new files from source

Infrastrucutre as Code/Ansible/roles/secure_vault/haproxy/tasks/main.yml

@@ -0,0 +1,107 @@
+---
+- name: Install HAProxy
+  dnf:
+    name: haproxy
+    state: present
+
+- name: Ensure firewalld is running and enabled
+  systemd:
+    name: firewalld
+    enabled: true
+    state: started
+
+- name: Allow inbound HTTPS (443/tcp)
+  ansible.posix.firewalld:
+    service: https
+    permanent: true
+    state: enabled
+    immediate: true
+
+- name: Ensure HAProxy certificate directories exist
+  file:
+    path: "{{ cert_dir }}"
+    state: directory
+    owner: haproxy
+    group: haproxy
+    mode: "0750"
+  loop:
+    - "{{ haproxy_certs_dir }}"
+    - "{{ haproxy_certs_dir }}/clients"
+  loop_control:
+    loop_var: cert_dir
+
+- name: Apply SELinux context for HAProxy certs
+  command: semanage fcontext -a -t etc_t "{{ haproxy_certs_dir }}(/.*)?"
+  become: true
+  register: semanage_fcontext_result
+  failed_when: false
+  changed_when: semanage_fcontext_result.rc == 0
+
+- name: Restore SELinux context for HAProxy certs
+  command: restorecon -Rv "{{ haproxy_certs_dir }}"
+  become: true
+  changed_when: false
+
+- name: Allow HAProxy to connect to any port (SELinux)
+  ansible.posix.seboolean:
+    name: haproxy_connect_any
+    state: true
+    persistent: true
+
+- name: Wait for HAProxy PEM and CA files
+  wait_for:
+    path: "{{ pem_item }}"
+    state: present
+    timeout: 120
+  loop:
+    - "{{ haproxy_pem_path }}"
+    - "{{ haproxy_ca_path }}"
+  loop_control:
+    loop_var: pem_item
+
+- name: Ensure permissions for HAProxy certs
+  file:
+    path: "{{ cert_item }}"
+    owner: haproxy
+    group: haproxy
+    mode: "0644"
+  loop:
+    - "{{ haproxy_pem_path }}"
+    - "{{ haproxy_ca_path }}"
+  loop_control:
+    loop_var: cert_item
+
+- name: Deploy HAProxy configuration
+  template:
+    src: haproxy.cfg.j2
+    dest: /etc/haproxy/haproxy.cfg
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Reload HAProxy
+
+- name: Ensure HAProxy service starts after vault-agent
+  lineinfile:
+    path: /usr/lib/systemd/system/haproxy.service
+    regexp: "^After="
+    line: "After=network-online.target vault-agent.service"
+    backup: yes
+
+- name: Reload systemd daemon
+  command: systemctl daemon-reload
+
+- name: Enable and start HAProxy
+  systemd:
+    name: haproxy
+    enabled: yes
+    state: started
+
+- name: Check SELinux mode
+  command: getenforce
+  register: selinux_state
+  changed_when: false
+
+- name: Warn if SELinux is not enforcing
+  debug:
+    msg: "⚠️ SELinux is not enforcing — HAProxy cert contexts may not be correctly applied."
+  when: selinux_state.stdout != "Enforcing"