Add HAProxy role

haproxy/defaults/main.yml

+---
+
+haproxy_ssl_level: intermediate
+haproxy:
+  defaults: {}
+  frontends: {}
+  backends: {}

haproxy/files/haproxy-default

+# Defaults file for HAProxy
+#
+# This is sourced by both, the initscript and the systemd unit file, so do not
+# treat it as a shell script fragment.
+
+# Change the config file location if needed
+#CONFIG="/etc/haproxy/haproxy.cfg"
+
+# Add extra flags here, see haproxy(1) for a few options
+EXTRAOPTS="-S /run/haproxy/master.sock"
+# Needed for systemd ProtectSystem=strict
+PIDFILE="/run/haproxy/haproxy.pid"

haproxy/files/haproxy-systemd.conf

+# -*- systemd -*-
+
+### The following section is based on the comments in the haproxy.service
+### shipped with Debian
+[Service]
+# The following lines leverage SystemD's sandboxing options to provide
+# defense in depth protection at the expense of restricting some flexibility
+# in your setup (e.g. placement of your configuration files) or possibly
+# reduced performance. See systemd.service(5) and systemd.exec(5) for further
+# information.
+
+NoNewPrivileges=true
+ProtectHome=true
+# If you want to use 'ProtectSystem=strict' you should whitelist the PIDFILE,
+# any state files and any other files written using 'ReadWritePaths' or
+# 'RuntimeDirectory'.
+ProtectSystem=strict
+ReadWritePaths=/run/haproxy
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+# If your SystemD version supports them, you can add: @reboot, @swap, @sync
+SystemCallFilter=~@cpu-emulation @keyring @module @obsolete @raw-io @reboot @swap @sync
+
+### The following section adapted to the systemd version in Debian Bullseye and
+### the options it supports.
+ProtectProc=invisible
+PrivateDevices=true
+PrivateTmp=true
+ProtectHostname=true
+ProtectClock=true
+ProtectKernelLogs=true
+LockPersonality=true
+SystemCallArchitectures=native

haproxy/handlers/main.yml

+---
+
+- name: Reload systemd
+  systemd:
+    daemon_reload: true
+
+- name: Restart HAProxy
+  systemd:
+    name: haproxy.service
+    state: restarted
+
+- name: Reload HAProxy
+  systemd:
+    name: haproxy.service
+    state: reloaded

haproxy/tasks/main.yml

+---
+
+- name: Install HAProxy
+  apt:
+    name: haproxy
+
+- name: Create systemd drop-in config directory
+  file:
+    path: /etc/systemd/system/haproxy.service.d
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Configure systemd service
+  copy:
+    src: haproxy-systemd.conf
+    dest: /etc/systemd/system/haproxy.service.d/ansible.conf
+    owner: root
+    group: root
+    mode: "0644"
+  notify:
+    - Reload systemd
+    - Restart HAProxy
+
+- name: Configure service environment
+  copy:
+    src: haproxy-default
+    dest: /etc/default/haproxy
+    owner: root
+    group: root
+    mode: "0644"
+  notify:
+    - Restart HAProxy
+
+- name: Configure HAProxy
+  template:
+    lstrip_blocks: true
+    src: haproxy.cfg.j2
+    dest: /etc/haproxy/haproxy.cfg
+    validate: /usr/sbin/haproxy -f %s -c -q
+    owner: root
+    group: root
+    mode: "0644"
+  notify:
+    - Reload HAProxy
+
+- name: Enable HAProxy
+  systemd:
+    name: haproxy.service
+    enabled: true

haproxy/templates/_macros.j2

+{% macro option(name, value) -%}
+  {% if value is not none -%}
+    {% if value is boolean -%}
+      {% if value -%}
+	option {{ name }}
+      {%- else -%}
+	no option {{ name }}
+      {%- endif -%}
+    {% else -%} {# not boolean #}
+      option {{ name }} {{ value }}
+    {%- endif -%}
+  {% endif -%} {# not none #}
+{% endmacro -%}
+
+{% macro errorfile(value) -%}
+  {% for k, v in value.items() -%}
+    {% if v -%}
+      errorfile {{ k ~ ' ' ~ v }}
+    {% endif -%}
+  {% endfor -%}
+{% endmacro -%}
+
+{% macro render(cfg) -%}
+  {%- for k, v in cfg.items()
+    if not (k == "options" or k == "errorfiles")
+    -%}
+    {% if v is iterable and not v is string -%}
+      {% for i in v -%}
+	{{ k ~ ' ' ~ i }}
+      {% endfor -%}
+    {% else -%}
+      {{ k ~ ' ' ~ v }}
+    {% endif -%}
+  {% endfor -%}
+  {% if cfg.options is defined -%}
+    {% for k, v in cfg.options.items() -%}
+      {{ option(k, v) }}
+    {% endfor -%}
+  {% endif -%}
+  {% if cfg.errorfiles is defined -%}
+    {{ errorfile(cfg.errorfiles) }}
+  {% endif -%}
+{% endmacro -%}

haproxy/templates/haproxy.cfg.j2

+{# -*- conf -*- -#}
+{% from "_macros.j2" import render -%}
+global
+	# log suitable for systemd journal
+	log stdout format short local0
+	chroot /var/lib/haproxy
+	stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
+	stats timeout 30s
+	user haproxy
+	group haproxy
+	daemon
+
+	# Default SSL material locations
+	ca-base /etc/ssl/certs
+	crt-base /etc/ssl/private
+
+	{{ haproxy_ssl_defaults[haproxy_ssl_level] | indent('\t') }}
+
+{% set _defaults = haproxy_defaults|combine(haproxy.defaults, recursive=True) %}
+defaults
+{# jinja newlines, lol. #}
+	{{ render(_defaults) | indent('\t') }}
+
+{% for k, v in haproxy.frontends.items() %}
+frontend {{ k }}
+	{{ render(v) | indent('\t') }}
+{% if not loop.last %}
+
+{% endif %}
+{% endfor %}
+
+{% for k, v in haproxy.backends.items() %}
+backend {{ k }}
+	{{ render(v) | indent('\t') }}
+{% if not loop.last %}
+
+{% endif %}
+{% endfor %}

haproxy/vars/main.yml

+---
+
+# yamllint disable rule:line-length
+
+haproxy_ssl_defaults:
+  modern: |
+    # modern configuration
+    ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
+    ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets
+
+    ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
+    ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets
+  intermediate: |
+    # intermediate configuration
+    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
+    ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
+    ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
+
+    ssl-default-server-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
+    ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
+    ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
+# yamllint enable rule:line-length
+
+haproxy_defaults:
+  log: global
+  mode: http
+  timeout connect: 5000
+  timeout client: 50000
+  timeout server: 50000
+  options:
+    httplog: true
+    dontlognull: true
+  errorfiles:
+    400: /etc/haproxy/errors/400.http
+    403: /etc/haproxy/errors/403.http
+    408: /etc/haproxy/errors/408.http
+    500: /etc/haproxy/errors/500.http
+    502: /etc/haproxy/errors/502.http
+    503: /etc/haproxy/errors/503.http
+    504: /etc/haproxy/errors/504.http