From ae6e173b71b30134f29420c5a3d91f7fffebf461 Mon Sep 17 00:00:00 2001
From: cinnaboot <cinnaboot@protonmail.com>
Date: Tue, 7 Dec 2021 16:31:19 -0500
Subject: [PATCH] add DNAT rules for haproxy port 80/443

---
 roles/lxd_host/tasks/main.yml    | 60 ++------------------------------
 roles/lxd_host/tasks/routing.yml | 50 ++++++++++++++++++++++++++
 2 files changed, 52 insertions(+), 58 deletions(-)
 create mode 100644 roles/lxd_host/tasks/routing.yml

diff --git a/roles/lxd_host/tasks/main.yml b/roles/lxd_host/tasks/main.yml
index 080af60..a28efca 100644
--- a/roles/lxd_host/tasks/main.yml
+++ b/roles/lxd_host/tasks/main.yml
@@ -24,63 +24,7 @@
       tmp_sshd_config: "/tmp/sshd_config_{{ item }}"
     with_items: "{{ groups['containers'] }}"
 
-  - name: install iptables and iptables-persistent
-    tags: routing
-    become: yes
-    apt:
-      name: [iptables, iptables-persistent]
-      state: present
+  - name: iptables DNAT routing tasks
+    include_tasks: routing.yml
     when: "'routing' in ansible_run_tags"
-
-  - name: add DNAT rules for containers
     tags: routing
-    iptables:
-      table: nat
-      chain: PREROUTING
-      in_interface: "{{ host_iface }}"
-      protocol: tcp
-      match: tcp
-      source: "{{ (host_ipt_ssh_cidr is defined) | ternary(host_ipt_ssh_cidr, '0.0.0.0/0')  }}"
-      jump: DNAT
-      destination_port: "{{ hostvars[item]['ansible_port'] }}"
-      to_destination: "{{ hostvars[item]['internal_ip'] }}"
-    become: yes
-    with_items: "{{ groups['containers'] }}"
-    when: "'routing' in ansible_run_tags"
-
-  - name: save DNAT rules on lxd host
-    tags: routing
-    become: yes
-    community.general.iptables_state:
-      table: nat
-      state: saved
-      path: /etc/iptables/rules.v4
-    when: "'routing' in ansible_run_tags"
-
-  # TODO: add other dnat ports in above loop?
-  #- name: add dokuwiki DNAT routing
-  #  iptables:
-  #    table: nat
-  #    chain: PREROUTING
-  #    in_interface: "{{ host_iface }}"
-  #    protocol: tcp
-  #    match: tcp
-  #    source: "{{ host_cidr }}"
-  #    jump: DNAT
-  #    destination_port: "{{ hostvars['dokuwiki']['dnat_dest_port'] }}"
-  #    to_destination: "{{ hostvars['dokuwiki']['internal_ip'] }}"
-  #  become: yes
-  #
-  #- name: add freshrss DNAT routing
-  #  iptables:
-  #    table: nat
-  #    chain: PREROUTING
-  #    in_interface: "{{ host_iface }}"
-  #    protocol: tcp
-  #    match: tcp
-  #    source: "{{ host_cidr }}"
-  #    jump: DNAT
-  #    destination_port: "{{ hostvars['freshrss']['dnat_dest_port'] }}"
-  #    to_destination: "{{ hostvars['freshrss']['internal_ip'] }}"
-  #  become: yes
-
diff --git a/roles/lxd_host/tasks/routing.yml b/roles/lxd_host/tasks/routing.yml
new file mode 100644
index 0000000..b36b32f
--- /dev/null
+++ b/roles/lxd_host/tasks/routing.yml
@@ -0,0 +1,50 @@
+---
+- name: install iptables and iptables-persistent
+  tags: routing
+  become: yes
+  apt:
+    name: [iptables, iptables-persistent]
+    state: present
+
+- name: add ssh DNAT rule for containers
+  tags: routing
+  iptables:
+    table: nat
+    chain: PREROUTING
+    in_interface: "{{ host_iface }}"
+    protocol: tcp
+    match: tcp
+    source: "{{ (host_ipt_ssh_cidr is defined) | ternary(host_ipt_ssh_cidr, '0.0.0.0/0')  }}"
+    jump: DNAT
+    destination_port: "{{ hostvars[item]['ansible_port'] }}"
+    to_destination: "{{ hostvars[item]['internal_ip'] }}"
+  become: yes
+  with_items: "{{ groups['containers'] }}"
+
+- debug:
+    var: groups['containers']
+  tags: routing
+
+- name: add http and https rules for haproxy container
+  when: "'haproxy' in groups['containers']"
+  tags: routing
+  iptables:
+    table: nat
+    chain: PREROUTING
+    in_interface: "{{ host_iface }}"
+    protocol: tcp
+    match: tcp
+    source: "{{ (host_ipt_ssh_cidr is defined) | ternary(host_ipt_ssh_cidr, '0.0.0.0/0')  }}"
+    jump: DNAT
+    destination_port: "{{ item }}"
+    to_destination: "{{ hostvars['haproxy']['internal_ip'] }}"
+  become: yes
+  loop: [ 80, 443 ]
+
+- name: save DNAT rules on lxd host
+  tags: routing
+  become: yes
+  community.general.iptables_state:
+    table: nat
+    state: saved
+    path: /etc/iptables/rules.v4