Created
February 27, 2023 13:49
-
-
Save fvoges/78d28bfb4305931029e10fc7f57b032e to your computer and use it in GitHub Desktop.
Ansible template fro HAProxy LB for Vault
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
global | |
log /dev/log local0 | |
log /dev/log local1 notice | |
chroot /var/lib/haproxy | |
stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners | |
stats timeout 30s | |
user haproxy | |
group haproxy | |
daemon | |
# Default SSL material locations | |
ca-base /etc/ssl/certs | |
crt-base /etc/ssl/private | |
# See: https://ssl-config.mozilla.org/#server=haproxy&server-version=2.0.3&config=intermediate | |
ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 | |
ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 | |
ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets | |
defaults | |
log global | |
mode http | |
option httplog | |
option dontlognull | |
timeout connect 5000 | |
timeout client 50000 | |
timeout server 50000 | |
errorfile 400 /etc/haproxy/errors/400.http | |
errorfile 403 /etc/haproxy/errors/403.http | |
errorfile 408 /etc/haproxy/errors/408.http | |
errorfile 500 /etc/haproxy/errors/500.http | |
errorfile 502 /etc/haproxy/errors/502.http | |
errorfile 503 /etc/haproxy/errors/503.http | |
errorfile 504 /etc/haproxy/errors/504.http | |
frontend stats | |
bind *:9000 | |
mode http | |
stats uri / | |
stats show-legends | |
no log | |
frontend vault_api_vip | |
bind *:8200 | |
mode tcp | |
default_backend vault_api_pool | |
option tcplog | |
backend vault_api_pool | |
mode tcp | |
balance roundrobin | |
option httpchk HEAD /v1/sys/health | |
{# option httpchk HEAD /v1/sys/health?perfstandbyok=true -#} | |
http-check expect status 200 | |
{% for vault_server in groups[vault_haproxy_nodes_group] %} | |
server {{ hostvars[vault_server]['ansible_hostname'] }} {{ hostvars[vault_server]['ansible_default_ipv4']['address'] }}:8200 check-ssl verify none | |
{% endfor %} | |
frontend vault_replication_vip | |
bind *:8201 | |
mode tcp | |
default_backend vault_replication_pool | |
option tcplog | |
backend vault_replication_pool | |
mode tcp | |
balance roundrobin | |
#option httpchk HEAD /v1/sys/health | |
option httpchk HEAD /v1/sys/health?perfstandbyok=true | |
http-check expect status 200 | |
{% for vault_server in groups[vault_haproxy_nodes_group] %} | |
server {{ hostvars[vault_server]['ansible_hostname'] }} {{ hostvars[vault_server]['ansible_default_ipv4']['address'] }}:8201 check-ssl verify none port 8200 | |
{% endfor %} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment