new files from source

2026-06-09 10:20:07 +03:00
commit 973546647d
@@ -0,0 +1,55 @@
+# Vault connection
+vault_addr: "http://VAULT_IP:VAULT_PORT"
+
+# Directory paths
+haproxy_certs_dir: "/etc/haproxy/certs"
+haproxy_cert_path: "{{ haproxy_pem_path }}"
+haproxy_pem_path: "{{ haproxy_certs_dir }}/haproxy.pem"
+haproxy_ca_path: "{{ haproxy_certs_dir }}/haproxy_ca.crt"
+
+# Systemd service names
+haproxy_service: "haproxy"
+
+# HAProxy tuning
+haproxy_global_maxconn: 4096
+haproxy_timeout_connect_ms: 5000
+haproxy_timeout_client_ms: 60000
+haproxy_timeout_server_ms: 60000
+haproxy_enable_hsts: true
+
+vault_agent_templates:
+  - src: "haproxy.pem.ctmpl"
+    dest: "{{ haproxy_pem_path }}"
+    service: "haproxy"
+  - src: "haproxy_ca.ctmpl"
+    dest: "{{ haproxy_ca_path }}"
+    service: "haproxy"
+
+# === Services routed internally through HAProxy ===
+securemtls_services:
+  vault:
+    hostname: vault.local.DOMAIN_PLACEHOLDER
+    balance: roundrobin
+    mode: http
+    timeout_connect: 5s
+    timeout_server: 30s
+    default_server_inter: 3s
+    default_server_rise: 2
+    default_server_fall: 3
+    backend_servers:
+      - address: VAULT_IP
+        port: VAULT_PORT
+        proto: http
+    headers:
+      - "http-request set-header Host vault.local.DOMAIN_PLACEHOLDER"
+      - "http-request set-header X-Forwarded-Proto https"
+    rewrites:
+      - "http-response replace-header Location ^http://VAULT_IP:VAULT_PORT/(.*) https://vault.local.DOMAIN_PLACEHOLDER/\\1"
+
+  technitium:
+    hostname: "technitium.local.DOMAIN_PLACEHOLDER"
+    backend_mode: http
+    backend_servers:
+      - address: TECHNITIUM_IP
+        port: TECHNITIUM_PORT
+        proto: "http"
@@ -0,0 +1,5 @@
+---
+- name: Reload HAProxy
+  systemd:
+    name: haproxy
+    state: reloaded
@@ -0,0 +1,107 @@
+---
+- name: Install HAProxy
+  dnf:
+    name: haproxy
+    state: present
+
+- name: Ensure firewalld is running and enabled
+  systemd:
+    name: firewalld
+    enabled: true
+    state: started
+
+- name: Allow inbound HTTPS (443/tcp)
+  ansible.posix.firewalld:
+    service: https
+    permanent: true
+    state: enabled
+    immediate: true
+
+- name: Ensure HAProxy certificate directories exist
+  file:
+    path: "{{ cert_dir }}"
+    state: directory
+    owner: haproxy
+    group: haproxy
+    mode: "0750"
+  loop:
+    - "{{ haproxy_certs_dir }}"
+    - "{{ haproxy_certs_dir }}/clients"
+  loop_control:
+    loop_var: cert_dir
+
+- name: Apply SELinux context for HAProxy certs
+  command: semanage fcontext -a -t etc_t "{{ haproxy_certs_dir }}(/.*)?"
+  become: true
+  register: semanage_fcontext_result
+  failed_when: false
+  changed_when: semanage_fcontext_result.rc == 0
+
+- name: Restore SELinux context for HAProxy certs
+  command: restorecon -Rv "{{ haproxy_certs_dir }}"
+  become: true
+  changed_when: false
+
+- name: Allow HAProxy to connect to any port (SELinux)
+  ansible.posix.seboolean:
+    name: haproxy_connect_any
+    state: true
+    persistent: true
+
+- name: Wait for HAProxy PEM and CA files
+  wait_for:
+    path: "{{ pem_item }}"
+    state: present
+    timeout: 120
+  loop:
+    - "{{ haproxy_pem_path }}"
+    - "{{ haproxy_ca_path }}"
+  loop_control:
+    loop_var: pem_item
+
+- name: Ensure permissions for HAProxy certs
+  file:
+    path: "{{ cert_item }}"
+    owner: haproxy
+    group: haproxy
+    mode: "0644"
+  loop:
+    - "{{ haproxy_pem_path }}"
+    - "{{ haproxy_ca_path }}"
+  loop_control:
+    loop_var: cert_item
+
+- name: Deploy HAProxy configuration
+  template:
+    src: haproxy.cfg.j2
+    dest: /etc/haproxy/haproxy.cfg
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Reload HAProxy
+
+- name: Ensure HAProxy service starts after vault-agent
+  lineinfile:
+    path: /usr/lib/systemd/system/haproxy.service
+    regexp: "^After="
+    line: "After=network-online.target vault-agent.service"
+    backup: yes
+
+- name: Reload systemd daemon
+  command: systemctl daemon-reload
+
+- name: Enable and start HAProxy
+  systemd:
+    name: haproxy
+    enabled: yes
+    state: started
+
+- name: Check SELinux mode
+  command: getenforce
+  register: selinux_state
+  changed_when: false
+
+- name: Warn if SELinux is not enforcing
+  debug:
+    msg: "⚠️ SELinux is not enforcing — HAProxy cert contexts may not be correctly applied."
+  when: selinux_state.stdout != "Enforcing"
@@ -0,0 +1,86 @@
+# ==========================================
+# HAProxy global settings
+# ==========================================
+global
+    log /dev/log local0
+    log /dev/log local1 notice
+    chroot /var/lib/haproxy
+    pidfile /run/haproxy.pid
+    maxconn {{ haproxy_global_maxconn | default(4096) }}
+    user haproxy
+    group haproxy
+    daemon
+
+defaults
+    log global
+    option httplog
+    option dontlognull
+    timeout connect {{ haproxy_timeout_connect_ms | default('5000') }}
+    timeout client {{ haproxy_timeout_client_ms | default('60000') }}
+    timeout server {{ haproxy_timeout_server_ms | default('60000') }}
+    option http-server-close
+    option forwardfor
+    retries 3
+    maxconn 2000
+
+# ==========================================
+# HAProxy frontends and backends template
+# ==========================================
+
+frontend https-in
+    mode http
+    bind *:443 ssl crt {{ haproxy_pem_path }} ca-file {{ haproxy_ca_path }} verify required alpn h2,http/1.1
+    option httplog
+    option forwardfor
+    timeout client 30s
+
+    http-request set-header X-Client-Cert %[ssl_c_der,base64]
+
+{% for service_name, service in securemtls_services.items() %}
+    acl host_{{ service_name }} hdr(host) -i {{ service.hostname }}
+    use_backend {{ service_name }} if host_{{ service_name }}
+{% endfor %}
+
+# ==========================================
+# Backends
+# ==========================================
+{% for service_name, service in securemtls_services.items() %}
+backend {{ service_name }}
+    balance {{ service.balance | default('roundrobin') }}
+    mode {{ service.mode | default('http') }}
+    timeout connect {{ service.timeout_connect | default('5s') }}
+    timeout server {{ service.timeout_server | default('30s') }}
+    option {{ service.options | default('http-server-close') }}
+    default-server inter {{ service.default_server_inter | default('3s') }}
+    default-server rise {{ service.default_server_rise | default('2') }}
+    default-server fall {{ service.default_server_fall | default('3') }}
+
+{% for server in service.backend_servers %}
+    {% if server.proto == "https" %}
+    server {{ service_name }}-{{ loop.index }} {{ server.address }}:{{ server.port }} ssl verify none check
+    {% else %}
+    server {{ service_name }}-{{ loop.index }} {{ server.address }}:{{ server.port }} check
+    {% endif %}
+{% endfor %}
+
+{% if service.headers is defined %}
+{% for hdr in service.headers %}
+    {{ hdr }}
+{% endfor %}
+{% endif %}
+
+{% if service.rewrites is defined %}
+{% for rewrite in service.rewrites %}
+    {{ rewrite }}
+{% endfor %}
+{% endif %}
+
+{% endfor %}
+
+# ==========================================
+# Vault backend for HAProxy
+# ==========================================
+backend vault_backend
+    mode tcp
+    option ssl-hello-chk
+    server vault1 VAULT_IP:VAULT_PORT ssl verify required ca-file {{ haproxy_ca_path }} crt {{ haproxy_cert_path }}