Merge pull request #475 from OpenConext/feature/acme-harica

ACME/loadbalancer fixes.

Author: baszoetekouw

provision.yml

@@ -30,15 +30,15 @@
   become: true
   roles:
     - role: haproxy
-      tags: ['core', 'loadbalancer', 'lb']
+      tags: ['core', 'loadbalancer_ha', 'loadbalancer', 'lb']
     - role: keepalived
       when:
-        - inventory_hostname in groups['loadbalancer_ha']
-      tags: ['core', 'loadbalancer', 'keepalived']
+        - "'loadbalancer_ha' in groups and inventory_hostname in groups['loadbalancer_ha']"
+      tags: ['core', 'loadbalancer_ha', 'keepalived']
     - role: bind
       when:
-        - inventory_hostname in groups['loadbalancer_ha']
-      tags: ['core', 'loadbalancer', 'bind']
+        - "'loadbalancer_ha' in groups and inventory_hostname in groups['loadbalancer_ha']"
+      tags: ['core', 'loadbalancer_ha', 'bind']
 
 - hosts: db_mysql
   gather_facts: no

roles/haproxy/tasks/get_acme_certs.yml

@@ -22,79 +22,83 @@
   check_mode: false  # this is safe run run, even in check mode
   run_once: true
 
-- name: Issue the certificates using acme
-  ansible.builtin.command:
-    cmd: |
-      /home/acme/.acme.sh/acme.sh
-        --issue
-        --ecc
-        --keylength ec-384
-        --days "{{ haproxy_acme_renewal_days }}"
-        --dns dns_acmedns
-        --stateless
-        --dnssleep 3
-        --server "{{ haproxy_acme_server }}"
-        --domain "{{ item }}"
-  environment:
-    ACMEDNS_BASE_URL: "{{ haproxy_acmedns.baseurl }}"
-    ACMEDNS_USERNAME: "{{ haproxy_acmedns.username }}"
-    ACMEDNS_PASSWORD: "{{ haproxy_acmedns.password }}"
-    ACMEDNS_SUBDOMAIN: "{{ haproxy_acmedns.subdomain }}"
-  loop: "{{ haproxy_ssl_hosts }}"
-  register: "acme_issue"
-  changed_when: "acme_issue.rc == 0"
-  failed_when: 'acme_issue.rc != 0 and acme_issue.rc != 2'
-  become_user: "acme"
-  become: true
+- name: Update certificates on one host at a time
+  throttle: 1
+  block:
+    - name: Issue the certificates using acme
+      ansible.builtin.command:
+        cmd: |
+          /home/acme/.acme.sh/acme.sh
+            --issue
+            --ecc
+            --keylength ec-384
+            --days "{{ haproxy_acme_renewal_days }}"
+            --dns dns_acmedns
+            --stateless
+            --dnssleep 3
+            --server "{{ haproxy_acme_server }}"
+            --domain "{{ item }}"
+      environment:
+        ACMEDNS_BASE_URL: "{{ haproxy_acmedns.baseurl }}"
+        ACMEDNS_USERNAME: "{{ haproxy_acmedns.username }}"
+        ACMEDNS_PASSWORD: "{{ haproxy_acmedns.password }}"
+        ACMEDNS_SUBDOMAIN: "{{ haproxy_acmedns.subdomain }}"
+      loop: "{{ haproxy_ssl_hosts }}"
+      throttle: 1
+      register: "acme_issue"
+      changed_when: "acme_issue.rc == 0"
+      failed_when: 'acme_issue.rc != 0 and acme_issue.rc != 2'
+      become_user: "acme"
+      become: true
 
-# Now deploy the certificates to haproxy
-# We do this in two steps:
-# 1. Cold-deploy the certificates to haproxy's certs directory
-# 2. Make sure haproxy is started, and hot-deploy the certificates to haproxy though the socket API
+    # Now deploy the certificates to haproxy
+    # We do this in two steps:
+    # 1. Cold-deploy the certificates to haproxy's certs directory
+    # 2. Make sure haproxy is started, and hot-deploy the certificates to haproxy though the socket API
 
-- name: Cold-deploy the certificates to haproxy  # noqa: no-handler
-  ansible.builtin.command:
-    cmd: |
-      /home/acme/.acme.sh/acme.sh
-        --deploy
-        --deploy-hook haproxy
-        --domain "{{ item }}"
-  environment:
-    DEPLOY_HAPROXY_PEM_PATH: "/etc/haproxy/certs"
-  loop: "{{ haproxy_ssl_hosts }}"
-  register: "result"
-  changed_when: "result.rc == 0"
-  when: "acme_issue.changed"
-  become_user: "acme"
-  become: true
+    - name: Cold-deploy the certificates to haproxy  # noqa: no-handler
+      ansible.builtin.command:
+        cmd: |
+          /home/acme/.acme.sh/acme.sh
+            --deploy
+            --deploy-hook haproxy
+            --domain "{{ item }}"
+      environment:
+        DEPLOY_HAPROXY_PEM_PATH: "/etc/haproxy/certs"
+      loop: "{{ haproxy_ssl_hosts }}"
+      register: "result"
+      changed_when: "result.rc == 0"
+      when: "acme_issue.changed"
+      become_user: "acme"
+      become: true
 
-- name: Start and enable haproxy
-  ansible.builtin.service:
-    name: "haproxy"
-    state: "started"
-    enabled: true
+    - name: Start and enable haproxy
+      ansible.builtin.service:
+        name: "haproxy"
+        state: "started"
+        enabled: true
 
-- name: Wait for port 443 to become open  # noqa: no-handler
-  ansible.builtin.wait_for:
-    port: 443
-    delay: 5
-    host: "{{ haproxy_sni_ip.ipv4 }}"
-  when: "acme_issue.changed"
+    - name: Wait for port 443 to become open  # noqa: no-handler
+      ansible.builtin.wait_for:
+        port: 443
+        delay: 5
+        host: "{{ haproxy_sni_ip.ipv4 }}"
+      when: "acme_issue.changed"
 
-- name: Hot-deploy the certificates to haproxy  # noqa: no-handler
-  ansible.builtin.command:
-    cmd: |
-      /home/acme/.acme.sh/acme.sh
-        --deploy
-        --deploy-hook haproxy
-        --domain "{{ item }}"
-  environment:
-    DEPLOY_HAPROXY_HOT_UPDATE: "yes"
-    DEPLOY_HAPROXY_STATS_SOCKET: "/var/lib/haproxy/haproxy.stats"
-    DEPLOY_HAPROXY_PEM_PATH: "/etc/haproxy/certs"
-  loop: "{{ haproxy_ssl_hosts }}"
-  when: "acme_issue.changed"
-  register: "result"
-  changed_when: "result.changed"
-  become_user: "acme"
-  become: true
+    - name: Hot-deploy the certificates to haproxy  # noqa: no-handler
+      ansible.builtin.command:
+        cmd: |
+          /home/acme/.acme.sh/acme.sh
+            --deploy
+            --deploy-hook haproxy
+            --domain "{{ item }}"
+      environment:
+        DEPLOY_HAPROXY_HOT_UPDATE: "yes"
+        DEPLOY_HAPROXY_STATS_SOCKET: "/var/lib/haproxy/haproxy.stats"
+        DEPLOY_HAPROXY_PEM_PATH: "/etc/haproxy/certs"
+      loop: "{{ haproxy_ssl_hosts }}"
+      when: "acme_issue.changed"
+      register: "result"
+      changed_when: "result.changed"
+      become_user: "acme"
+      become: true

roles/haproxy/tasks/main.yml

@@ -36,6 +36,7 @@
   ansible.builtin.include_tasks: get_acme_certs.yml
   when: haproxy_acme | bool
 
+
 - name: Check if we need to load additional certificates for migration
   ansible.builtin.find:
     paths: "/etc/haproxy/certs"