new files from source

Infrastrucutre as Code/Ansible/roles/secure_vault/haproxy/defaults/main.yml

@@ -0,0 +1,55 @@
+# Vault connection
+vault_addr: "http://VAULT_IP:VAULT_PORT"
+
+# Directory paths
+haproxy_certs_dir: "/etc/haproxy/certs"
+haproxy_cert_path: "{{ haproxy_pem_path }}"
+haproxy_pem_path: "{{ haproxy_certs_dir }}/haproxy.pem"
+haproxy_ca_path: "{{ haproxy_certs_dir }}/haproxy_ca.crt"
+
+# Systemd service names
+haproxy_service: "haproxy"
+
+# HAProxy tuning
+haproxy_global_maxconn: 4096
+haproxy_timeout_connect_ms: 5000
+haproxy_timeout_client_ms: 60000
+haproxy_timeout_server_ms: 60000
+haproxy_enable_hsts: true
+
+vault_agent_templates:
+  - src: "haproxy.pem.ctmpl"
+    dest: "{{ haproxy_pem_path }}"
+    service: "haproxy"
+  - src: "haproxy_ca.ctmpl"
+    dest: "{{ haproxy_ca_path }}"
+    service: "haproxy"
+
+# === Services routed internally through HAProxy ===
+securemtls_services:
+  vault:
+    hostname: vault.local.DOMAIN_PLACEHOLDER
+    balance: roundrobin
+    mode: http
+    timeout_connect: 5s
+    timeout_server: 30s
+    default_server_inter: 3s
+    default_server_rise: 2
+    default_server_fall: 3
+    backend_servers:
+      - address: VAULT_IP
+        port: VAULT_PORT
+        proto: http
+    headers:
+      - "http-request set-header Host vault.local.DOMAIN_PLACEHOLDER"
+      - "http-request set-header X-Forwarded-Proto https"
+    rewrites:
+      - "http-response replace-header Location ^http://VAULT_IP:VAULT_PORT/(.*) https://vault.local.DOMAIN_PLACEHOLDER/\\1"
+
+  technitium:
+    hostname: "technitium.local.DOMAIN_PLACEHOLDER"
+    backend_mode: http
+    backend_servers:
+      - address: TECHNITIUM_IP
+        port: TECHNITIUM_PORT
+        proto: "http"