roles/hashistack_ingress/.docsible

@@ -1,13 +0,0 @@
-aap_hub: null
-automation_kind: null
-category: null
-critical: null
-description: null
-dt_dev: null
-dt_prod: null
-dt_update: 26/08/2024
-requester: null
-subCategory: null
-time_saving: null
-users: null
-version: null

roles/hashistack_ingress/README.md

@@ -1,52 +0,0 @@
-<!-- DOCSIBLE START -->
-
-# 📃 Role overview
-
-## hashistack_ingress
-
-
-
-Description: Deploys an ingress reverse-proxy on a hashistack-ansible managed nomad cluster
-
-
-| Field         | Value      |
-|---------------|------------|
-| Readme update | 26/08/2024 |
-
-
-
-
-
-
-
-
-
-
-
-
-### Tasks
-
-
-
-
-
-
-
-
-## Author Information
-Bertrand Lanson
-
-#### License
-
-license (BSD, MIT)
-
-#### Minimum Ansible Version
-
-2.10
-
-#### Platforms
-
-- **Ubuntu**: ['focal', 'jammy', 'noble']
-- **Debian**: ['bullseye', 'bookworm']
-
-<!-- DOCSIBLE END -->

roles/hashistack_ingress/defaults/main.yml

@@ -1,45 +0,0 @@
----
-# defaults file for hashistack_ingress
-hashistack_ingress_nomad_api_addr: "http://127.0.0.1:4646"
-hashistack_ingress_nomad_api_token:
-
-hashistack_ingress_job_name: HashistackHAProxyIngress
-hashistack_ingress_datacenters: []
-hashistack_ingress_namespace: default
-hashistack_ingress_replicas: 1
-hashistack_ingress_enable_consul_service: true
-
-hashistack_ingress_virtual_ip_keepalived_version: latest
-hashistack_ingress_virtual_ip_addr: "192.168.1.1"
-hashistack_ingress_virtual_ip_interface: eth0
-hashistack_ingress_virtual_ip_vrrp_interface: "{{ hashistack_ingress_virtual_ip_interface }}"
-hashistack_ingress_virtual_ip_vrrp_router_id: 50
-hashistack_ingress_virtual_ip_vrrp_priority: 100
-hashistack_ingress_virtual_ip_vrrp_advertise_interval: 1
-hashistack_ingress_virtual_ip_vrrp_password: password
-
-hashistack_ingress_enable_http: true
-hashistack_ingress_enable_https: false
-hashistack_ingress_enable_prometheus_metrics: false
-hashistack_ingress_enable_admin_interface: false
-hashistack_ingress_admin_interface_password: password
-
-hashistack_ingress_virtual_ip_haproxy_version: latest
-hashistack_ingress_haproxy_global:
-  - log /dev/log local0
-  - log /dev/log local1 notice
-  - stats socket {{ deploy_haproxy_socket }} level admin
-  - chroot {{ deploy_haproxy_chroot }}
-  - daemon
-  - description hashistack haproxy
-hashistack_ingress_haproxy_defaults:
-  - log global
-  - mode http
-  - option httplog
-  - option dontlognull
-  - timeout connect 5000
-  - timeout client  5000
-  - timeout server  5000
-hashistack_ingress_haproxy_frontends: []
-hashistack_ingress_haproxy_backends: []
-hashistack_ingress_haproxy_listen: []

roles/hashistack_ingress/handlers/main.yml

@@ -1,2 +0,0 @@
----
-# handlers file for hashistack_ingress

roles/hashistack_ingress/meta/main.yml

@@ -1,28 +0,0 @@
----
-# meta file for hashistack_ingress
-galaxy_info:
-  namespace: "ednz_cloud"
-  role_name: "hashistack_ingress"
-  author: "Bertrand Lanson"
-  description: "Deploys an ingress reverse-proxy on a hashistack-ansible managed nomad cluster"
-  license: "license (BSD, MIT)"
-  min_ansible_version: "2.10"
-  platforms:
-    - name: Ubuntu
-      versions:
-        - focal
-        - jammy
-        - noble
-    - name: Debian
-      versions:
-        - bullseye
-        - bookworm
-  galaxy_tags:
-    - "ubuntu"
-    - "debian"
-    - "hashicorp"
-    - "nomad"
-    - "haproxy"
-    - "ingress"
-
-dependencies: []

roles/hashistack_ingress/tasks/main.yml

@@ -1,2 +0,0 @@
----
-# task/main file for hashistack_ingress

roles/hashistack_ingress/templates/chk_haproxy.sh.j2

@@ -1 +0,0 @@
-#! /bin/sh

roles/hashistack_ingress/templates/haproxy.cfg.j2

@@ -1,31 +0,0 @@
-# {{ ansible_managed }}
-global
-{% for option in hashistack_ingress_haproxy_global %}
-  {{ option }}
-{% endfor %}
-
-defaults
-{% for option in hashistack_ingress_haproxy_defaults %}
-  {{ option }}
-{% endfor %}
-
-{% for frontend in hashistack_ingress_haproxy_frontends + hashistack_ingress_mandatory_frontends %}
-frontend {{ frontend.name }}
-{% for option in frontend.options %}
-  {{ option }}
-{% endfor %}
-{% endfor %}
-
-{% for backend in hashistack_ingress_haproxy_backends %}
-backend {{ backend.name }}
-{% for option in backend.options%}
-  {{ option }}
-{% endfor %}
-{% endfor %}
-
-{% for listen in hashistack_ingress_haproxy_listen %}
-listen {{ listen.name }}
-{% for option in listen.options %}
-  {{ option }}
-{% endfor %}
-{% endfor %}

roles/hashistack_ingress/templates/ingress.job.hcl.j2

@@ -1,155 +0,0 @@
-job "{{ hashistack_ingress_job_name }}" {
-  datacenters = {{ hashistack_ingress_datacenters }}
-  type        = "service"
-  priority    = 85
-  namespace   = {{ hashistack_ingress_namespace }}
-
-  group "haproxy" {
-    network {
-      mode = "bridge"
-      port "http" {
-        to     = 80
-        static = 80
-      }
-      port "https" {
-        to     = 443
-        static = 443
-      }
-      port "stats" {
-        to     = 9000
-      }
-    }
-
-{% if hashistack_ingress_enable_http %}
-    service {
-      name = "haproxy-http"
-      provider = "{{ "consul" if hashistack_ingress_enable_consul_service else "nomad"}}"
-      port = "http"
-      task = "loadbalancer"
-      check {
-        type     = "http"
-        port     = "stats"
-        path     = "/health"
-        interval = "10s"
-        timeout  = "2s"
-      }
-      tags = []
-    }
-{% endif %}
-
-{% if hashistack_ingress_enable_https %}
-    service {
-      name = "haproxy-https"
-      provider = "{{ "consul" if hashistack_ingress_enable_consul_service else "nomad"}}"
-      port = "https"
-      task = "loadbalancer"
-      check {
-        type     = "http"
-        port     = "stats"
-        path     = "/health"
-        interval = "10s"
-        timeout  = "2s"
-      }
-      tags = []
-    }
-{% endif %}
-
-    service {
-      name = "haproxy-stats"
-      provider = "{{ "consul" if hashistack_ingress_enable_consul_service else "nomad"}}"
-      port = "stats"
-      task = "loadbalancer"
-      check {
-        type     = "http"
-        port     = "stats"
-        path     = "/health"
-        interval = "10s"
-        timeout  = "2s"
-      }
-      tags = []
-    }
-
-
-
-{% if hashistack_ingress_enable_prometheus_metrics %}
-    service {
-      name = "loadbalancer-exporter"
-      port = "prometheus-exporter"
-      task = "loadbalancer"
-      tags = []
-    }
-{% endif %}
-
-    task "keepalived" {
-      driver = "docker"
-      lifecycle {
-        hook    = "poststart"
-        sidecar = true
-      }
-      config {
-        image        = "{{ hashistack_ingress_keepalived_image }}:{{ hashistack_ingress_virtual_ip_keepalived_version }}"
-        network_mode = "host"
-        cap_add = [
-          "NET_ADMIN",
-          "NET_BROADCAST",
-          "NET_RAW"
-        ]
-        mount {
-          type   = "bind"
-          source = "secrets/keepalived.conf"
-          target = "/etc/keepalived/keepalived.conf"
-        }
-        mount {
-          type   = "bind"
-          source = "secrets/chk_haproxy.sh"
-          target = "/etc/keepalived/scripts.d/chk_haproxy.sh"
-        }
-        mount {
-          type   = "bind"
-          target = "/var/run/docker.sock"
-          source = "/var/run/docker.sock"
-          readonly = true
-        }
-      }
-      template {
-        data        = <<-EOT
-{% include "keepalived.conf.j2" %}
-EOT
-        destination = "secrets/keepalived.conf"
-      }
-      template {
-        data        = <<-EOT
-{% include "chk_haproxy.sh.j2" %}
-EOT
-        destination = "secrets/chk_haproxy.sh"
-        perms = "755"
-      }
-      resources {
-        cpu    = 50
-        memory = 10
-      }
-    }
-
-    task "loadbalancer" {
-      driver = "docker"
-      config {
-        image = "{{ hashistack_ingress_haproxy_image }}:{{ hashistack_ingress_virtual_ip_haproxy_version }}"
-        mount {
-          type   = "bind"
-          source = "secrets/haproxy.cfg"
-          target = "/usr/local/etc/haproxy/haproxy.cfg"
-        }
-      }
-      template {
-        data        = <<-EOT
-{% include "haproxy.cfg.j2" %}
-EOT
-        destination = "secrets/haproxy.cfg"
-      }
-      resources {
-        cpu    = 128
-        memory = 256
-      }
-    }
-  }
-}

roles/hashistack_ingress/templates/keepalived.conf.j2

@@ -1,37 +0,0 @@
-global_defs {
-  script_user root
-  enable_script_security
-}
-
-vrrp_script chk_haproxy {
-  script "/etc/keepalived/scripts.d/chk_haproxy.sh"
-  user root
-  interval 3
-  weight 0
-  rise 6
-  fall 1
-}
-
-vrrp_instance haproxy {
-  interface {{ hashistack_ingress_virtual_ip_vrrp_interface }}
-
-  state {{ hashistack_ingress_keepalived_init_state }}
-  virtual_router_id {{ hashistack_ingress_virtual_ip_vrrp_router_id }}
-  priority {{ hashistack_ingress_virtual_ip_vrrp_priority }}
-  advert_int {{ hashistack_ingress_virtual_ip_vrrp_advertise_interval }}
-
-  authentication {
-    auth_type PASS
-    auth_pass {{ hashistack_ingress_virtual_ip_vrrp_password }}
-  }
-
-  virtual_ipaddress {
-    {{ hashistack_ingress_virtual_ip_addr }}/32 dev {{ hashistack_ingress_virtual_ip_interface }}
-  }
-
-  track_script {
-    chk_haproxy
-  }
-
-  notify /etc/keepalived/scripts.d/notify.sh
-}

roles/hashistack_ingress/vars/main.yml

@@ -1,28 +0,0 @@
----
-# vars file for hashistack_ingress
-hashistack_ingress_keepalived_image: ednxzu/keepalived
-hashistack_ingress_haproxy_image: haproxytech/haproxy-debian
-
-hashistack_ingress_keepalived_init_state: BACKUP
-
-hashistack_ingress_template_haproxy_cfg: "{{ lookup('ansible.builtin.template', 'haproxy.cfg.j2') }}"
-hashistack_ingress_template_keepalived_conf: "{{ lookup('ansible.builtin.template', 'keepalived.conf.j2') }}"
-hashistack_ingress_template_chk_haproxy_sh: "{{ lookup('ansible.builtin.template', 'chk_haproxy.sh.j2') }}"
-
-hashistack_ingress_mandatory_frontends:
-  - name: monitoring
-    options:
-      - bind :9000
-      - mode http
-      - option httpchk
-      - "{{'stats enable' if hashistack_ingress_enable_admin_interface else omit }}"
-      - "{{'stats uri /stats' if hashistack_ingress_enable_admin_interface else omit }}"
-      - "{{'stats refresh 30s' if hashistack_ingress_enable_admin_interface else omit }}"
-      - "{{'stats show-desc' if hashistack_ingress_enable_admin_interface else omit }}"
-      - "{{'stats show-legends' if hashistack_ingress_enable_admin_interface else omit }}"
-      - "{{'stats auth admin:'~hashistack_ingress_admin_interface_password if hashistack_ingress_enable_admin_interface else omit }}"
-      - http-check send meth GET uri /health ver HTTP/1.1 hdr Host localhost
-      - http-check expect status 200
-      - acl health_check_ok nbsrv() ge 1
-      - monitor-uri /health
-      - "{{'http-request use-service prometheus-exporter if { path /metrics }' if hashistack_ingress_enable_prometheus_metrics else omit }}"