Skip to content

Commit 6845450

Browse files
itewkitewk
committed
all applications to be exposed on http or https frontends
1 parent 606e661 commit 6845450

File tree

8 files changed

+118
-50
lines changed

8 files changed

+118
-50
lines changed

‎README.md

Lines changed: 44 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -28,62 +28,77 @@ Information about the expected role parameters.
2828
### haproxy_applications
2929
The `haproxy_applications` parameter is a list of hashes defining the applications to load balance. Each item in the list may contain the following parameters.
3030

31-
| parameter | required | default | choices | comments
32-
| --------------------- |:--------:|:-------:| ----------- |:--------
33-
| name | yes | | | Name of the application. Used in defining frontend and backend servers. Should be descriptive as will show up in HAProxy stats. Must match `/a-zA-Z0-9-_/`
34-
| domain | yes | | | FQDN which will resolve to the HAProxy server(s) to then load balance the `servers`. Can either just be a simple FQDN or a regex statement to match a domain.
35-
| domain\_is\_regex | no | false | true, false | `true` if the given `domain` is regex, `false` to treat as plane FQDN.
36-
| http\_redirect | no | false | true, false | `true` to automatically redirect http to https, `false` not to redirect.
37-
| servers | yes | | | List of hashes defining servers to load balance.
31+
| parameter | required | default | choices | comments
32+
| ---------------------- |:--------:|:-------:| ----------- |:--------
33+
| name | yes | | | Name of the application. Used in defining frontend and backend servers. Should be descriptive as will show up in HAProxy stats. Must match `/a-zA-Z0-9-_/`
34+
| domain | yes | | | FQDN which will resolve to the HAProxy server(s) to then load balance the `servers`. Can either just be a simple FQDN or a regex statement to match a domain.
35+
| domain\_is\_regex | no | false | true, false | `true` if the given `domain` is regex, `false` to treat as plane FQDN.
36+
| expose_http | no | false | true, false | `true` to expose this application on http, `false` to not expose on http.
37+
| expose_https | no | false | true, false | `true` to expose this application on https, `false` to not expose on https.
38+
| redirect_http_to_https | no | false | true, false | `true` to automatically redirect http to https, `false` not to redirect.
39+
| servers | yes | | | List of hashes defining servers to load balance.
3840

3941
#### servers
4042
Each element in the `haproxy_applications` list must contain a `servers` key which is a list of hashes defining the servers to load balance for the respective application. Each item in the list may contain the following parameters.
4143

42-
| parameter | required | default | choices | comments
43-
| --------- |:--------:|:-------:| --------------- |:--------
44-
| name | yes | | | Name used to reference the server. Will be displayed in the HAProxy stats. Must match `/a-zA-Z0-9-_/`
45-
| address | yes | | | FQDN or IP of server to load balance.
46-
| port | yes | | | Port of server at `address` to load balance.
44+
| parameter | required | default | choices | comments
45+
| ---------- |:--------:|:-------:| --------------- |:--------
46+
| name | yes | | | Name used to reference the server. Will be displayed in the HAProxy stats. Must match `/a-zA-Z0-9-_/`
47+
| address | yes | | | FQDN or IP of server to load balance.
48+
| port_http | no | 80 | | Port of server at `address` to load balance when `expose_http` is `true`.
49+
| port_https | no | 443 | | Port of server at `address` to load balance when `expose_https` is `true`.
4750

4851
## Example Playbooks
4952

50-
### Load balance Ansible Tower and OpenShift Container Platform (OCP) with same HAProxy server(s)
51-
53+
## Load balance Ansible Tower
5254
- name: HAProxy
5355
hosts: haproxy
5456
roles:
5557
- role: haproxy
5658
haproxy_applications:
5759
- name: ansible-tower
5860
domain: tower.example.com
59-
http_redirect: true
61+
expose_https: True
62+
redirect_http_to_https: True
6063
servers:
6164
- name: tower0002
6265
address: tower0002.example.com
63-
port: 443
6466
- name: tower0003
6567
address: tower0003.example.com
66-
port: 443
6768
- name: tower0004
6869
address: tower0004.example.com
69-
port: 443
70-
- name: ocp
70+
71+
## Load balance OpenShift Container Platform (OCP) masters and routers
72+
- name: HAProxy
73+
hosts: haproxy
74+
roles:
75+
- role: haproxy
76+
haproxy_applications:
77+
- name: ocp-admin
7178
domain: ocp.example.com
72-
http_redirect: true
79+
expose_https: True
80+
redirect_http_to_https: True
7381
servers:
74-
- name: ocp0002
82+
- name: ocp0002-master
7583
address: ocp0002.example.com
76-
port: 443
77-
- name: ocp0003
84+
- name: ocp0003-master
7885
address: ocp0003.example.com
79-
port: 443
80-
- name: ocp0004
86+
- name: ocp0004-master
8187
address: ocp0004.example.com
82-
port: 443
83-
84-
## License
88+
- name: ocp-router
89+
domain: .*.apps.example.com
90+
domain_is_regex: True
91+
expose_https: True
92+
expose_http: True
93+
redirect_http_to_https: False
94+
servers:
95+
- name: ocp0005-infra
96+
address: ocp0005.example.com
97+
- name: ocp0006-infra
98+
address: ocp0006.example.com
99+
- name: ocp0007-infra
100+
address: ocp0007.example.com
85101

86-
Apache
87102

88103
## Author Information
89104

‎tasks/configure.yml

Lines changed: 19 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -9,30 +9,40 @@
99
tags:
1010
- haproxy-configure
1111

12-
- name: HAProxy | Configure | Update http_redirect.map
12+
- name: HAProxy | Configure | Update redirect_http_to_https.map
1313
template:
14-
src: templates/http_redirect.map.j2
15-
dest: /etc/haproxy/http_redirect.map
14+
src: templates/redirect_http_to_https.map.j2
15+
dest: /etc/haproxy/redirect_http_to_https.map
1616
owner: haproxy
1717
group: haproxy
18-
register: http_redirect_result
18+
register: redirect_http_to_https_result
1919
tags:
2020
- haproxy-configure
2121

22-
- name: HAProxy | Configure | Update be_tcp.map
22+
- name: HAProxy | Configure | Update expose_http.map
2323
template:
24-
src: templates/be_tcp.map.j2
25-
dest: /etc/haproxy/be_tcp.map
24+
src: templates/expose_http.map.j2
25+
dest: /etc/haproxy/expose_http.map
2626
owner: haproxy
2727
group: haproxy
28-
register: be_tcp_result
28+
register: expose_http_result
29+
tags:
30+
- haproxy-configure
31+
32+
- name: HAProxy | Configure | Update expose_https.map
33+
template:
34+
src: templates/expose_https.map.j2
35+
dest: /etc/haproxy/expose_https.map
36+
owner: haproxy
37+
group: haproxy
38+
register: expose_https_result
2939
tags:
3040
- haproxy-configure
3141

3242
- name: HAProxy | Configure | Restart Service
3343
service:
3444
name: haproxy
3545
state: restarted
36-
when: haproxy_cfg_result.changed or http_redirect_result.changed or be_tcp_result.changed
46+
when: haproxy_cfg_result.changed or redirect_http_to_https_result.changed or expose_http_result.changed or expose_https_result.changed
3747
tags:
3848
- haproxy-configure

‎templates/.haproxy.cfg.j2.swp

-12 KB
Binary file not shown.

‎templates/be_tcp.map.j2 renamed to ‎templates/expose_http.map.j2

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
{% for application in haproxy_applications %}
2-
{% if application.domain_is_regex | default(false) %}
2+
{% if application.expose_http | default(false) %}
3+
{% if application.domain_is_regex | default(false) %}
34
^{{ application.domain }}(:[0-9]+)?(/.*)?$ {{application.name}}
4-
{% else %}
5+
{% else %}
56
^{{ application.domain | regex_escape() }}(:[0-9]+)?(/.*)?$ {{application.name}}
7+
{% endif %}
68
{% endif %}
79
{% endfor %}

‎templates/expose_https.map.j2

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{% for application in haproxy_applications %}
2+
{% if application.expose_https | default(false) %}
3+
{% if application.domain_is_regex | default(false) %}
4+
^{{ application.domain }}(:[0-9]+)?(/.*)?$ {{application.name}}
5+
{% else %}
6+
^{{ application.domain | regex_escape() }}(:[0-9]+)?(/.*)?$ {{application.name}}
7+
{% endif %}
8+
{% endif %}
9+
{% endfor %}

‎templates/haproxy.cfg.j2

Lines changed: 33 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -58,21 +58,49 @@ frontend public
5858
http-request set-header Host %[req.hdr(Host),lower]
5959

6060
# check if we need to redirect/force using https.
61-
acl secure_redirect base,map_reg(/etc/haproxy/http_redirect.map) -m found
61+
acl secure_redirect base,map_reg(/etc/haproxy/redirect_http_to_https.map) -m found
6262
redirect scheme https if secure_redirect
6363

64+
# determine if should expose http
65+
acl http_expose base,map_reg(/etc/haproxy/expose_http.map) -m found
66+
67+
# use http backend if not https redirect and expose http
68+
use_backend be_http:%[base,map_reg(/etc/haproxy/expose_http.map) if !secure_redirect http_expose
69+
6470
frontend public_ssl
6571
bind :443
6672
tcp-request inspect-delay 5s
6773
tcp-request content accept if { req_ssl_hello_type 1 }
74+
75+
# determine if the conneciton is SNI
6876
acl sni req.ssl_sni -m found
69-
use_backend be_tcp:%[req.ssl_sni,lower,map_reg(/etc/haproxy/be_tcp.map)] if sni
7077

78+
# determien if should expose https
79+
acl https_expose req.ssl_sni,lower,map_reg(/etc/haproxy/expose_https.map) -m found
80+
81+
# use tcp backend if SNI connection and expose https
82+
use_backend be_tcp:%[req.ssl_sni,lower,map_reg(/etc/haproxy/expose_https.map)] if sni https_expose
83+
84+
# create TCP backends
7185
{% for application in haproxy_applications %}
86+
{% if application.expose_https | default(false) %}
7287
backend be_tcp:{{ application.name }}
7388
balance source
7489
mode tcp
75-
{% for server in application.servers %}
76-
server {{ server.name }} {{ server.address }}:{{ server.port }} check
77-
{% endfor %}
90+
{% for server in application.servers %}
91+
server {{ server.name }} {{ server.address }}:{{ server.port_https | default(443) }} check
92+
{% endfor %}
93+
{% endif %}
94+
{% endfor %}
95+
96+
# create HTTP backends
97+
{% for application in haproxy_applications %}
98+
{% if application.expose_http | default(false) %}
99+
backend be_http:{{ application.name }}
100+
balance source
101+
mode http
102+
{% for server in application.servers %}
103+
server {{ server.name }} {{ server.address }}:{{ server.port_http | default(80) }} check
104+
{% endfor %}
105+
{% endif %}
78106
{% endfor %}

‎templates/http_redirect.map.j2

Lines changed: 0 additions & 5 deletions
This file was deleted.

‎templates/redirect_http_to_https.map.j2

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{% for application in haproxy_applications %}
2+
{% if application.redirect_http_to_https | default(false) %}
3+
{% if application.domain_is_regex | default(false) %}
4+
^{{ application.domain }}(:[0-9]+)?(/.*)?$ {{application.name}}
5+
{% else %}
6+
^{{ application.domain | regex_escape() }}(:[0-9]+)?(/.*)?$ {{application.name}}
7+
{% endif %}
8+
{% endif %}
9+
{% endfor %}

0 commit comments

Comments
 (0)