deveryware / ansible-haproxy

Installs and configures HAProxy

haproxy

Installs and configures HAProxy.

Versions

The current release is 1.5.0.

The next release is in development (Cf. the projects tab).

Features

• Supports CentOS and Debian (Ubuntu should work)
• Installs HAProxy from official repositories on Debian.
• Installs HAProxy from EPEL repository on CentOS.
• Tests via Molecule and Docker

Requirements

The python library jmespath is required on the control node.

Role Variables

• haproxy_global

  Global HAProxy settings.

• haproxy_defaults

  Default settings for frontends, backends, and listen proxies.

• haproxy_resolvers

  A list of HAProxy resolvers.

• haproxy_backends

  A list of HAProxy backends.

• haproxy_frontends

  A list of HAProxy frontends.

• haproxy_listen

  A list of listen proxies.

• haproxy_logforward

  A list of log-forward proxies (Only for HAProxy version 2.3 and above).

• haproxy_peers

  A list of peers.

See vars/main.yml for a complete list of configurable .

See the wiki for more details.

Example

- hosts: loadbalancers
  roles:
     - role: haproxy
       haproxy_frontends:
       - name: 'fe-mysupersite'
         ip: '123.123.123.120'
         port: '80'
         maxconn: '1000'
         default_backend: 'be-mysupersite'
       haproxy_backends:
       - name: 'be-mysupersite'
         description: 'mysupersite is really cool'
         servers:
           - name: 'be-mysupersite-01'
             ip: '192.168.1.100'
       log-forward:
          - name: 'my-syslog-lb'
            dgrambind:
              - '127.0.0.1:514' # Listen on UDP IPv4
            log:
              - ip: '192.168.1.101'
                port: 5514
                sample_range: "1:2"
                facility: "local0 info"
              - ip: '192.168.1.102'
                port: 5514
                sample_range: "3:4"
                facility: "local0 info"

Testing

To test the role you first need to install Molecule with :

$ pip install molecule docker

If you encounter a problem while installing with pip, install python-dev

To run the tests, execute :

$ molecule test

License

Apache v2

Author Information

This role was created in 2014 by Pheromone - Pierre Paul Lefebvre ([email protected]).

This role was forked in 2019 by Deveryware.

The contributors list

ansible-haproxy's Issues

Role not idempotent

Because of the way the config file is generated the role is not idempotent :

ERROR: Idempotence test failed because of the following tasks:
* [instance] => ansible-haproxy : Delete the compiled folder
* [instance] => ansible-haproxy : Create the compiled folder
* [instance] => ansible-haproxy : Build up the global config
* [instance] => ansible-haproxy : Build up the default config
* [instance] => ansible-haproxy : Assemble the resolvers sections configuration file
* [instance] => ansible-haproxy : Assemble the backends configuration file
* [instance] => ansible-haproxy : Assemble the frontends configuration file
* [instance] => ansible-haproxy : Assemble the listen sections configuration file
* [instance] => ansible-haproxy : Assemble the userlists sections configuration file

Using contimeout is deprecated

This option should be removed from the listen section.

http-request rule placed after a redirect

[WARNING] 101/162143 (14123) : parsing [/etc/haproxy/haproxy.cfg:<line>] : a 'http-request' rule placed after a 'redirect' rule will still be processed before.

The templates/global.cfg needs to be update to avoid this warning message.

Consolidate the various timeout

The way to configure a timeout is different in section resolvers and the others.

Use haproxy_config_dir in default config

The default configuration generated with defaults/main.yml does not use haproxy_config_dir, even if it is the very first defined variable in that file.

It is useful for simple installation to just override a few variables rather than rewriting the whole structure so more simple elements should be provided and used.

Upstream PR#121

Test and evaluate devops-coop/ansible-haproxy#121

Factorize complex structures

A lot of configuration elements are shared among sections listen, fronteds, backends and others but are copypasted in each file. They could instead be split in common files like _macro.j2.

Handle new systemd configuration

Since version 1.8, HAProxy does not support haproxy-systemd-wrapper (https://www.mail-archive.com/[email protected]/msg26250.html). The template for systemd unit file need to be adapted depending on the HAProxy version.

Ship error files

Some operating systems do not install haproxy error pages by default. This is addressed upstream with issue 82 and PR 104.

Documentation is lacking

In order to write a proper configuration for a moderately complex install I had to reverse-engineer the templates. Documentation for the various templates would be a plus.

I see separate wiki pages for defaults, frontend, global, listen, resolvers and userlist as good vessels.

What do you think?

Error during configuration assembling with default value

With the default configuration, the role fail at the task :
Assemble the final configuration file
with the message
failed to validate: rc:2 error:

It is due to Haproxy exiting with error code 2 when there's no listener even when the config file has no error

Configuration file has no error but will not start (no listener) => exit(2).