Feature/new loadbalancer playbook

deploy_loadbalancers_playbook.yml

@@ -1 +1,28 @@
----
+---
+- name: Read secrets
+  hosts: loadbalancer
+  become: true
+  tasks:
+    - name: Read vars from secrets file
+      ansible.builtin.include_vars: "{{ inventory_dir }}/secrets/secrets.yml"
+      no_log: true
+      tags:
+        - always
+
+- name: Deploy haproxy
+  hosts: loadbalancer
+  gather_facts: true
+  become: true
+  roles:
+    - role: haproxy
+      tags: ['core', 'loadbalancer', 'lb']
+
+- name: Deploy keepalived and bind for clustered loadbalancers
+  hosts: loadbalancer_ha
+  gather_facts: true
+  become: true
+  roles:
+    - role: keepalived
+      tags: ['core', 'loadbalancer_ha', 'keepalived']
+    - role: bind
+      tags: ['core', 'loadbalancer_ha', 'bind']

environments/template/group_vars/template.yml

@@ -1,4 +1,5 @@
 ---
+
 env: "%env%"
 mariadb_host: localhost
 rsyslog_host: localhost

environments/template/inventory

@@ -55,6 +55,19 @@ dbcluster_nodes
 localhost ansible_connection=local
 
 # for refactored playbooks
+
+[%location%:children] # create one or more groups here for your chosen location(s)
+storage
+mongo_servers
+sysloghost
+loadbalancer_ha
+loadbalancer
+lifecycle
+dbcluster
+dbcluster_nodes
+stats
+docker_servers
+
 [base:children]
 docker_servers
 

inc_test_loadbalancer_tasklist.yml

@@ -0,0 +1,39 @@
+---
+# playbook loops over:
+# loadbalancers
+#     haproxy_applications (item)
+#
+# and does an url request on lodbalancer ip with vhostname as the host header
+
+- name: Try to reach {{ item.vhost_name }} via https://{{ haproxy_sni_ip_restricted.ipv4 }}:443 # noqa: name[template] jinja template helps with debugging
+  when: item.restricted is defined and item.restricted
+  ansible.builtin.uri:
+    url: "https://{{ haproxy_sni_ip_restricted.ipv4 }}:443/{{ item.ha_url }}"
+    method: GET
+    status_code: [200, 302]
+    return_content: false
+    validate_certs: false
+    headers:
+      host: "{{ item.vhost_name }}"
+  register: result
+  until: result.status == 200 or result.status == 302
+  retries: 3
+  delay: 2
+  delegate_to: 127.0.0.1 # run check from deploy host
+
+# Try to reach applications via loadbalancer without restricted ip v4
+- name: Try to reach {{ item.vhost_name }} via https://{{ haproxy_sni_ip.ipv4 }}:443 # noqa: name[template] jinja template helps with debugging
+  when: item.restricted is undefined
+  ansible.builtin.uri:
+    url: "https://{{ haproxy_sni_ip.ipv4 }}:443/{{ item.ha_url }}"
+    method: GET
+    status_code: [200, 302]
+    return_content: false
+    validate_certs: false
+    headers:
+      host: "{{ item.vhost_name }}"
+  register: result
+  until: result.status == 200 or result.status == 302
+  retries: 3
+  delay: 2
+  delegate_to: 127.0.0.1 #run check from deploy host

roles/haproxy/tasks/main.yml

@@ -4,6 +4,7 @@
     url: "https://haproxy.debian.net/bernat.debian.org.gpg"
     dest: "/etc/apt/trusted.gpg.d/haproxy.asc"
     mode: '0644'
+  when: not ansible_check_mode # task reports change in check mode when there is none
 
 - name: Add HAProxy repository to sources list
   ansible.builtin.copy:

test_loadbalancers_playbook.yml

@@ -0,0 +1,17 @@
+---
+- name: Test loadbalancer
+  hosts: loadbalancer
+  gather_facts: false
+  become: false
+  tasks:
+
+    - name: Read vars from secrets file
+      ansible.builtin.include_vars: "{{ inventory_dir }}/secrets/secrets.yml"
+      no_log: true
+      tags:
+        - always
+
+    - name: Include task list in play
+      ansible.builtin.include_tasks:
+        file: inc_test_loadbalancer_tasklist.yml
+      with_items: "{{ haproxy_applications }}"