Recommit for updates in build 3

README.md

@@ -1,8 +1,6 @@
 # Readme
 
 [![Build Status](https://jenkins.confdroid.com/buildStatus/icon?job=confdroid_haproxy&style=plastic)](https://jenkins.confdroid.com/job/confdroid_haproxy/)
-[![Security Hotspots](https://sonarqube.confdroid.com/api/project_badges/measure?project=confdroid_haproxy&metric=security_hotspots&token=sqb_0205ee61c907f77ebdc1c717b8f4ff568c3724cf)](https://sonarqube.confdroid.com/dashboard?id=confdroid_haproxy)
-[![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/grizzlycoda/puppet_collection)
 
 - [Readme](#readme)
   - [Synopsis](#synopsis)
@@ -12,7 +10,6 @@
   - [Deployment](#deployment)
   - [Parameters](#parameters)
   - [Proxy Configuration](#proxy-configuration)
-  - [TLS](#tls)
   - [SELINUX](#selinux)
   - [Known Problems](#known-problems)
   - [Support](#support)
@@ -45,20 +42,18 @@ CONFIGURATION
   - front-end options
   - back-end options
   - ACL options
-- adds haproxy logs to rsyslog for remote logging where used
+- manage fail2ban integration (optional, requires fail2ban_cd module)
-- manage fail2ban integration (optional, requires `confdroid_fail2ban` module)
-- manage nagios integration (optional, requires `confdroid-nagios` module)
 
 SERVICE
 
 - manage haproxy service
 - restart service after changes in the configuration
-- stats are enabled on port 8404 with uri /haproxy?stats and strict private mode, set `hy_stats_auth` to something meaningful.
 
 ## Dependencies
 
 All dependencies must be included in the catalogue.
 
+- [cd_resources](https://gitlab.confdroid.com/puppet/cd_resources) for managing yum base repos
 - [concat](https://github.com/puppetlabs/puppetlabs-concat) for managing file fragments
 
 ## Deployment
@@ -88,8 +83,6 @@ The parameters are documented via puppet strings and [listed here](/docs/index.h
 The proxy instances are configured in /etc/haproxy/haproxy.cfg, which is concatenated from various templates through a define in this puppet module.
 In order to create proxy instances, you will need an external class, which addresses the define, like so:
 
-ACL rule:
-
 ```bash
   confdroid_haproxy::server::proxy { 'testing':
     haproxy_fqdn    =>  'node.example.net',
@@ -101,41 +94,13 @@ ACL rule:
   }
 ```
 
-real Proxy for https:
-
-```bash
-  haproxy_cd::server::proxy { 'https-in':
-    haproxy_fqdn    => 'node.example.net',
-    frontend_name   => 'https-in',
-    frontend_mode   => 'http',
-    fe_bind_mode    => '*:443 ssl crt /etc/haproxy/certs/',
-    fe_option       => 'forwardfor',
-    fe_http_request => 'add-header X-Forwarded-Proto https',
-    acl_rule_front  => 'host_grafana hdr(host) -i grafana.example.net',
-    fe_use_backend  => 'grafana_backend if host_grafana',
-    backend_configs => [
-      {
-        'backend_name'         => 'grafana_backend',
-        'be_mode'              => 'http',
-        'be_balance'           => 'roundrobin',
-        'be_server_name_array' => ['node1 10.0.1.1:8080 check'],
-      }
-    ]
-  default_backend => 'error_backend',
-```
-
 This allows the puppet module to create the sections in the configuration file as required. The haproxy service will be restarted after the changes in the configuration file are made.
 `haproxy_fqdn` **must**- contain the fqdn of the haproxy **server**- where this should be configured, otherwise the templates are not being populated.
 Multiple ACLs need to be added as array, and will create one line each.
 
-## TLS
-
-Haproxy can manage all sorts of proxies including http and https. It also can terminate https requests and send the requests within a private network unencrypted, which is quite common. **This module is NOT managing certificates**, as there are many ways to manage this, including Kubernetes cert-manager, Let's encrypt or other ways.
-
 ## SELINUX
 
 All files and directories are configured with correct selinux context. If selinux is disabled, these contexts are ignored.
-If selinux is set to `enforce` (not controlled within this module),  the parameter `hy_selinux_allow_stats` must also be set to `true`, else the haproxy service will not start  as selinux will not allow it. This is the default setting.
 
 ## Known Problems
 

doc/_index.html

@@ -108,11 +108,6 @@
       
             </li>
     
-            <li>
-      <span class='object_link'><a href="puppet_classes/confdroid_haproxy_3A_3Amonitoring_3A_3Atarget.html" title="puppet_classes::confdroid_haproxy::monitoring::target (puppet_class)">confdroid_haproxy::monitoring::target</a></span>
-      
-            </li>
-    
             <li>
       <span class='object_link'><a href="puppet_classes/confdroid_haproxy_3A_3Aparams.html" title="puppet_classes::confdroid_haproxy::params (puppet_class)">confdroid_haproxy::params</a></span>
       

doc/file.README.html

@@ -60,7 +60,7 @@
       <div id="content"><div id='filecontents'>
 <h1 id="label-Readme">Readme</h1>
 
-<p><a href="https://jenkins.confdroid.com/job/confdroid_haproxy/"><img src="https://jenkins.confdroid.com/buildStatus/icon?job=confdroid_haproxy&amp;style=plastic"></a> <a href="https://sonarqube.confdroid.com/dashboard?id=confdroid_haproxy"><img src="https://sonarqube.confdroid.com/api/project_badges/measure?project=confdroid_haproxy&amp;metric=security_hotspots&amp;token=sqb_0205ee61c907f77ebdc1c717b8f4ff568c3724cf"></a> <a href="https://deepwiki.com/grizzlycoda/puppet_collection"><img src="https://deepwiki.com/badge.svg"></a></p>
+<p><a href="https://jenkins.confdroid.com/job/confdroid_haproxy/"><img src="https://jenkins.confdroid.com/buildStatus/icon?job=confdroid_haproxy&amp;style=plastic"></a></p>
 <ul><li>
 <p><a href="#readme">Readme</a></p>
 </li><li>
@@ -78,8 +78,6 @@
 </li><li>
 <p><a href="#proxy-configuration">Proxy Configuration</a></p>
 </li><li>
-<p><a href="#tls">TLS</a></p>
-</li><li>
 <p><a href="#selinux">SELINUX</a></p>
 </li><li>
 <p><a href="#known-problems">Known Problems</a></p>
@@ -128,11 +126,7 @@
 </li><li>
 <p>ACL options</p>
 </li><li>
-<p>adds haproxy logs to rsyslog for remote logging where used</p>
+<p>manage fail2ban integration (optional, requires fail2ban_cd module)</p>
-</li><li>
-<p>manage fail2ban integration (optional, requires <code>confdroid_fail2ban</code> module)</p>
-</li><li>
-<p>manage nagios integration (optional, requires <code>confdroid-nagios</code> module)</p>
 </li></ul>
 
 <p>SERVICE</p>
@@ -140,14 +134,14 @@
 <p>manage haproxy service</p>
 </li><li>
 <p>restart service after changes in the configuration</p>
-</li><li>
-<p>stats are enabled on port 8404 with uri /haproxy?stats and strict private mode, set <code>hy_stats_auth</code> to something meaningful.</p>
 </li></ul>
 
 <h2 id="label-Dependencies">Dependencies</h2>
 
 <p>All dependencies must be included in the catalogue.</p>
 <ul><li>
+<p><a href="https://gitlab.confdroid.com/puppet/cd_resources">cd_resources</a> for managing yum base repos</p>
+</li><li>
 <p><a href="https://github.com/puppetlabs/puppetlabs-concat">concat</a> for managing file fragments</p>
 </li></ul>
 
@@ -178,8 +172,6 @@
 
 <p>The proxy instances are configured in /etc/haproxy/haproxy.cfg, which is concatenated from various templates through a define in this puppet module. In order to create proxy instances, you will need an external class, which addresses the define, like so:</p>
 
-<p>ACL rule:</p>
-
 <pre class="code ruby"><code class="ruby">confdroid_haproxy::server::proxy { &#39;testing&#39;:
     haproxy_fqdn    =&gt;  &#39;node.example.net&#39;,
     frontend_name   =&gt;  &#39;test01-frontend&#39;,
@@ -190,37 +182,11 @@
   }
 </code></pre>
 
-<p>real Proxy for https:</p>
-
-<pre class="code ruby"><code class="ruby">haproxy_cd::server::proxy { &#39;https-in&#39;:
-    haproxy_fqdn    =&gt; &#39;node.example.net&#39;,
-    frontend_name   =&gt; &#39;https-in&#39;,
-    frontend_mode   =&gt; &#39;http&#39;,
-    fe_bind_mode    =&gt; &#39;*:443 ssl crt /etc/haproxy/certs/&#39;,
-    fe_option       =&gt; &#39;forwardfor&#39;,
-    fe_http_request =&gt; &#39;add-header X-Forwarded-Proto https&#39;,
-    acl_rule_front  =&gt; &#39;host_grafana hdr(host) -i grafana.example.net&#39;,
-    fe_use_backend  =&gt; &#39;grafana_backend if host_grafana&#39;,
-    backend_configs =&gt; [
-      {
-        &#39;backend_name&#39;         =&gt; &#39;grafana_backend&#39;,
-        &#39;be_mode&#39;              =&gt; &#39;http&#39;,
-        &#39;be_balance&#39;           =&gt; &#39;roundrobin&#39;,
-        &#39;be_server_name_array&#39; =&gt; [&#39;node1 10.0.1.1:8080 check&#39;],
-      }
-    ]
-  default_backend =&gt; &#39;error_backend&#39;,
-</code></pre>
-
 <p>This allows the puppet module to create the sections in the configuration file as required. The haproxy service will be restarted after the changes in the configuration file are made. <code>haproxy_fqdn</code> <strong>must</strong>- contain the fqdn of the haproxy <strong>server</strong>- where this should be configured, otherwise the templates are not being populated. Multiple ACLs need to be added as array, and will create one line each.</p>
 
-<h2 id="label-TLS">TLS</h2>
-
-<p>Haproxy can manage all sorts of proxies including http and https. It also can terminate https requests and send the requests within a private network unencrypted, which is quite common. <strong>This module is NOT managing certificates</strong>, as there are many ways to manage this, including Kubernetes cert-manager, Let’s encrypt or other ways.</p>
-
 <h2 id="label-SELINUX">SELINUX</h2>
 
-<p>All files and directories are configured with correct selinux context. If selinux is disabled, these contexts are ignored. If selinux is set to <code>enforce</code> (not controlled within this module), the parameter <code>hy_selinux_allow_stats</code> must also be set to <code>true</code>, else the haproxy service will not start as selinux will not allow it. This is the default setting.</p>
+<p>All files and directories are configured with correct selinux context. If selinux is disabled, these contexts are ignored.</p>
 
 <h2 id="label-Known+Problems">Known Problems</h2>
 

doc/index.html

@@ -60,7 +60,7 @@
       <div id="content"><div id='filecontents'>
 <h1 id="label-Readme">Readme</h1>
 
-<p><a href="https://jenkins.confdroid.com/job/confdroid_haproxy/"><img src="https://jenkins.confdroid.com/buildStatus/icon?job=confdroid_haproxy&amp;style=plastic"></a> <a href="https://sonarqube.confdroid.com/dashboard?id=confdroid_haproxy"><img src="https://sonarqube.confdroid.com/api/project_badges/measure?project=confdroid_haproxy&amp;metric=security_hotspots&amp;token=sqb_0205ee61c907f77ebdc1c717b8f4ff568c3724cf"></a> <a href="https://deepwiki.com/grizzlycoda/puppet_collection"><img src="https://deepwiki.com/badge.svg"></a></p>
+<p><a href="https://jenkins.confdroid.com/job/confdroid_haproxy/"><img src="https://jenkins.confdroid.com/buildStatus/icon?job=confdroid_haproxy&amp;style=plastic"></a></p>
 <ul><li>
 <p><a href="#readme">Readme</a></p>
 </li><li>
@@ -78,8 +78,6 @@
 </li><li>
 <p><a href="#proxy-configuration">Proxy Configuration</a></p>
 </li><li>
-<p><a href="#tls">TLS</a></p>
-</li><li>
 <p><a href="#selinux">SELINUX</a></p>
 </li><li>
 <p><a href="#known-problems">Known Problems</a></p>
@@ -128,11 +126,7 @@
 </li><li>
 <p>ACL options</p>
 </li><li>
-<p>adds haproxy logs to rsyslog for remote logging where used</p>
+<p>manage fail2ban integration (optional, requires fail2ban_cd module)</p>
-</li><li>
-<p>manage fail2ban integration (optional, requires <code>confdroid_fail2ban</code> module)</p>
-</li><li>
-<p>manage nagios integration (optional, requires <code>confdroid-nagios</code> module)</p>
 </li></ul>
 
 <p>SERVICE</p>
@@ -140,14 +134,14 @@
 <p>manage haproxy service</p>
 </li><li>
 <p>restart service after changes in the configuration</p>
-</li><li>
-<p>stats are enabled on port 8404 with uri /haproxy?stats and strict private mode, set <code>hy_stats_auth</code> to something meaningful.</p>
 </li></ul>
 
 <h2 id="label-Dependencies">Dependencies</h2>
 
 <p>All dependencies must be included in the catalogue.</p>
 <ul><li>
+<p><a href="https://gitlab.confdroid.com/puppet/cd_resources">cd_resources</a> for managing yum base repos</p>
+</li><li>
 <p><a href="https://github.com/puppetlabs/puppetlabs-concat">concat</a> for managing file fragments</p>
 </li></ul>
 
@@ -178,8 +172,6 @@
 
 <p>The proxy instances are configured in /etc/haproxy/haproxy.cfg, which is concatenated from various templates through a define in this puppet module. In order to create proxy instances, you will need an external class, which addresses the define, like so:</p>
 
-<p>ACL rule:</p>
-
 <pre class="code ruby"><code class="ruby">confdroid_haproxy::server::proxy { &#39;testing&#39;:
     haproxy_fqdn    =&gt;  &#39;node.example.net&#39;,
     frontend_name   =&gt;  &#39;test01-frontend&#39;,
@@ -190,37 +182,11 @@
   }
 </code></pre>
 
-<p>real Proxy for https:</p>
-
-<pre class="code ruby"><code class="ruby">haproxy_cd::server::proxy { &#39;https-in&#39;:
-    haproxy_fqdn    =&gt; &#39;node.example.net&#39;,
-    frontend_name   =&gt; &#39;https-in&#39;,
-    frontend_mode   =&gt; &#39;http&#39;,
-    fe_bind_mode    =&gt; &#39;*:443 ssl crt /etc/haproxy/certs/&#39;,
-    fe_option       =&gt; &#39;forwardfor&#39;,
-    fe_http_request =&gt; &#39;add-header X-Forwarded-Proto https&#39;,
-    acl_rule_front  =&gt; &#39;host_grafana hdr(host) -i grafana.example.net&#39;,
-    fe_use_backend  =&gt; &#39;grafana_backend if host_grafana&#39;,
-    backend_configs =&gt; [
-      {
-        &#39;backend_name&#39;         =&gt; &#39;grafana_backend&#39;,
-        &#39;be_mode&#39;              =&gt; &#39;http&#39;,
-        &#39;be_balance&#39;           =&gt; &#39;roundrobin&#39;,
-        &#39;be_server_name_array&#39; =&gt; [&#39;node1 10.0.1.1:8080 check&#39;],
-      }
-    ]
-  default_backend =&gt; &#39;error_backend&#39;,
-</code></pre>
-
 <p>This allows the puppet module to create the sections in the configuration file as required. The haproxy service will be restarted after the changes in the configuration file are made. <code>haproxy_fqdn</code> <strong>must</strong>- contain the fqdn of the haproxy <strong>server</strong>- where this should be configured, otherwise the templates are not being populated. Multiple ACLs need to be added as array, and will create one line each.</p>
 
-<h2 id="label-TLS">TLS</h2>
-
-<p>Haproxy can manage all sorts of proxies including http and https. It also can terminate https requests and send the requests within a private network unencrypted, which is quite common. <strong>This module is NOT managing certificates</strong>, as there are many ways to manage this, including Kubernetes cert-manager, Let’s encrypt or other ways.</p>
-
 <h2 id="label-SELINUX">SELINUX</h2>
 
-<p>All files and directories are configured with correct selinux context. If selinux is disabled, these contexts are ignored. If selinux is set to <code>enforce</code> (not controlled within this module), the parameter <code>hy_selinux_allow_stats</code> must also be set to <code>true</code>, else the haproxy service will not start as selinux will not allow it. This is the default setting.</p>
+<p>All files and directories are configured with correct selinux context. If selinux is disabled, these contexts are ignored.</p>
 
 <h2 id="label-Known+Problems">Known Problems</h2>
 

doc/puppet_class_list.html

@@ -96,21 +96,14 @@
     </li>
     
 
-    <li id="object_puppet_classes::confdroid_haproxy::monitoring::target" class="odd">
+    <li id="object_puppet_classes::confdroid_haproxy::params" class="odd">
-      <div class="item">
-        <span class='object_link'><a href="puppet_classes/confdroid_haproxy_3A_3Amonitoring_3A_3Atarget.html" title="puppet_classes::confdroid_haproxy::monitoring::target (puppet_class)">confdroid_haproxy::monitoring::target</a></span>
-      </div>
-    </li>
-    
-
-    <li id="object_puppet_classes::confdroid_haproxy::params" class="even">
       <div class="item">
         <span class='object_link'><a href="puppet_classes/confdroid_haproxy_3A_3Aparams.html" title="puppet_classes::confdroid_haproxy::params (puppet_class)">confdroid_haproxy::params</a></span>
       </div>
     </li>
     
 
-    <li id="object_puppet_classes::confdroid_haproxy::server::service" class="odd">
+    <li id="object_puppet_classes::confdroid_haproxy::server::service" class="even">
       <div class="item">
         <span class='object_link'><a href="puppet_classes/confdroid_haproxy_3A_3Aserver_3A_3Aservice.html" title="puppet_classes::confdroid_haproxy::server::service (puppet_class)">confdroid_haproxy::server::service</a></span>
       </div>

doc/puppet_classes/confdroid_haproxy_3A_3Afirewall_3A_3Aiptables.html

@@ -117,13 +117,7 @@
 19
 20
 21
-22
+22</pre>
-23
-24
-25
-26
-27
-28</pre>
       </td>
       <td>
         <pre class="code"><span class="info file"># File 'manifests/firewall/iptables.pp', line 6</span>
@@ -143,12 +137,6 @@ class confdroid_haproxy::firewall::iptables (
       dport =&gt; $hy_https_port,
       jump  =&gt; &#39;accept&#39;,
     }
-
-    firewall { &quot;${hy_fw_order_no}${hy_stats_port} tcp port ${hy_stats_port}&quot;:
-      proto =&gt; &#39;tcp&#39;,
-      dport =&gt; $hy_stats_port,
-      jump  =&gt; &#39;accept&#39;,
-    }
   }
 }</pre>
       </td>

doc/puppet_classes/confdroid_haproxy_3A_3Amain_3A_3Aconfig.html

@@ -109,18 +109,7 @@
 11
 12
 13
-14
+14</pre>
-15
-16
-17
-18
-19
-20
-21
-22
-23
-24
-25</pre>
       </td>
       <td>
         <pre class="code"><span class="info file"># File 'manifests/main/config.pp', line 6</span>
@@ -133,17 +122,6 @@ class confdroid_haproxy::main::config (
   if $hy_manage_fail2ban == true {
     include confdroid_haproxy::monitoring::fail2ban
   }
-
-  if $hy_manage_nagios == true {
-    include confdroid_haproxy::monitoring::target
-  }
-
-  if $hy_selinux_allow_stats == true {
-    exec { &#39;setsebool haproxy_connect_any on&#39;:
-      path   =&gt; [&#39;/bin&#39;, &#39;/usr/bin&#39;, &#39;/sbin&#39;, &#39;/usr/sbin&#39;],
-      onlyif =&gt; &#39;/usr/sbin/getsebool haproxy_connect_any | /usr/bin/grep -q &quot; --&gt; off$&quot;&#39;,
-    }
-  }
 }</pre>
       </td>
     </tr>

doc/puppet_classes/confdroid_haproxy_3A_3Amonitoring_3A_3Atarget.html

@@ -1,156 +0,0 @@
-<!DOCTYPE html>
-<html>
-  <head>
-    <meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1.0">
-<title>
-  Puppet Class: confdroid_haproxy::monitoring::target
-  
-    &mdash; Documentation by YARD 0.9.36
-  
-</title>
-
-  <link rel="stylesheet" href="../css/style.css" type="text/css" />
-
-  <link rel="stylesheet" href="../css/common.css" type="text/css" />
-
-<script type="text/javascript">
-  pathId = "puppet_classes::confdroid_haproxy::monitoring::target";
-  relpath = '../';
-</script>
-
-
-  <script type="text/javascript" charset="utf-8" src="../js/jquery.js"></script>
-
-  <script type="text/javascript" charset="utf-8" src="../js/app.js"></script>
-
-
-  </head>
-  <body>
-    <div class="nav_wrap">
-      <iframe id="nav" src="../puppet_class_list.html?1"></iframe>
-      <div id="resizer"></div>
-    </div>
-
-    <div id="main" tabindex="-1">
-      <div id="header">
-        <div id="menu">
-  
-    <a href="../_index.html">Index (c)</a> &raquo;
-    <span class='title'><span class='object_link'>Puppet Classes</span></span>
-     &raquo; 
-    <span class="title">confdroid_haproxy::monitoring::target</span>
-  
-</div>
-
-        <div id="search">
-  
-    <a class="full_list_link" id="puppet_class_list_link"
-        href="../puppet_class_list.html">
-
-        <svg width="24" height="24">
-          <rect x="0" y="4" width="24" height="4" rx="1" ry="1"></rect>
-          <rect x="0" y="12" width="24" height="4" rx="1" ry="1"></rect>
-          <rect x="0" y="20" width="24" height="4" rx="1" ry="1"></rect>
-        </svg>
-    </a>
-  
-</div>
-        <div class="clear"></div>
-      </div>
-
-      <div id="content"><h1>Puppet Class: confdroid_haproxy::monitoring::target</h1>
-<div class="box_info">
-  
-  <dl>
-    <dt>Inherits:</dt>
-    <dd><span class='object_link'><a href="confdroid_haproxy_3A_3Aparams.html" title="puppet_classes::confdroid_haproxy::params (puppet_class)">confdroid_haproxy::params</a></span></dd>
-  </dl>
-  
-  
-  <dl>
-    <dt>Defined in:</dt>
-    <dd>
-      manifests/monitoring/target.pp
-    </dd>
-  </dl>
-</div>
-
-  <h2>Summary</h2>
-  class manages exports for nagios monitoring
-
-<h2>Overview</h2>
-<div class="docstring">
-  <div class="discussion">
-    
-<p>confdroid_haproxy::monitoring::target.pp Module name: confdroid_haproxy Author: 12ww1160 (12ww1160@puppetsoft.com)</p>
-
-  </div>
-</div>
-
-
-
-<div class="tags">
-  
-
-
-</div><div class="method_details_list">
-  <table class="source_code">
-    <tr>
-      <td>
-        <pre class="lines">
-
-
-6
-7
-8
-9
-10
-11
-12
-13
-14
-15
-16
-17
-18
-19
-20
-21
-22
-23</pre>
-      </td>
-      <td>
-        <pre class="code"><span class="info file"># File 'manifests/monitoring/target.pp', line 6</span>
-
-class confdroid_haproxy::monitoring::target (
-
-) inherits confdroid_haproxy::params {
-  if $hy_manage_nagios == true {
-    @@nagios_service { &quot;check_haproxy_${fqdn}&quot;:
-      check_command       =&gt; &quot;check_nrpe!check_haproxy!${hy_procs_allowed}!haproxy&quot;,
-      use                 =&gt; &#39;generic-service&#39;,
-      host_name           =&gt; $fqdn,
-      notification_period =&gt; &#39;24x7&#39;,
-      service_description =&gt; &quot;${fqdn}_check_haproxy&quot;,
-      target              =&gt; $hy_target_service,
-      owner               =&gt; &#39;nagios&#39;,
-      group               =&gt; &#39;nagios&#39;,
-      mode                =&gt; &#39;0640&#39;,
-      contacts            =&gt; $hy_target_contacts,
-    }
-  }
-}</pre>
-      </td>
-    </tr>
-  </table>
-</div>
-</div>
-
-      <div id="footer">
-     Generated by <a href="http://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>.
-</div>
-
-    </div>
-  </body>
-</html>

doc/puppet_classes/confdroid_haproxy_3A_3Aparams.html

@@ -81,8 +81,6 @@
       
       <span class='object_link'><a href="confdroid_haproxy_3A_3Afirewall_3A_3Aiptables.html" title="puppet_classes::confdroid_haproxy::firewall::iptables (puppet_class)">confdroid_haproxy::firewall::iptables</a></span><br/>
       
-      <span class='object_link'><a href="confdroid_haproxy_3A_3Amonitoring_3A_3Atarget.html" title="puppet_classes::confdroid_haproxy::monitoring::target (puppet_class)">confdroid_haproxy::monitoring::target</a></span><br/>
-      
       <span class='object_link'><a href="confdroid_haproxy_3A_3Amonitoring_3A_3Afail2ban.html" title="puppet_classes::confdroid_haproxy::monitoring::fail2ban (puppet_class)">confdroid_haproxy::monitoring::fail2ban</a></span><br/>
       
     </dd>
@@ -399,6 +397,24 @@
       
     </li>
   
+    <li>
+      
+        <span class='name'>hy_show_stats</span>
+      
+      
+        <span class='type'>(<tt>Boolean</tt>)</span>
+      
+      
+        <em class="default">(defaults to: <tt>false</tt>)</em>
+      
+      
+        &mdash;
+        <div class='inline'>
+<p>whether we want to display the statistics page</p>
+</div>
+      
+    </li>
+  
     <li>
       
         <span class='name'>hy_stats_socket</span>
@@ -849,109 +865,6 @@
       
     </li>
   
-    <li>
-      
-        <span class='name'>hy_selinux_allow_stats</span>
-      
-      
-        <span class='type'>(<tt>Boolean</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>true</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>whether to allow stats in selinux</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>hy_stats_port</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;8404&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>the port to use for stats. used in firewall settings</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>hy_manage_nagios</span>
-      
-      
-        <span class='type'>(<tt>Boolean</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>false</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>whether to manage nagios service checks</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>hy_target_service</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;/etc/nagios/conf.d/haproxy_service.cfg&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>the path to the nagios service check file</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>hy_target_contacts</span>
-      
-      
-        <span class='type'>(<tt>Array</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>[&#39;nagiosadmin&#39;]</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>the contacts to use for nagios service checks</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>hy_procs_allowed</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;1:&#39;</tt>)</em>
-      
-      
-    </li>
-  
 </ul>
 
 
@@ -963,6 +876,10 @@
         <pre class="lines">
 
 
+58
+59
+60
+61
 62
 63
 64
@@ -1047,23 +964,10 @@
 143
 144
 145
-146
+146</pre>
-147
-148
-149
-150
-151
-152
-153
-154
-155
-156
-157
-158
-159</pre>
       </td>
       <td>
-        <pre class="code"><span class="info file"># File 'manifests/params.pp', line 62</span>
+        <pre class="code"><span class="info file"># File 'manifests/params.pp', line 58</span>
 
 class confdroid_haproxy::params (
 
@@ -1079,16 +983,13 @@ class confdroid_haproxy::params (
 # fail2ban
   Boolean $hy_manage_fail2ban         = false,
 
-# selinux
-  Boolean $hy_selinux_allow_stats     = true,
-
 # main config
   String $hy_http_port                = &#39;80&#39;,
   String $hy_https_port               = &#39;443&#39;,
-  String $hy_stats_port               = &#39;8404&#39;,
   String $hy_chroot                   = &#39;/var/lib/haproxy&#39;,
   String $hy_pid                      = &#39;/var/run/haproxy.pid&#39;,
   String $hy_maxconn                  = &#39;4000&#39;,
+  Boolean $hy_show_stats              = false,
   String $hy_stats_socket             = &#39;/var/lib/haproxy/stats&#39;,
   String $hy_default_mode             = &#39;tcp&#39;,
   Boolean $hy_use_http_server_close   = false,
@@ -1124,12 +1025,6 @@ class confdroid_haproxy::params (
   Boolean $hy_manage_be_users         = false,
   String $hy_be_userlist              = &#39;####&#39;,
 
-# nagios
-  Boolean $hy_manage_nagios           = false,
-  String $hy_target_service           = &#39;/etc/nagios/conf.d/haproxy_service.cfg&#39;,
-  Array $hy_target_contacts           = [&#39;nagiosadmin&#39;],
-  String $hy_procs_allowed            = &#39;1:&#39;
-
 ) {
   $fqdn                               = $facts[&#39;networking&#39;][&#39;fqdn&#39;]
 

manifests/firewall/iptables.pp

@@ -18,11 +18,5 @@ class confdroid_haproxy::firewall::iptables (
       dport => $hy_https_port,
       jump  => 'accept',
     }
-
-    firewall { "${hy_fw_order_no}${hy_stats_port} tcp port ${hy_stats_port}":
-      proto => 'tcp',
-      dport => $hy_stats_port,
-      jump  => 'accept',
-    }
   }
 }

manifests/main/config.pp

@@ -11,15 +11,4 @@ class confdroid_haproxy::main::config (
   if $hy_manage_fail2ban == true {
     include confdroid_haproxy::monitoring::fail2ban
   }
-
-  if $hy_manage_nagios == true {
-    include confdroid_haproxy::monitoring::target
-  }
-
-  if $hy_selinux_allow_stats == true {
-    exec { 'setsebool haproxy_connect_any on':
-      path   => ['/bin', '/usr/bin', '/sbin', '/usr/sbin'],
-      onlyif => '/usr/sbin/getsebool haproxy_connect_any | /usr/bin/grep -q " --> off$"',
-    }
-  }
 }

manifests/monitoring/target.pp

@@ -1,23 +0,0 @@
-## confdroid_haproxy::monitoring::target.pp
-# Module name: confdroid_haproxy
-# Author: 12ww1160 (12ww1160@puppetsoft.com)
-# @summary class manages exports for nagios monitoring
-##############################################################################
-class confdroid_haproxy::monitoring::target (
-
-) inherits confdroid_haproxy::params {
-  if $hy_manage_nagios == true {
-    @@nagios_service { "check_haproxy_${fqdn}":
-      check_command       => "check_nrpe!check_haproxy!${hy_procs_allowed}!haproxy",
-      use                 => 'generic-service',
-      host_name           => $fqdn,
-      notification_period => '24x7',
-      service_description => "${fqdn}_check_haproxy",
-      target              => $hy_target_service,
-      owner               => 'nagios',
-      group               => 'nagios',
-      mode                => '0640',
-      contacts            => $hy_target_contacts,
-    }
-  }
-}

manifests/params.pp

@@ -23,6 +23,7 @@
 # @param [String] hy_chroot where the chroot should be
 # @param [String] hy_pid the pid file to use.
 # @param [String] hy_maxconn how many connections should we max allow.
+# @param [Boolean] hy_show_stats whether we want to display the statistics page
 # @param [String] hy_stats_socket name and path of the stats socket
 # @param [String] hy_default_mode which mode to use in the defaults block
 # @param [String] hy_log_default should be used when the instance's logging
@@ -53,11 +54,6 @@
 # @param [Boolean] hy_use_dontlognull whether to use dontlognull as default
 # @param [String] hy_be_userlist backend userlist comment
 # @param [Boolean] hy_manage_be_users  whether to manage backend users
-# @param [Boolean] hy_selinux_allow_stats whether to allow stats in selinux
-# @param [String] hy_stats_port the port to use for stats. used in firewall settings
-# @param [Boolean] hy_manage_nagios whether to manage nagios service checks
-# @param [String] hy_target_service the path to the nagios service check file
-# @param [Array] hy_target_contacts the contacts to use for nagios service checks 
 ###############################################################################
 class confdroid_haproxy::params (
 
@@ -73,16 +69,13 @@ class confdroid_haproxy::params (
 # fail2ban
   Boolean $hy_manage_fail2ban         = false,
 
-# selinux
-  Boolean $hy_selinux_allow_stats     = true,
-
 # main config
   String $hy_http_port                = '80',
   String $hy_https_port               = '443',
-  String $hy_stats_port               = '8404',
   String $hy_chroot                   = '/var/lib/haproxy',
   String $hy_pid                      = '/var/run/haproxy.pid',
   String $hy_maxconn                  = '4000',
+  Boolean $hy_show_stats              = false,
   String $hy_stats_socket             = '/var/lib/haproxy/stats',
   String $hy_default_mode             = 'tcp',
   Boolean $hy_use_http_server_close   = false,
@@ -118,12 +111,6 @@ class confdroid_haproxy::params (
   Boolean $hy_manage_be_users         = false,
   String $hy_be_userlist              = '####',
 
-# nagios
-  Boolean $hy_manage_nagios           = false,
-  String $hy_target_service           = '/etc/nagios/conf.d/haproxy_service.cfg',
-  Array $hy_target_contacts           = ['nagiosadmin'],
-  String $hy_procs_allowed            = '1:'
-
 ) {
   $fqdn                               = $facts['networking']['fqdn']
 

templates/haproxy_head.erb

@@ -7,6 +7,10 @@ global
     log             <%= @hy_log_local1 %>
 <% if @hy_hard_stop == true -%>
     hard-stop-after <%= @hy_hard_stop_value %>
+<% end -%>
+<% if @hy_show_stats == true -%>
+    stats socket    /var/lib/haproxy/stats
+    stats timeout   30s
 <% end -%>
     chroot          <%= @hy_chroot %>
     pidfile         <%= @hy_pid %>
@@ -51,7 +55,7 @@ defaults
     maxconn                 <%= @hy_maxconn %>
 
 listen stats
-    bind *:8404
+    bind 127.0.0.1:8404  # Bind to localhost if only local access is needed #
     mode http
     stats enable
     stats uri /haproxy?stats