93 lines
2.7 KiB
YAML
93 lines
2.7 KiB
YAML
---
|
|
- name: Déploiement HAProxy (load-balancer)
|
|
hosts: load-balancer
|
|
become: true
|
|
gather_facts: true
|
|
|
|
vars:
|
|
haproxy_cert_dir: /etc/haproxy/certs
|
|
haproxy_cert_path: "{{ haproxy_cert_dir }}/{{ domain_name }}.pem"
|
|
local_cert_sync_dir: ../certs
|
|
|
|
tasks:
|
|
- name: Installer HAProxy
|
|
ansible.builtin.apt:
|
|
name: haproxy
|
|
state: present
|
|
update_cache: yes
|
|
|
|
- name: Créer le dossier des certificats HAProxy
|
|
ansible.builtin.file:
|
|
path: "{{ haproxy_cert_dir }}"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0750"
|
|
|
|
- name: Copier fullchain.pem et privkey.pem sur le load-balancer
|
|
ansible.builtin.copy:
|
|
src: "{{ local_cert_sync_dir }}/{{ item }}"
|
|
dest: "{{ haproxy_cert_dir }}/{{ item }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0640"
|
|
loop:
|
|
- fullchain.pem
|
|
- privkey.pem
|
|
notify: reload haproxy
|
|
|
|
- name: Construire le certificat combiné pour HAProxy (fullchain + privkey)
|
|
ansible.builtin.shell: >
|
|
cat {{ haproxy_cert_dir }}/fullchain.pem
|
|
{{ haproxy_cert_dir }}/privkey.pem
|
|
> {{ haproxy_cert_path }}
|
|
notify: reload haproxy
|
|
|
|
- name: Restreindre les permissions du certificat combiné
|
|
ansible.builtin.file:
|
|
path: "{{ haproxy_cert_path }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0640"
|
|
|
|
- name: Installer iptables-persistent
|
|
ansible.builtin.apt:
|
|
name: iptables-persistent
|
|
state: present
|
|
update_cache: yes
|
|
|
|
- name: Autoriser le port HTTPS (443) entrant
|
|
ansible.builtin.iptables:
|
|
chain: INPUT
|
|
protocol: tcp
|
|
destination_port: "443"
|
|
jump: ACCEPT
|
|
action: insert
|
|
comment: "haproxy: autorise HTTPS entrant"
|
|
|
|
- name: Sauvegarder les règles iptables (persistance au reboot)
|
|
ansible.builtin.command: netfilter-persistent save
|
|
changed_when: false
|
|
|
|
- name: Déployer la configuration HAProxy
|
|
ansible.builtin.template:
|
|
src: ../templates/haproxy.cfg.j2
|
|
dest: /etc/haproxy/haproxy.cfg
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
validate: haproxy -c -f %s
|
|
notify: reload haproxy
|
|
|
|
- name: Démarrer et activer HAProxy
|
|
ansible.builtin.systemd:
|
|
name: haproxy
|
|
state: started
|
|
enabled: yes
|
|
|
|
handlers:
|
|
- name: reload haproxy
|
|
ansible.builtin.systemd:
|
|
name: haproxy
|
|
state: reloaded
|