update haproxy role for certbot

roles/haproxy/README

@@ -0,0 +1,15 @@
+haproxy ansilbe role with certbot support
+
+NOTE: to install certbot for SSL termination in haproxy set the variable
+	'install_certbot' to true in your inventory file.
+	eg)
+---
+containers:
+	hosts:
+		haproxy:
+			internal_ip: 10.0.0.1
+			ansible_port: 25001
+			domain_name: example.com
+			install_certbot: true
+
+NOTE: this expects your certificates at '/etc/letsencrypt/live/__domain__/'

roles/haproxy/tasks/install_certbot_hooks.yml

@@ -0,0 +1,12 @@
+---
+- set_fact:
+    service_state: "{{ item }}"
+
+- set_fact:
+    folder: "{{ (item == 'stop') | ternary('pre', 'post') }}"
+
+- name: add certbot hooks
+  template:
+    src: templates/renewal_hook.sh.j2
+    dest: "/etc/letsencrypt/renewal-hooks/{{ folder }}/haproxy.sh"
+    mode: 0755

roles/haproxy/tasks/main.yml

@@ -1,7 +1,6 @@
 ---
 - name: main haproxy block
-  vars:
-    install_certbot: true
+  vars: {}
   block:
   - debug:
       var: groups['containers']
@@ -9,6 +8,7 @@
   - name: install pakages
     apk:
       name: [ haproxy ]
+      state: installed
 
   - name: create haproxy routes for other containers
     template:
@@ -21,10 +21,23 @@
       enabled: yes
       state: restarted
 
+- name: cerbot block
+  when: install_certbot
+  block:
   - name: install certbot
     apk:
       name: [ certbot ]
-    when: install_certbot
 
-# TODO: route web roots for each container in haproxy.conf
-# NOTE: can use *.lxd domain names in haproxy container
+  - name: add certbot hooks
+    include_tasks: install_certbot_hooks.yml
+    loop: [ "stop", "start" ]
+
+  - name: add certbot autorenew cron job
+    template:
+      src: templates/certbot_renew_cron.sh.j2
+      dest: /etc/periodic/weekly/certbot_renew.sh
+      mode: 0755
+
+
+# TODO: add task to upload existing certificates
+# TODO: add task to create initial certificates

roles/haproxy/templates/certbot_renew_cron.sh.j2

@@ -0,0 +1,3 @@
+#!/usr/bin/env sh
+
+certbot renew

roles/haproxy/templates/haproxy.cfg.j2

@@ -29,6 +29,10 @@ defaults
 
 frontend main
 	bind *:80
+{% if install_certbot %}
+	bind *:443 ssl crt "/etc/letsencrypt/live/{{ domain_name }}/{{ domain_name }}.pem"
+	http-request redirect scheme https unless { ssl_fc }
+{% endif %}
 
 {% for c in groups['containers'] %}
 {% if c != 'haproxy' %}
@@ -37,7 +41,6 @@ frontend main
 
 {% endif %}
 {% endfor %}
-	# default_backend dokuwiki
 
 {% for c in groups['containers'] %}
 {# NOTE: don't add haproxy to list of containers :P #}

roles/haproxy/templates/renewal_hook.sh.j2

@@ -0,0 +1,9 @@
+#!/usr/bin/env sh
+
+{% if folder == "post" %}
+# combine keys for haproxy
+cat "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem" \
+	"/etc/letsencrypt/live/{{ domain_name }}/privkey.pem" \
+	> /etc/letsencrypt/live/{{ domain_name }}/{{ domain_name }}.pem
+{% endif %}
+service haproxy "{{ service_state }}"