confdroid/confdroid_haproxy
1
0
Fork 0
Code Issues Actions Packages Projects Releases Wiki Activity

Compare commits

base: confdroid:master
Branches Tags
confdroid:master
confdroid:1.1.0 confdroid:1.0.0
..
compare: confdroid:19df6fdca063352e12c76f699e3e2dd740d7664b
Branches Tags
confdroid:master
confdroid:1.1.0 confdroid:1.0.0

1 Commits
master ... 19df6fdca0

Author SHA1 Message Date
Jenkins Server
19df6fdca0 Recommit for updates in build 4 2026-09-05 12:54:06 +02:00
14 changed files with 51 additions and 464 deletions
Expand all files Collapse all files

40
README.md
View File

@@ -1,8 +1,6 @@
# Readme
[![Build Status](https://jenkins.confdroid.com/buildStatus/icon?job=confdroid_haproxy&style=plastic)](https://jenkins.confdroid.com/job/confdroid_haproxy/)
[![Security Hotspots](https://sonarqube.confdroid.com/api/project_badges/measure?project=confdroid_haproxy&metric=security_hotspots&token=sqb_0205ee61c907f77ebdc1c717b8f4ff568c3724cf)](https://sonarqube.confdroid.com/dashboard?id=confdroid_haproxy)
[![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/grizzlycoda/puppet_collection)
- [Readme](#readme)
- [Synopsis](#synopsis)
@@ -12,7 +10,6 @@
- [Deployment](#deployment)
- [Parameters](#parameters)
- [Proxy Configuration](#proxy-configuration)
- [TLS](#tls)
- [SELINUX](#selinux)
- [Known Problems](#known-problems)
- [Support](#support)
@@ -45,20 +42,18 @@ CONFIGURATION
- front-end options
- back-end options
- ACL options
- adds haproxy logs to rsyslog for remote logging where used
- manage fail2ban integration (optional, requires `confdroid_fail2ban` module)
- manage nagios integration (optional, requires `confdroid-nagios` module)
- manage fail2ban integration (optional, requires fail2ban_cd module)
SERVICE
- manage haproxy service
- restart service after changes in the configuration
- stats are enabled on port 8404 with uri /haproxy?stats and strict private mode, set `hy_stats_auth` to something meaningful.
## Dependencies
All dependencies must be included in the catalogue.
- [cd_resources](https://gitlab.confdroid.com/puppet/cd_resources) for managing yum base repos
- [concat](https://github.com/puppetlabs/puppetlabs-concat) for managing file fragments
## Deployment
@@ -88,8 +83,6 @@ The parameters are documented via puppet strings and [listed here](/docs/index.h
The proxy instances are configured in /etc/haproxy/haproxy.cfg, which is concatenated from various templates through a define in this puppet module.
In order to create proxy instances, you will need an external class, which addresses the define, like so:
ACL rule:
```bash
confdroid_haproxy::server::proxy { 'testing':
haproxy_fqdn => 'node.example.net',
@@ -101,41 +94,14 @@ ACL rule:
}
```
real Proxy for https:
```bash
haproxy_cd::server::proxy { 'https-in':
haproxy_fqdn => 'node.example.net',
frontend_name => 'https-in',
frontend_mode => 'http',
fe_bind_mode => '*:443 ssl crt /etc/haproxy/certs/',
fe_option => 'forwardfor',
fe_http_request => 'add-header X-Forwarded-Proto https',
acl_rule_front => 'host_grafana hdr(host) -i grafana.example.net',
fe_use_backend => 'grafana_backend if host_grafana',
backend_configs => [
{
'backend_name' => 'grafana_backend',
'be_mode' => 'http',
'be_balance' => 'roundrobin',
'be_server_name_array' => ['node1 10.0.1.1:8080 check'],
}
]
default_backend => 'error_backend',
```
This allows the puppet module to create the sections in the configuration file as required. The haproxy service will be restarted after the changes in the configuration file are made.
`haproxy_fqdn` **must**- contain the fqdn of the haproxy **server**- where this should be configured, otherwise the templates are not being populated.
Multiple ACLs need to be added as array, and will create one line each.
## TLS
Haproxy can manage all sorts of proxies including http and https. It also can terminate https requests and send the requests within a private network unencrypted, which is quite common. **This module is NOT managing certificates**, as there are many ways to manage this, including Kubernetes cert-manager, Let's encrypt or other ways.
## SELINUX
All files and directories are configured with correct selinux context. If selinux is disabled, these contexts are ignored.
If selinux is set to `enforce` (not controlled within this module), the parameter `hy_selinux_allow_stats` must also be set to `true`, else the haproxy service will not start as selinux will not allow it. This is the default setting.
If selinux is set to `enforce` (not controlled within this module) and `hy_show_stats`is set to `true`, the parameter `hy_selinux_allow_stats` must also be set to `true`, else the haproxy service will not start as selinux will not allow it.
## Known Problems

5
doc/_index.html
View File

@@ -108,11 +108,6 @@
</li>
<li>
<span class='object_link'><a href="puppet_classes/confdroid_haproxy_3A_3Amonitoring_3A_3Atarget.html" title="puppet_classes::confdroid_haproxy::monitoring::target (puppet_class)">confdroid_haproxy::monitoring::target</a></span>
</li>
<li>
<span class='object_link'><a href="puppet_classes/confdroid_haproxy_3A_3Aparams.html" title="puppet_classes::confdroid_haproxy::params (puppet_class)">confdroid_haproxy::params</a></span>

44
doc/file.README.html
View File

@@ -60,7 +60,7 @@
<div id="content"><div id='filecontents'>
<h1 id="label-Readme">Readme</h1>
<p><a href="https://jenkins.confdroid.com/job/confdroid_haproxy/"><img src="https://jenkins.confdroid.com/buildStatus/icon?job=confdroid_haproxy&amp;style=plastic"></a> <a href="https://sonarqube.confdroid.com/dashboard?id=confdroid_haproxy"><img src="https://sonarqube.confdroid.com/api/project_badges/measure?project=confdroid_haproxy&amp;metric=security_hotspots&amp;token=sqb_0205ee61c907f77ebdc1c717b8f4ff568c3724cf"></a> <a href="https://deepwiki.com/grizzlycoda/puppet_collection"><img src="https://deepwiki.com/badge.svg"></a></p>
<p><a href="https://jenkins.confdroid.com/job/confdroid_haproxy/"><img src="https://jenkins.confdroid.com/buildStatus/icon?job=confdroid_haproxy&amp;style=plastic"></a></p>
<ul><li>
<p><a href="#readme">Readme</a></p>
</li><li>
@@ -78,8 +78,6 @@
</li><li>
<p><a href="#proxy-configuration">Proxy Configuration</a></p>
</li><li>
<p><a href="#tls">TLS</a></p>
</li><li>
<p><a href="#selinux">SELINUX</a></p>
</li><li>
<p><a href="#known-problems">Known Problems</a></p>
@@ -128,11 +126,7 @@
</li><li>
<p>ACL options</p>
</li><li>
<p>adds haproxy logs to rsyslog for remote logging where used</p>
</li><li>
<p>manage fail2ban integration (optional, requires <code>confdroid_fail2ban</code> module)</p>
</li><li>
<p>manage nagios integration (optional, requires <code>confdroid-nagios</code> module)</p>
<p>manage fail2ban integration (optional, requires fail2ban_cd module)</p>
</li></ul>
<p>SERVICE</p>
@@ -140,14 +134,14 @@
<p>manage haproxy service</p>
</li><li>
<p>restart service after changes in the configuration</p>
</li><li>
<p>stats are enabled on port 8404 with uri /haproxy?stats and strict private mode, set <code>hy_stats_auth</code> to something meaningful.</p>
</li></ul>
<h2 id="label-Dependencies">Dependencies</h2>
<p>All dependencies must be included in the catalogue.</p>
<ul><li>
<p><a href="https://gitlab.confdroid.com/puppet/cd_resources">cd_resources</a> for managing yum base repos</p>
</li><li>
<p><a href="https://github.com/puppetlabs/puppetlabs-concat">concat</a> for managing file fragments</p>
</li></ul>
@@ -178,8 +172,6 @@
<p>The proxy instances are configured in /etc/haproxy/haproxy.cfg, which is concatenated from various templates through a define in this puppet module. In order to create proxy instances, you will need an external class, which addresses the define, like so:</p>
<p>ACL rule:</p>
<pre class="code ruby"><code class="ruby">confdroid_haproxy::server::proxy { &#39;testing&#39;:
haproxy_fqdn =&gt; &#39;node.example.net&#39;,
frontend_name =&gt; &#39;test01-frontend&#39;,
@@ -190,37 +182,11 @@
}
</code></pre>
<p>real Proxy for https:</p>
<pre class="code ruby"><code class="ruby">haproxy_cd::server::proxy { &#39;https-in&#39;:
haproxy_fqdn =&gt; &#39;node.example.net&#39;,
frontend_name =&gt; &#39;https-in&#39;,
frontend_mode =&gt; &#39;http&#39;,
fe_bind_mode =&gt; &#39;*:443 ssl crt /etc/haproxy/certs/&#39;,
fe_option =&gt; &#39;forwardfor&#39;,
fe_http_request =&gt; &#39;add-header X-Forwarded-Proto https&#39;,
acl_rule_front =&gt; &#39;host_grafana hdr(host) -i grafana.example.net&#39;,
fe_use_backend =&gt; &#39;grafana_backend if host_grafana&#39;,
backend_configs =&gt; [
{
&#39;backend_name&#39; =&gt; &#39;grafana_backend&#39;,
&#39;be_mode&#39; =&gt; &#39;http&#39;,
&#39;be_balance&#39; =&gt; &#39;roundrobin&#39;,
&#39;be_server_name_array&#39; =&gt; [&#39;node1 10.0.1.1:8080 check&#39;],
}
]
default_backend =&gt; &#39;error_backend&#39;,
</code></pre>
<p>This allows the puppet module to create the sections in the configuration file as required. The haproxy service will be restarted after the changes in the configuration file are made. <code>haproxy_fqdn</code> <strong>must</strong>- contain the fqdn of the haproxy <strong>server</strong>- where this should be configured, otherwise the templates are not being populated. Multiple ACLs need to be added as array, and will create one line each.</p>
<h2 id="label-TLS">TLS</h2>
<p>Haproxy can manage all sorts of proxies including http and https. It also can terminate https requests and send the requests within a private network unencrypted, which is quite common. <strong>This module is NOT managing certificates</strong>, as there are many ways to manage this, including Kubernetes cert-manager, Let’s encrypt or other ways.</p>
<h2 id="label-SELINUX">SELINUX</h2>
<p>All files and directories are configured with correct selinux context. If selinux is disabled, these contexts are ignored. If selinux is set to <code>enforce</code> (not controlled within this module), the parameter <code>hy_selinux_allow_stats</code> must also be set to <code>true</code>, else the haproxy service will not start as selinux will not allow it. This is the default setting.</p>
<p>All files and directories are configured with correct selinux context. If selinux is disabled, these contexts are ignored. If selinux is set to <code>enforce</code> (not controlled within this module) and <code>hy_show_stats</code>is set to <code>true</code>, the parameter <code>hy_selinux_allow_stats</code> must also be set to <code>true</code>, else the haproxy service will not start as selinux will not allow it.</p>
<h2 id="label-Known+Problems">Known Problems</h2>

44
doc/index.html
View File

@@ -60,7 +60,7 @@
<div id="content"><div id='filecontents'>
<h1 id="label-Readme">Readme</h1>
<p><a href="https://jenkins.confdroid.com/job/confdroid_haproxy/"><img src="https://jenkins.confdroid.com/buildStatus/icon?job=confdroid_haproxy&amp;style=plastic"></a> <a href="https://sonarqube.confdroid.com/dashboard?id=confdroid_haproxy"><img src="https://sonarqube.confdroid.com/api/project_badges/measure?project=confdroid_haproxy&amp;metric=security_hotspots&amp;token=sqb_0205ee61c907f77ebdc1c717b8f4ff568c3724cf"></a> <a href="https://deepwiki.com/grizzlycoda/puppet_collection"><img src="https://deepwiki.com/badge.svg"></a></p>
<p><a href="https://jenkins.confdroid.com/job/confdroid_haproxy/"><img src="https://jenkins.confdroid.com/buildStatus/icon?job=confdroid_haproxy&amp;style=plastic"></a></p>
<ul><li>
<p><a href="#readme">Readme</a></p>
</li><li>
@@ -78,8 +78,6 @@
</li><li>
<p><a href="#proxy-configuration">Proxy Configuration</a></p>
</li><li>
<p><a href="#tls">TLS</a></p>
</li><li>
<p><a href="#selinux">SELINUX</a></p>
</li><li>
<p><a href="#known-problems">Known Problems</a></p>
@@ -128,11 +126,7 @@
</li><li>
<p>ACL options</p>
</li><li>
<p>adds haproxy logs to rsyslog for remote logging where used</p>
</li><li>
<p>manage fail2ban integration (optional, requires <code>confdroid_fail2ban</code> module)</p>
</li><li>
<p>manage nagios integration (optional, requires <code>confdroid-nagios</code> module)</p>
<p>manage fail2ban integration (optional, requires fail2ban_cd module)</p>
</li></ul>
<p>SERVICE</p>
@@ -140,14 +134,14 @@
<p>manage haproxy service</p>
</li><li>
<p>restart service after changes in the configuration</p>
</li><li>
<p>stats are enabled on port 8404 with uri /haproxy?stats and strict private mode, set <code>hy_stats_auth</code> to something meaningful.</p>
</li></ul>
<h2 id="label-Dependencies">Dependencies</h2>
<p>All dependencies must be included in the catalogue.</p>
<ul><li>
<p><a href="https://gitlab.confdroid.com/puppet/cd_resources">cd_resources</a> for managing yum base repos</p>
</li><li>
<p><a href="https://github.com/puppetlabs/puppetlabs-concat">concat</a> for managing file fragments</p>
</li></ul>
@@ -178,8 +172,6 @@
<p>The proxy instances are configured in /etc/haproxy/haproxy.cfg, which is concatenated from various templates through a define in this puppet module. In order to create proxy instances, you will need an external class, which addresses the define, like so:</p>
<p>ACL rule:</p>
<pre class="code ruby"><code class="ruby">confdroid_haproxy::server::proxy { &#39;testing&#39;:
haproxy_fqdn =&gt; &#39;node.example.net&#39;,
frontend_name =&gt; &#39;test01-frontend&#39;,
@@ -190,37 +182,11 @@
}
</code></pre>
<p>real Proxy for https:</p>
<pre class="code ruby"><code class="ruby">haproxy_cd::server::proxy { &#39;https-in&#39;:
haproxy_fqdn =&gt; &#39;node.example.net&#39;,
frontend_name =&gt; &#39;https-in&#39;,
frontend_mode =&gt; &#39;http&#39;,
fe_bind_mode =&gt; &#39;*:443 ssl crt /etc/haproxy/certs/&#39;,
fe_option =&gt; &#39;forwardfor&#39;,
fe_http_request =&gt; &#39;add-header X-Forwarded-Proto https&#39;,
acl_rule_front =&gt; &#39;host_grafana hdr(host) -i grafana.example.net&#39;,
fe_use_backend =&gt; &#39;grafana_backend if host_grafana&#39;,
backend_configs =&gt; [
{
&#39;backend_name&#39; =&gt; &#39;grafana_backend&#39;,
&#39;be_mode&#39; =&gt; &#39;http&#39;,
&#39;be_balance&#39; =&gt; &#39;roundrobin&#39;,
&#39;be_server_name_array&#39; =&gt; [&#39;node1 10.0.1.1:8080 check&#39;],
}
]
default_backend =&gt; &#39;error_backend&#39;,
</code></pre>
<p>This allows the puppet module to create the sections in the configuration file as required. The haproxy service will be restarted after the changes in the configuration file are made. <code>haproxy_fqdn</code> <strong>must</strong>- contain the fqdn of the haproxy <strong>server</strong>- where this should be configured, otherwise the templates are not being populated. Multiple ACLs need to be added as array, and will create one line each.</p>
<h2 id="label-TLS">TLS</h2>
<p>Haproxy can manage all sorts of proxies including http and https. It also can terminate https requests and send the requests within a private network unencrypted, which is quite common. <strong>This module is NOT managing certificates</strong>, as there are many ways to manage this, including Kubernetes cert-manager, Let’s encrypt or other ways.</p>
<h2 id="label-SELINUX">SELINUX</h2>
<p>All files and directories are configured with correct selinux context. If selinux is disabled, these contexts are ignored. If selinux is set to <code>enforce</code> (not controlled within this module), the parameter <code>hy_selinux_allow_stats</code> must also be set to <code>true</code>, else the haproxy service will not start as selinux will not allow it. This is the default setting.</p>
<p>All files and directories are configured with correct selinux context. If selinux is disabled, these contexts are ignored. If selinux is set to <code>enforce</code> (not controlled within this module) and <code>hy_show_stats</code>is set to <code>true</code>, the parameter <code>hy_selinux_allow_stats</code> must also be set to <code>true</code>, else the haproxy service will not start as selinux will not allow it.</p>
<h2 id="label-Known+Problems">Known Problems</h2>

11
doc/puppet_class_list.html
View File

@@ -96,21 +96,14 @@
</li>
<li id="object_puppet_classes::confdroid_haproxy::monitoring::target" class="odd">
<div class="item">
<span class='object_link'><a href="puppet_classes/confdroid_haproxy_3A_3Amonitoring_3A_3Atarget.html" title="puppet_classes::confdroid_haproxy::monitoring::target (puppet_class)">confdroid_haproxy::monitoring::target</a></span>
</div>
</li>
<li id="object_puppet_classes::confdroid_haproxy::params" class="even">
<li id="object_puppet_classes::confdroid_haproxy::params" class="odd">
<div class="item">
<span class='object_link'><a href="puppet_classes/confdroid_haproxy_3A_3Aparams.html" title="puppet_classes::confdroid_haproxy::params (puppet_class)">confdroid_haproxy::params</a></span>
</div>
</li>
<li id="object_puppet_classes::confdroid_haproxy::server::service" class="odd">
<li id="object_puppet_classes::confdroid_haproxy::server::service" class="even">
<div class="item">
<span class='object_link'><a href="puppet_classes/confdroid_haproxy_3A_3Aserver_3A_3Aservice.html" title="puppet_classes::confdroid_haproxy::server::service (puppet_class)">confdroid_haproxy::server::service</a></span>
</div>

14
doc/puppet_classes/confdroid_haproxy_3A_3Afirewall_3A_3Aiptables.html
View File

@@ -117,13 +117,7 @@
19
20
21
22
23
24
25
26
27
28</pre>
22</pre>
</td>
<td>
<pre class="code"><span class="info file"># File 'manifests/firewall/iptables.pp', line 6</span>
@@ -143,12 +137,6 @@ class confdroid_haproxy::firewall::iptables (
dport =&gt; $hy_https_port,
jump =&gt; &#39;accept&#39;,
}
firewall { &quot;${hy_fw_order_no}${hy_stats_port} tcp port ${hy_stats_port}&quot;:
proto =&gt; &#39;tcp&#39;,
dport =&gt; $hy_stats_port,
jump =&gt; &#39;accept&#39;,
}
}
}</pre>
</td>

12
doc/puppet_classes/confdroid_haproxy_3A_3Amain_3A_3Aconfig.html
View File

@@ -115,12 +115,7 @@
17
18
19
20
21
22
23
24
25</pre>
20</pre>
</td>
<td>
<pre class="code"><span class="info file"># File 'manifests/main/config.pp', line 6</span>
@@ -134,14 +129,9 @@ class confdroid_haproxy::main::config (
include confdroid_haproxy::monitoring::fail2ban
}
if $hy_manage_nagios == true {
include confdroid_haproxy::monitoring::target
}
if $hy_selinux_allow_stats == true {
exec { &#39;setsebool haproxy_connect_any on&#39;:
path =&gt; [&#39;/bin&#39;, &#39;/usr/bin&#39;, &#39;/sbin&#39;, &#39;/usr/sbin&#39;],
onlyif =&gt; &#39;/usr/sbin/getsebool haproxy_connect_any | /usr/bin/grep -q &quot; --&gt; off$&quot;&#39;,
}
}
}</pre>

156
doc/puppet_classes/confdroid_haproxy_3A_3Amonitoring_3A_3Atarget.html
View File

@@ -1,156 +0,0 @@
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>
Puppet Class: confdroid_haproxy::monitoring::target
&mdash; Documentation by YARD 0.9.36
</title>
<link rel="stylesheet" href="../css/style.css" type="text/css" />
<link rel="stylesheet" href="../css/common.css" type="text/css" />
<script type="text/javascript">
pathId = "puppet_classes::confdroid_haproxy::monitoring::target";
relpath = '../';
</script>
<script type="text/javascript" charset="utf-8" src="../js/jquery.js"></script>
<script type="text/javascript" charset="utf-8" src="../js/app.js"></script>
</head>
<body>
<div class="nav_wrap">
<iframe id="nav" src="../puppet_class_list.html?1"></iframe>
<div id="resizer"></div>
</div>
<div id="main" tabindex="-1">
<div id="header">
<div id="menu">
<a href="../_index.html">Index (c)</a> &raquo;
<span class='title'><span class='object_link'>Puppet Classes</span></span>
&raquo;
<span class="title">confdroid_haproxy::monitoring::target</span>
</div>
<div id="search">
<a class="full_list_link" id="puppet_class_list_link"
href="../puppet_class_list.html">
<svg width="24" height="24">
<rect x="0" y="4" width="24" height="4" rx="1" ry="1"></rect>
<rect x="0" y="12" width="24" height="4" rx="1" ry="1"></rect>
<rect x="0" y="20" width="24" height="4" rx="1" ry="1"></rect>
</svg>
</a>
</div>
<div class="clear"></div>
</div>
<div id="content"><h1>Puppet Class: confdroid_haproxy::monitoring::target</h1>
<div class="box_info">
<dl>
<dt>Inherits:</dt>
<dd><span class='object_link'><a href="confdroid_haproxy_3A_3Aparams.html" title="puppet_classes::confdroid_haproxy::params (puppet_class)">confdroid_haproxy::params</a></span></dd>
</dl>
<dl>
<dt>Defined in:</dt>
<dd>
manifests/monitoring/target.pp
</dd>
</dl>
</div>
<h2>Summary</h2>
class manages exports for nagios monitoring
<h2>Overview</h2>
<div class="docstring">
<div class="discussion">
<p>confdroid_haproxy::monitoring::target.pp Module name: confdroid_haproxy Author: 12ww1160 (12ww1160@puppetsoft.com)</p>
</div>
</div>
<div class="tags">
</div><div class="method_details_list">
<table class="source_code">
<tr>
<td>
<pre class="lines">
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23</pre>
</td>
<td>
<pre class="code"><span class="info file"># File 'manifests/monitoring/target.pp', line 6</span>
class confdroid_haproxy::monitoring::target (
) inherits confdroid_haproxy::params {
if $hy_manage_nagios == true {
@@nagios_service { &quot;check_haproxy_${fqdn}&quot;:
check_command =&gt; &quot;check_nrpe!check_haproxy!${hy_procs_allowed}!haproxy&quot;,
use =&gt; &#39;generic-service&#39;,
host_name =&gt; $fqdn,
notification_period =&gt; &#39;24x7&#39;,
service_description =&gt; &quot;${fqdn}_check_haproxy&quot;,
target =&gt; $hy_target_service,
owner =&gt; &#39;nagios&#39;,
group =&gt; &#39;nagios&#39;,
mode =&gt; &#39;0640&#39;,
contacts =&gt; $hy_target_contacts,
}
}
}</pre>
</td>
</tr>
</table>
</div>
</div>
<div id="footer">
Generated by <a href="http://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>.
</div>
</div>
</body>
</html>

133
doc/puppet_classes/confdroid_haproxy_3A_3Aparams.html
View File

@@ -81,8 +81,6 @@
<span class='object_link'><a href="confdroid_haproxy_3A_3Afirewall_3A_3Aiptables.html" title="puppet_classes::confdroid_haproxy::firewall::iptables (puppet_class)">confdroid_haproxy::firewall::iptables</a></span><br/>
<span class='object_link'><a href="confdroid_haproxy_3A_3Amonitoring_3A_3Atarget.html" title="puppet_classes::confdroid_haproxy::monitoring::target (puppet_class)">confdroid_haproxy::monitoring::target</a></span><br/>
<span class='object_link'><a href="confdroid_haproxy_3A_3Amonitoring_3A_3Afail2ban.html" title="puppet_classes::confdroid_haproxy::monitoring::fail2ban (puppet_class)">confdroid_haproxy::monitoring::fail2ban</a></span><br/>
</dd>
@@ -399,6 +397,24 @@
</li>
<li>
<span class='name'>hy_show_stats</span>
<span class='type'>(<tt>Boolean</tt>)</span>
<em class="default">(defaults to: <tt>false</tt>)</em>
&mdash;
<div class='inline'>
<p>whether we want to display the statistics page</p>
</div>
</li>
<li>
<span class='name'>hy_stats_socket</span>
@@ -857,7 +873,7 @@
<span class='type'>(<tt>Boolean</tt>)</span>
<em class="default">(defaults to: <tt>true</tt>)</em>
<em class="default">(defaults to: <tt>false</tt>)</em>
&mdash;
@@ -867,91 +883,6 @@
</li>
<li>
<span class='name'>hy_stats_port</span>
<span class='type'>(<tt>String</tt>)</span>
<em class="default">(defaults to: <tt>&#39;8404&#39;</tt>)</em>
&mdash;
<div class='inline'>
<p>the port to use for stats. used in firewall settings</p>
</div>
</li>
<li>
<span class='name'>hy_manage_nagios</span>
<span class='type'>(<tt>Boolean</tt>)</span>
<em class="default">(defaults to: <tt>false</tt>)</em>
&mdash;
<div class='inline'>
<p>whether to manage nagios service checks</p>
</div>
</li>
<li>
<span class='name'>hy_target_service</span>
<span class='type'>(<tt>String</tt>)</span>
<em class="default">(defaults to: <tt>&#39;/etc/nagios/conf.d/haproxy_service.cfg&#39;</tt>)</em>
&mdash;
<div class='inline'>
<p>the path to the nagios service check file</p>
</div>
</li>
<li>
<span class='name'>hy_target_contacts</span>
<span class='type'>(<tt>Array</tt>)</span>
<em class="default">(defaults to: <tt>[&#39;nagiosadmin&#39;]</tt>)</em>
&mdash;
<div class='inline'>
<p>the contacts to use for nagios service checks</p>
</div>
</li>
<li>
<span class='name'>hy_procs_allowed</span>
<span class='type'>(<tt>String</tt>)</span>
<em class="default">(defaults to: <tt>&#39;1:&#39;</tt>)</em>
</li>
</ul>
@@ -963,6 +894,9 @@
<pre class="lines">
59
60
61
62
63
64
@@ -1051,19 +985,10 @@
147
148
149
150
151
152
153
154
155
156
157
158
159</pre>
150</pre>
</td>
<td>
<pre class="code"><span class="info file"># File 'manifests/params.pp', line 62</span>
<pre class="code"><span class="info file"># File 'manifests/params.pp', line 59</span>
class confdroid_haproxy::params (
@@ -1080,15 +1005,15 @@ class confdroid_haproxy::params (
Boolean $hy_manage_fail2ban = false,
# selinux
Boolean $hy_selinux_allow_stats = true,
Boolean $hy_selinux_allow_stats = false,
# main config
String $hy_http_port = &#39;80&#39;,
String $hy_https_port = &#39;443&#39;,
String $hy_stats_port = &#39;8404&#39;,
String $hy_chroot = &#39;/var/lib/haproxy&#39;,
String $hy_pid = &#39;/var/run/haproxy.pid&#39;,
String $hy_maxconn = &#39;4000&#39;,
Boolean $hy_show_stats = false,
String $hy_stats_socket = &#39;/var/lib/haproxy/stats&#39;,
String $hy_default_mode = &#39;tcp&#39;,
Boolean $hy_use_http_server_close = false,
@@ -1124,12 +1049,6 @@ class confdroid_haproxy::params (
Boolean $hy_manage_be_users = false,
String $hy_be_userlist = &#39;####&#39;,
# nagios
Boolean $hy_manage_nagios = false,
String $hy_target_service = &#39;/etc/nagios/conf.d/haproxy_service.cfg&#39;,
Array $hy_target_contacts = [&#39;nagiosadmin&#39;],
String $hy_procs_allowed = &#39;1:&#39;
) {
$fqdn = $facts[&#39;networking&#39;][&#39;fqdn&#39;]

6
manifests/firewall/iptables.pp
View File

@@ -18,11 +18,5 @@ class confdroid_haproxy::firewall::iptables (
dport => $hy_https_port,
jump => 'accept',
}
firewall { "${hy_fw_order_no}${hy_stats_port} tcp port ${hy_stats_port}":
proto => 'tcp',
dport => $hy_stats_port,
jump => 'accept',
}
}
}

5
manifests/main/config.pp
View File

@@ -12,14 +12,9 @@ class confdroid_haproxy::main::config (
include confdroid_haproxy::monitoring::fail2ban
}
if $hy_manage_nagios == true {
include confdroid_haproxy::monitoring::target
}
if $hy_selinux_allow_stats == true {
exec { 'setsebool haproxy_connect_any on':
path => ['/bin', '/usr/bin', '/sbin', '/usr/sbin'],
onlyif => '/usr/sbin/getsebool haproxy_connect_any | /usr/bin/grep -q " --> off$"',
}
}
}

23
manifests/monitoring/target.pp
View File

@@ -1,23 +0,0 @@
## confdroid_haproxy::monitoring::target.pp
# Module name: confdroid_haproxy
# Author: 12ww1160 (12ww1160@puppetsoft.com)
# @summary class manages exports for nagios monitoring
##############################################################################
class confdroid_haproxy::monitoring::target (
) inherits confdroid_haproxy::params {
if $hy_manage_nagios == true {
@@nagios_service { "check_haproxy_${fqdn}":
check_command => "check_nrpe!check_haproxy!${hy_procs_allowed}!haproxy",
use => 'generic-service',
host_name => $fqdn,
notification_period => '24x7',
service_description => "${fqdn}_check_haproxy",
target => $hy_target_service,
owner => 'nagios',
group => 'nagios',
mode => '0640',
contacts => $hy_target_contacts,
}
}
}

15
manifests/params.pp
View File

@@ -23,6 +23,7 @@
# @param [String] hy_chroot where the chroot should be
# @param [String] hy_pid the pid file to use.
# @param [String] hy_maxconn how many connections should we max allow.
# @param [Boolean] hy_show_stats whether we want to display the statistics page
# @param [String] hy_stats_socket name and path of the stats socket
# @param [String] hy_default_mode which mode to use in the defaults block
# @param [String] hy_log_default should be used when the instance's logging
@@ -54,10 +55,6 @@
# @param [String] hy_be_userlist backend userlist comment
# @param [Boolean] hy_manage_be_users whether to manage backend users
# @param [Boolean] hy_selinux_allow_stats whether to allow stats in selinux
# @param [String] hy_stats_port the port to use for stats. used in firewall settings
# @param [Boolean] hy_manage_nagios whether to manage nagios service checks
# @param [String] hy_target_service the path to the nagios service check file
# @param [Array] hy_target_contacts the contacts to use for nagios service checks
###############################################################################
class confdroid_haproxy::params (
@@ -74,15 +71,15 @@ class confdroid_haproxy::params (
Boolean $hy_manage_fail2ban = false,
# selinux
Boolean $hy_selinux_allow_stats = true,
Boolean $hy_selinux_allow_stats = false,
# main config
String $hy_http_port = '80',
String $hy_https_port = '443',
String $hy_stats_port = '8404',
String $hy_chroot = '/var/lib/haproxy',
String $hy_pid = '/var/run/haproxy.pid',
String $hy_maxconn = '4000',
Boolean $hy_show_stats = false,
String $hy_stats_socket = '/var/lib/haproxy/stats',
String $hy_default_mode = 'tcp',
Boolean $hy_use_http_server_close = false,
@@ -118,12 +115,6 @@ class confdroid_haproxy::params (
Boolean $hy_manage_be_users = false,
String $hy_be_userlist = '####',
# nagios
Boolean $hy_manage_nagios = false,
String $hy_target_service = '/etc/nagios/conf.d/haproxy_service.cfg',
Array $hy_target_contacts = ['nagiosadmin'],
String $hy_procs_allowed = '1:'
) {
$fqdn = $facts['networking']['fqdn']

3
templates/haproxy_head.erb
View File

@@ -50,6 +50,7 @@ defaults
timeout check <%= @hy_timeout_check %>
maxconn <%= @hy_maxconn %>
<% if @hy_show_stats == true -%>
listen stats
bind *:8404
mode http
@@ -59,6 +60,8 @@ listen stats
stats auth <%= @hy_stats_auth %>
stats refresh 30s
stats admin if TRUE # Allow admin actions if logged in
<% end -%>
listen stats
<% if @hy_manage_be_users == true -%>
<%= @hy_be_userlist %>