Ansible role: Haproxy

Install and configure haproxy

Requirements

• Ansible >= 2.21
• Debian
  • Trixie

Role variables

Name	Type	Required	Default	Comment
haproxy_use_official_repository	bool	no	false	if true, use haproxy official repository
haproxy_version	str	no	3.4	when you use official repository, you can set the major version to install
haproxy_apt_release	str	no	ansible_facts.distribution_release	set the apt release to use
haproxy_global	dict	no		global section in configuration of haproxy
haproxy_defaults	dict	no		defaults sections in configuration of haproxy
haproxy_listen_stats	dict	no		config for listen stats section
haproxy_resolvers	dict	no		config the resolvers
haproxy_frontends	dict	no		frontends configuration
haproxy_backends	dict	no		backend configuration
haproxy_subnets_lists	dict	no		IPs list for use in haproxy ACL
haproxy_userlists	dict	no		user list for basic auth
haproxy_ssl_certificates	dict	no		SSL certificates file to copy
haproxy_http_errors	dict	no		HTTP error groups
haproxy_http_errors_files	dict	no		HTTP error files to copy

haproxy_global

Set parameters in global section of Haproxy configuration. See all parameters in Haproxy documentation

log-send-hostname: true
chroot: /var/lib/haproxy
pidfile: /var/run/haproxy.pid
maxconn: 4096
user: haproxy
group: haproxy
daemon: true
stats: socket /var/lib/haproxy/stats

haproxy_defaults

Set parameters in defaults section of Haproxy configuration. See all parameters in Haproxy documentation

mode: http
log: global
option:
  - httplog
  - dontlognull
  - http-server-close
  - forwardfor except 127.0.0.0/8
  - redispatch
retries: 3
timeout:
  - http-request 10s
  - queue 1m
  - connect 10s
  - client 1m
  - server 1m
  - http-keep-alive 10s
  - check 10s
maxconn: 4096

haproxy_listen_stats

Set parameters in listen stats section of Haproxy configuration. See all parameters in Haproxy documentation

bind: "127.0.0.1:9000"
mode: http
maxconn: 10
timeout:
  - client 30s
  - server 30s
  - connect 30s
  - queue 30s
stats:
  - "refresh 5s"
  - "show-node"
  - 'realm Haproxy\ Statistics'
  - "auth {{ haproxy_stats_username }}:{{ haproxy_stats_password }}"
  - "uri /haproxy_stats"

haproxy_resolvers

dns:
  local:
    - dns1 127.0.0.1:53

haproxy_frontends

See all parameters in Haproxy documentation

fontend-https:
  bind: "*:443 ssl cert /etc/haproxy/ssl1.pem /etc/haproxy/ssl2.pem"
  default_backend: backend-app
frontend-http:
  bind: "*:80"
  mode: http
  option:
    - "forwardfor except 127.0.0.0/8"
    - "httplog"
    - "http-server-close"
  acl:
    - acl_test1-https hdr(host) test1.example.net
    - acl_test2-https hdr(host) test2.example.net
    - acl_blacklist src -f /etc/haproxy/blacklist.list
  use_backend:
    - backend-app if acl_test1-https
    - backend-app if acl_test2-https
    - backend-app if acl_test1-https acl_blacklist

haproxy_backends

See all parameters in Haproxy documentation

backend-app:
  mode: http
  balance: roundrobin
  stick-table: type ip size 512k expire 30m
  stick: on src
  option:
    - "ssl-hello-chk"
    - "tcp-check"
    - "log-health-checks"
    - "forwardfor header X-Forwarded-For"
  server:
    - host1 127.0.0.1:80 check maxconn 1000 inter 15s
    - host2 127.0.0.1:80 check maxconn 1000 inter 15s

haproxy_subnets_lists

Name	Type	Required	Default	Comment
key	str	yes		name of subnets list
value	list(str)	yes		list of subnet

blacklist:
  - 192.168.0.0/16
  - 172.10.10.0/24
public_withlist:
  - 8.8.8.8

haproxy_userlists

restricted:
  group:
    - admin
  user:
    - admin password 84375611a53741f7e94b09eb49127f41 groups admin

haproxy_ssl_certificates

Name	Type	Required	Default	Comment
key	str	yes		name of certificate
value	str	yes		the certificate

example-com: |-
  -----BEGIN CERTIFICATE-----
  MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQDJZs7pOmgIjXqa
  /rZx2CL4pXTo4kKv+Itj3xfrq46r4DZKQJoCHqcs/bFjtCP89xJlvbrZVmxizFOF
  mfKiNat39GNgeUaTH23+N/FOAyphayOcFk+s4X6GbdxrkHqt9IBrfK0B88bYjL/m
  ...

haproxy_http_errors

test:
  503: test-503

haproxy_http_errors_files

test-503: |-
  HTTP/1.1 503 Service Unavailable
  Cache-Control: no-cache
  Connection: close
  Content-Type: text/html

  <!DOCTYPE html>
  <html lang="en">
      <body>
          <main>
              This is my custom 503 page
          </main>
      </body>
  </html>

How to use

- hosts: server
  roles:
    - nishiki.haproxy

Development

Test with molecule and docker

• install docker
• install python3 and python3-pip
• install molecule and dependencies pip3 install molecule molecule-plugins docker ansible-lint testinfra yamllint
• run molecule test

License

Copyright (c) 2019 Adrien Waksberg

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.