipaddr = hostvars[server]['ansible_default_ipv4']['address'] | default(hostvars[server].proxmox_net0.ip | ansible.utils.ipaddr('address')) %}
+	server host_{{ hostname_slug }} {{ hostname_ipaddr }}:80
 
 backend https_{{ hostvars[server].ansible_host }}
 	mode tcp
-	server host_{{ hostvars[server].ansible_host.split('.')|join('_') }} {{ hostvars[server]['ansible_default_ipv4']['address'] }}:443
+	server host_{{ hostname_slug }} {{ hostname_ipaddr }}:443
 
 {% endfor %}
 

roles/nginx/templates/header.conf.j2

@@ -9,7 +9,9 @@
 	error_log /var/log/nginx/{{ item.host }}.error.log;
 	error_log syslog:server=unix:/dev/log;
 {% if item.allowlistv4 is defined %}
-	allow {{ hostvars['haproxy']['ansible_default_ipv4']['address'] }};
+{% for host in groups['lbservers'] %}
+	allow {{ hostvars[host].proxmox_net0.ip | ansible.utils.ipaddr('address') }};
+{% endfor %}
 {% endif %}
 {% if item.allowlistv6 is defined %}
 {% for addrv6 in item.allowlistv6 %}