uclalib_haproxy.yml

---

# 2020-04-09 jhriv
# A simple playbook to put UCLA Library test/prod HAProxy under
# Ansible / version control.

- name: HAProxy (Prod/Test) Install/Configure
  hosts: all

  tasks:
    - name: Install HAProxy
      dnf:
        name: haproxy
        state: present
        disable_excludes: all
      become: true
      when: ansible_facts['os_family'] == "RedHat" and ansible_facts['distribution_major_version'] == "8"

    - name: Install sysctl if not present
      dnf:
        name: procps-ng
        state: present
        disable_excludes: all
      become: true
      when: ansible_facts['os_family'] == "RedHat" and ansible_facts['distribution_major_version'] == "8"

    - name: Start HAProxy on boot
      service:
        name: haproxy
        enabled: true
      become: true

    - name: Allow bind to non-local IPs (keepalived)
      sysctl:
        name: net.ipv4.ip_nonlocal_bind
        value: '1'
        state: present
        sysctl_set: true
        reload: true
      become: true

    - name: Get the directories
      # -printf is a GNU extension
      # command: find . -type d -printf '%P\n'
      command: find . -type d -print
      args:
        chdir: "files/{{ haproxy_local_file_path }}"
      connection: local
      changed_when: false
      check_mode: false
      register: haproxy_conf_directories

    - name: Get the files
      # -printf is a GNU extension
      # command: find . -type f -not -name haproxy.cfg -printf '%P\n'
      command: find . -type f -not -name haproxy.cfg -print
      args:
        chdir: "files/{{ haproxy_local_file_path }}"
      connection: local
      changed_when: false
      check_mode: false
      register: haproxy_conf_files

    - name: Create Directories
      file:
        name: "{{ haproxy_config_dir }}/{{ item }}"
        state: directory
      become: true
      loop:
        "{{ haproxy_conf_directories.stdout_lines }}"

    - name: Copy Files
      copy:
        src: "{{ haproxy_local_file_path }}/{{ item }}"
        dest: "{{ haproxy_config_dir }}/{{ item | regex_replace ('\\.vault(|\\..*)$', '\\1' ) }}"
      become: true
      loop:
        "{{ haproxy_conf_files.stdout_lines }}"
      notify:
        - Restart HAProxy

    - name: Deploy ACL sources
      copy:
        content: "{{ hostvars[inventory_hostname][item] | join('\n') }}\n"
        dest: "{{ haproxy_config_dir  }}/{{ item }}"
        owner: "root"
        group: "root"
        mode: 0644
      become: true
      loop:
        - ucla_vpn_networks
        - ucla_library_staff_networks
        - rancher_agent_acl
      notify:
        - Restart HAProxy

    - name: Copy Config
      copy:
        src: "{{ haproxy_local_file_path }}/haproxy.cfg"
        dest: "{{ haproxy_config_dir }}/haproxy.cfg"
        validate: haproxy -c -f %s
      become: true
      notify:
        - Restart HAProxy

  handlers:
    - name: Restart HAProxy
      service:
        name: haproxy
        state: restarted
      become: true