122 lines
2.7 KiB
YAML
122 lines
2.7 KiB
YAML
---
|
|
# file: roles/haproxy/tasks/main.yml
|
|
|
|
- name: Install Ansible prereq packages
|
|
package:
|
|
name:
|
|
- policycoreutils-python-utils
|
|
- NetworkManager
|
|
state: latest
|
|
become: yes
|
|
|
|
- name: Install packages
|
|
package:
|
|
name:
|
|
- keepalived
|
|
- haproxy
|
|
- firewalld
|
|
state: latest
|
|
become: yes
|
|
|
|
- name: Add VLAN
|
|
nmcli:
|
|
conn_name: "{{ haproxy_keepalived_adapter }}.{{ haproxy_keepalived_adapter_vlan }}"
|
|
vlanid: "{{ haproxy_keepalived_adapter_vlan }}"
|
|
ip4: "{{ haproxy_keepalived_ip }}"
|
|
vlandev: "{{ haproxy_keepalived_adapter }}"
|
|
autoconnect: yes
|
|
type: vlan
|
|
state: present
|
|
become: yes
|
|
when: (haproxy_keepalived_adapter_vlan is defined) and (haproxy_keepalived_ip is defined)
|
|
|
|
- name: Enable firewall rule for vrrp
|
|
firewalld:
|
|
rich_rule: 'rule protocol value="vrrp" accept'
|
|
permanent: yes
|
|
state: enabled
|
|
immediate: yes
|
|
notify: reload firewalld
|
|
become: yes
|
|
|
|
- name: Allow binding non-local IP
|
|
sysctl:
|
|
name: net.ipv4.ip_nonlocal_bind
|
|
value: "1"
|
|
reload: true
|
|
state: present
|
|
become: yes
|
|
|
|
- name: Allow binding ip forward
|
|
sysctl:
|
|
name: net.ipv4.ip_forward
|
|
value: "1"
|
|
reload: true
|
|
state: present
|
|
become: yes
|
|
|
|
- name: Update keepalived configuration
|
|
template:
|
|
src: keepalived.conf.j2
|
|
dest: /etc/keepalived/keepalived.conf
|
|
notify: reload keepalived
|
|
become: yes
|
|
|
|
- name: Enable keepalived
|
|
service:
|
|
name: keepalived
|
|
state: started
|
|
enabled: yes
|
|
become: yes
|
|
|
|
- name: Limit SSH to only ansible_host
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: '^#?ListenAddress '
|
|
line: "ListenAddress {{ ansible_host }}"
|
|
notify:
|
|
- Restart SSH
|
|
become: yes
|
|
|
|
- name: Flush handlers
|
|
meta: flush_handlers
|
|
|
|
- name: Set haproxy_connect_any flag and keep it persistent across reboots
|
|
seboolean:
|
|
name: haproxy_connect_any
|
|
state: yes
|
|
persistent: yes
|
|
become: yes
|
|
|
|
- name: Update HAProxy configuration
|
|
template:
|
|
src: haproxy.cfg.j2
|
|
dest: /etc/haproxy/haproxy.cfg
|
|
mode: 0644
|
|
validate: haproxy -f %s -c -q
|
|
notify: reload haproxy
|
|
become: yes
|
|
|
|
- name: Ensure HAProxy is started and enabled on boot.
|
|
service:
|
|
name: haproxy
|
|
state: started
|
|
enabled: yes
|
|
become: yes
|
|
|
|
- name: Enable firewall ports for haproxy
|
|
firewalld:
|
|
rich_rule: 'rule family=ipv4 destination address={{ haproxy_shared_ip }}{{ haproxy_shared_ip_subnet }} port port={{ item.port }} protocol={{ item.protocol }} accept'
|
|
permanent: yes
|
|
immediate: yes
|
|
state: enabled
|
|
loop: "{{ haproxy_listen_ports }}"
|
|
notify: reload firewalld
|
|
become: yes
|
|
|
|
- name: Enable firewalld
|
|
service:
|
|
name: firewalld
|
|
state: started
|
|
enabled: yes
|
|
become: yes
|