Haproxy refactor

core/src/epicli/data/common/ansible/playbooks/roles/backup/tasks/load_balancer_haproxy_etc.yml

@@ -10,17 +10,9 @@
   import_tasks: common/create_snapshot_archive.yml
   vars:
     snapshot_prefix: "haproxy_etc"
-    dirs_to_archive: >-
-      {{ _dirs_to_archive_switch[ansible_os_family] | default(_dirs_to_archive_switch.default) }}
-    # Simulate some basic in-place switch/case expression using a dictionary.
-    _dirs_to_archive_switch:
-      RedHat:
-        - /etc/haproxy/
-        - /etc/ssl/haproxy/
-        - /etc/opt/rh/rh-haproxy18/haproxy/
-      default:
-        - /etc/haproxy/
-        - /etc/ssl/haproxy/
+    dirs_to_archive:
+      - /etc/haproxy/
+      - /etc/ssl/haproxy/
 
 - name: Create snapshot checksum
   import_tasks: common/create_snapshot_checksum.yml

core/src/epicli/data/common/ansible/playbooks/roles/haproxy/tasks/deploy-certificates.yml

@@ -0,0 +1,55 @@
+---
+- name: Ensure /etc/ssl/haproxy directory exists
+  file:
+    path: /etc/ssl/haproxy/
+    state: directory
+
+- name: Find certificate files in role directory
+  local_action:
+    module: find
+    paths: "{{ role_path }}/files/"
+    patterns: "*.pem"
+  become: false
+  register: certificates_names
+
+- name: Check if any certificate exist in role directory
+  set_fact:
+    certificates_exist: >-
+      {{ certificates_names is defined and (certificates_names.files | length > 0) }}
+
+- name: Handle "local" certificates
+  when: certificates_exist
+  block:
+    - name: Copy certificates remotely if certificate files in role directory exist
+      copy:
+        dest: /etc/ssl/haproxy/
+        src: "{{ item.path }}"
+      loop: "{{ certificates_names.files }}"
+
+- name: Handle "remote" certificates
+  when: not certificates_exist
+  block:
+    - name: Generate self-signed certificates
+      include_tasks: generate-certificates.yml
+
+    - name: Copy self-signed certificates to /etc/ssl/haproxy/
+      copy:
+        dest: /etc/ssl/haproxy/
+        src: /tmp/{{ specification.self_signed_concatenated_cert_name }}
+        remote_src: true
+
+- name: Find certificate files in haproxy directory  # needed in templates
+  find:
+    paths: /etc/ssl/haproxy/
+    patterns: "*.pem"
+  register: haproxy_certs_names
+
+- name: Ensure /etc/haproxy directory exists
+  file:
+    path: /etc/haproxy/
+    state: directory
+
+- name: Copy dhparam config
+  copy:
+    dest: /etc/haproxy/dhparam
+    src: dhparam

core/src/epicli/data/common/ansible/playbooks/roles/haproxy/tasks/certificate_generate.yml → core/src/epicli/data/common/ansible/playbooks/roles/haproxy/tasks/generate-certificates.yml

@@ -1,5 +1,4 @@
 ---
-
 - name: Check if self signed certificate exists on node
   stat:
     path: /tmp/{{ specification.self_signed_certificate_name }}
@@ -11,7 +10,13 @@
   register: privkey_node
 
 - name: Generate private key if certificate hasn't been found in directory
-  shell: openssl req -x509 -nodes -newkey rsa:4096 -keyout /tmp/{{ specification.self_signed_private_key_name }} -out /tmp/{{ specification.self_signed_certificate_name }} -days 365 -subj '/CN=test'
+  shell: |
+    openssl req \
+      -x509 -nodes -newkey rsa:4096 \
+      -keyout /tmp/{{ specification.self_signed_private_key_name }} \
+      -out /tmp/{{ specification.self_signed_certificate_name }} \
+      -days 365 \
+      -subj '/CN=test'
   when:
     - not certificate_node.stat.exists
     - not privkey_node.stat.exists
@@ -31,15 +36,13 @@
     path: /tmp/{{ specification.self_signed_concatenated_cert_name }}
   register: cert_consolidated
 
-- name: Display if cert exists
-  debug:
-    msg: "Cert doesn't exist"
-  when:
-    - not cert_consolidated.stat.exists
-
 - name: Concatenate key and cert for haproxy
-  shell: cat /tmp/{{ specification.self_signed_certificate_name }} /tmp/{{ specification.self_signed_private_key_name }} > /tmp/{{ specification.self_signed_concatenated_cert_name }}
+  shell: |
+    cat \
+      /tmp/{{ specification.self_signed_certificate_name }} \
+      /tmp/{{ specification.self_signed_private_key_name }} \
+      > /tmp/{{ specification.self_signed_concatenated_cert_name }}
   when:
     - certificate_node.stat.exists
     - privkey_node.stat.exists
-    - not cert_consolidated.stat.exists
+    - not cert_consolidated.stat.exists

core/src/epicli/data/common/ansible/playbooks/roles/haproxy/tasks/main.yml

@@ -1,5 +1,28 @@
 ---
+- name: Ensure certificates exist remotely
+  include_tasks: deploy-certificates.yml
 
-- include_tasks: "{{ ansible_os_family }}.yml"
-- include_tasks: "setup_logrotate.yml"
+- name: Render haproxy config
+  template:
+    dest: /etc/haproxy/haproxy.cfg
+    src: haproxy.cfg.j2
+  register: template_haproxy_cfg
 
+- name: Setup and start haproxy runc-based systemd service
+  include_role: { name: haproxy_runc }
+  vars:
+    haproxy_service: haproxy
+    extra_mounts:
+      - destination: /etc/ssl/haproxy/
+        source: /etc/ssl/haproxy/
+        type: bind
+        options: [rbind, ro]
+
+- name: Reload haproxy service
+  systemd:
+    name: haproxy
+    state: reloaded
+  when: template_haproxy_cfg is changed
+
+- name: Setup haproxy logging
+  include_tasks: setup-haproxy-logging.yml