Allow greater flexibility in listen directive.

[Spredzy]

Currently the module does not allow to specify specific bind options
per IP we are binding haproxy onto.
Hence, if a user has a service available across several network, but
with different haproxy bind option according to the network, s/he can't
configure haproxy with the current state of this module.

It aims to make it possible to have configuration as the following:

  bind 192.168.2.1:80 ssl crt public.puppetlabs.com.crt
  bind 10.0.0.1:80 ssl crt private.puppetlabs.com.crt
  bind 178.35.67.12:80

by doing

haproxy::listen {'apache00' : 
  ports => '80',
  ipaddresses_and_bind_options => {'192.168.2.1'  => ['ssl', 'crt', 'public.puppetlabs.com.crt'],
                                   '10.0.0.1'     => ['ssl', 'crt', 'private.puppetlabs.com.crt'],
                                   '178.35.67.12' => []},
}

[hunner]

What do you think about using the existing parameters in a different way to accomplish the same thing? Perhaps if the ipaddress and bind_options are arrays, then it would assign the options to the ip addresses? Something like:

haproxy::listen {'apache00' :
  ipaddress    => [
    '192.168.2.1',
    '10.0.0.1',
    '178.35.67.12',
  ],
  ports        => '80',
  bind_options => [
    ['ssl', 'crt', 'public.puppetlabs.com.crt'],
    ['ssl', 'crt', 'private.puppetlabs.com.crt'],
    [],
  ],
}

Or even have the ipaddress parameter take a hash which includes bind options? Then the bind_options parameter wouldn't even be needed.

haproxy::listen {'apache00' :
  ports => '80',
  ipaddress => {
    '192.168.2.1'  => ['ssl', 'crt', 'public.puppetlabs.com.crt'],
    '10.0.0.1'     => ['ssl', 'crt', 'private.puppetlabs.com.crt'],
    '178.35.67.12' => [],
  },
}

[igalic]

I like @hunner's second proposal, Alot. The first one is problematic because it needs specific ordering.
Not a big fan of ipaddresses_and_bind_options as a name.

[Spredzy]

I agree with @hunner second idea but that would break backward compatibility if that is an issue.

Should we add a warning if is_array is true and mutate the array to an hash with empty values?

[igalic]

👍

[Spredzy]

Sorry for the delay was out for holidays, please let me know if this new version seems better

[antaflos]

@esbjerg raises a valid point in #122. Seems like we should be able to specify arbitrary bind options independently for IP addresses and ports, and valid combinations of IP addresses and ports.

Would something like this work?

haproxy::listen { 'apache00' :
  bind => {
    '192.168.2.1:80'   => [],
    '10.0.0.1:8080'    => [],
    '178.35.67.12:443' => [ 'ssl', 'crt', 'foo.example.com.crt.pem', ],
  },
}

This could be translated more or less easily and directly to a bind line in haproxy.cfg. Of course this breaks backwards compatibility without some thoughtful array-to-hash-conversion-and-validation.

[esbjerg]

I like antaflos' solution. It provides the felixibility I need.

[KlavsKlavsen]

I agree with antaflos solution - it's actually even more flexible - and would mean I could go back to using upstream module (now that it supports haproxy 1.5 as well :)

[Spredzy]

Taking @antaflos remark in account this is how this new patch works :

To remain backward compatible, $ports will specify the defaults ports to bind to if port hasn't been specified in the ipaddress hash.

So taking the example :

haproxy::listen { 'apache00' :
  ipaddress => {
    '192.168.2.1'      => [],
    '10.0.0.1:8080'    => [],
    '178.35.67.12:443' => [ 'ssl', 'crt', 'foo.example.com.crt.pem', ],
  },
  ports => ['80','82'],
}

This would generate the following piece of haproxy configuration :

bind 192.168.2.1:80
bind 192.168.2.1:82 
bind 10.0.0.1:8080 
bind 178.35.67.12:443 ssl crl foo.example.com.crt.pem

Hope this meet everyone's needs. Any feedback is welcome

[hunner]

Could the indentation of this look more like the rest? (Newline after {, two space indent, } on it's own line after, and trailing commas on all hash pairs.)

[Spredzy]

Up

[hunner]

Could you line this up?

[hunner]

This has failures: https://travis-ci.org/puppetlabs/puppetlabs-haproxy/jobs/34728895