108 lines
2.4 KiB
YAML
108 lines
2.4 KiB
YAML
---
|
|
- name: Install HAProxy
|
|
dnf:
|
|
name: haproxy
|
|
state: present
|
|
|
|
- name: Ensure firewalld is running and enabled
|
|
systemd:
|
|
name: firewalld
|
|
enabled: true
|
|
state: started
|
|
|
|
- name: Allow inbound HTTPS (443/tcp)
|
|
ansible.posix.firewalld:
|
|
service: https
|
|
permanent: true
|
|
state: enabled
|
|
immediate: true
|
|
|
|
- name: Ensure HAProxy certificate directories exist
|
|
file:
|
|
path: "{{ cert_dir }}"
|
|
state: directory
|
|
owner: haproxy
|
|
group: haproxy
|
|
mode: "0750"
|
|
loop:
|
|
- "{{ haproxy_certs_dir }}"
|
|
- "{{ haproxy_certs_dir }}/clients"
|
|
loop_control:
|
|
loop_var: cert_dir
|
|
|
|
- name: Apply SELinux context for HAProxy certs
|
|
command: semanage fcontext -a -t etc_t "{{ haproxy_certs_dir }}(/.*)?"
|
|
become: true
|
|
register: semanage_fcontext_result
|
|
failed_when: false
|
|
changed_when: semanage_fcontext_result.rc == 0
|
|
|
|
- name: Restore SELinux context for HAProxy certs
|
|
command: restorecon -Rv "{{ haproxy_certs_dir }}"
|
|
become: true
|
|
changed_when: false
|
|
|
|
- name: Allow HAProxy to connect to any port (SELinux)
|
|
ansible.posix.seboolean:
|
|
name: haproxy_connect_any
|
|
state: true
|
|
persistent: true
|
|
|
|
- name: Wait for HAProxy PEM and CA files
|
|
wait_for:
|
|
path: "{{ pem_item }}"
|
|
state: present
|
|
timeout: 120
|
|
loop:
|
|
- "{{ haproxy_pem_path }}"
|
|
- "{{ haproxy_ca_path }}"
|
|
loop_control:
|
|
loop_var: pem_item
|
|
|
|
- name: Ensure permissions for HAProxy certs
|
|
file:
|
|
path: "{{ cert_item }}"
|
|
owner: haproxy
|
|
group: haproxy
|
|
mode: "0644"
|
|
loop:
|
|
- "{{ haproxy_pem_path }}"
|
|
- "{{ haproxy_ca_path }}"
|
|
loop_control:
|
|
loop_var: cert_item
|
|
|
|
- name: Deploy HAProxy configuration
|
|
template:
|
|
src: haproxy.cfg.j2
|
|
dest: /etc/haproxy/haproxy.cfg
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Reload HAProxy
|
|
|
|
- name: Ensure HAProxy service starts after vault-agent
|
|
lineinfile:
|
|
path: /usr/lib/systemd/system/haproxy.service
|
|
regexp: "^After="
|
|
line: "After=network-online.target vault-agent.service"
|
|
backup: yes
|
|
|
|
- name: Reload systemd daemon
|
|
command: systemctl daemon-reload
|
|
|
|
- name: Enable and start HAProxy
|
|
systemd:
|
|
name: haproxy
|
|
enabled: yes
|
|
state: started
|
|
|
|
- name: Check SELinux mode
|
|
command: getenforce
|
|
register: selinux_state
|
|
changed_when: false
|
|
|
|
- name: Warn if SELinux is not enforcing
|
|
debug:
|
|
msg: "⚠️ SELinux is not enforcing — HAProxy cert contexts may not be correctly applied."
|
|
when: selinux_state.stdout != "Enforcing"
|