/
main.yml
78 lines (75 loc) · 2.86 KB
/
main.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
---
# Copyright 2021, City Network International AB
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
_haproxy_tls_vip_binds: |
{% set vip_binds = [haproxy_bind_external_lb_vip_address] %}
{% if haproxy_bind_internal_lb_vip_address != haproxy_bind_external_lb_vip_address %}
{% set _ = vip_binds.append(haproxy_bind_internal_lb_vip_address) %}
{% endif %}
{% for vip_address in extra_lb_tls_vip_addresses %}
{% set _ = vip_binds.append(vip_address) %}
{% endfor %}
{{ vip_binds }}
_haproxy_pki_certificates: |
{% set _pki_certs = [] %}
{% for vip in _haproxy_tls_vip_binds %}
{% set _ = _pki_certs.append(
{
'name': 'haproxy_' ~ ansible_facts['hostname'] ~ '-' ~ vip,
'provider': 'ownca',
'cn': ansible_facts['hostname'],
'san': 'DNS:' ~ ansible_facts['hostname'] ~ ',DNS:' ~ ansible_facts['fqdn'] ~ ',' ~ (vip | ansible.netcommon.ipaddr) | ternary('IP:', 'DNS:') ~ vip,
'signed_by': haproxy_pki_intermediate_cert_name,
}
) %}
{% endfor %}
{{ _pki_certs }}
_haproxy_pki_install_certificates: |
{% set _pki_install = [] %}
{% for vip in _haproxy_tls_vip_binds %}
{% set _cert_basename = '/haproxy_' ~ ansible_facts['hostname'] ~ '-' ~ vip %}
{% set _ = _pki_install.append(
{
'src': haproxy_user_ssl_cert | default(haproxy_pki_certs_path ~ _cert_basename ~ '.crt'),
'dest': haproxy_ssl_cert_path ~ _cert_basename ~ '.crt',
'owner': 'root',
'group': 'root',
'mode': '0644'
}
)
%}
{% set _ = _pki_install.append(
{
'src': haproxy_user_ssl_key | default(haproxy_pki_keys_path ~ _cert_basename ~ '.key.pem'),
'dest': haproxy_ssl_cert_path ~ _cert_basename ~ '.key',
'owner': 'root',
'group': 'root',
'mode': '0644'
}
)
%}
{# We need to put CA only when it's provided by user or internal CA is used and user certs are not provided #}
{% if (haproxy_user_ssl_cert is not defined and haproxy_user_ssl_key is not defined) or haproxy_user_ssl_ca_cert is defined %}
{% set _ = _pki_install.append(
{
'src': haproxy_user_ssl_ca_cert | default(haproxy_pki_intermediate_cert_path),
'dest': haproxy_ssl_cert_path ~ _cert_basename ~ '-ca.crt',
'owner': 'root',
'group': 'root',
'mode': '0644'
})
%}
{% endif %}
{% endfor %}
{{ _pki_install }}