From f55a37715207520b67d6c55861e802b3c012f650 Mon Sep 17 00:00:00 2001
From: cinnaboot <cinnaboot@protonmail.com>
Date: Wed, 8 Dec 2021 13:56:16 -0500
Subject: [PATCH] update haproxy role for certbot

---
 roles/haproxy/README                          | 15 ++++++++++++
 roles/haproxy/tasks/install_certbot_hooks.yml | 12 ++++++++++
 roles/haproxy/tasks/main.yml                  | 23 +++++++++++++++----
 .../templates/certbot_renew_cron.sh.j2        |  3 +++
 roles/haproxy/templates/haproxy.cfg.j2        |  5 +++-
 roles/haproxy/templates/renewal_hook.sh.j2    |  9 ++++++++
 6 files changed, 61 insertions(+), 6 deletions(-)
 create mode 100644 roles/haproxy/README
 create mode 100644 roles/haproxy/tasks/install_certbot_hooks.yml
 create mode 100644 roles/haproxy/templates/certbot_renew_cron.sh.j2
 create mode 100644 roles/haproxy/templates/renewal_hook.sh.j2

diff --git a/roles/haproxy/README b/roles/haproxy/README
new file mode 100644
index 0000000..66ddf90
--- /dev/null
+++ b/roles/haproxy/README
@@ -0,0 +1,15 @@
+haproxy ansilbe role with certbot support
+
+NOTE: to install certbot for SSL termination in haproxy set the variable
+	'install_certbot' to true in your inventory file.
+	eg)
+---
+containers:
+	hosts:
+		haproxy:
+			internal_ip: 10.0.0.1
+			ansible_port: 25001
+			domain_name: example.com
+			install_certbot: true
+
+NOTE: this expects your certificates at '/etc/letsencrypt/live/__domain__/'
diff --git a/roles/haproxy/tasks/install_certbot_hooks.yml b/roles/haproxy/tasks/install_certbot_hooks.yml
new file mode 100644
index 0000000..3bdfa2a
--- /dev/null
+++ b/roles/haproxy/tasks/install_certbot_hooks.yml
@@ -0,0 +1,12 @@
+---
+- set_fact:
+    service_state: "{{ item }}"
+
+- set_fact:
+    folder: "{{ (item == 'stop') | ternary('pre', 'post') }}"
+
+- name: add certbot hooks
+  template:
+    src: templates/renewal_hook.sh.j2
+    dest: "/etc/letsencrypt/renewal-hooks/{{ folder }}/haproxy.sh"
+    mode: 0755
diff --git a/roles/haproxy/tasks/main.yml b/roles/haproxy/tasks/main.yml
index 64b7d78..e242385 100644
--- a/roles/haproxy/tasks/main.yml
+++ b/roles/haproxy/tasks/main.yml
@@ -1,7 +1,6 @@
 ---
 - name: main haproxy block
-  vars:
-    install_certbot: true
+  vars: {}
   block:
   - debug:
       var: groups['containers']
@@ -9,6 +8,7 @@
   - name: install pakages
     apk:
       name: [ haproxy ]
+      state: installed
 
   - name: create haproxy routes for other containers
     template:
@@ -21,10 +21,23 @@
       enabled: yes
       state: restarted
 
+- name: cerbot block
+  when: install_certbot
+  block:
   - name: install certbot
     apk:
       name: [ certbot ]
-    when: install_certbot
 
-# TODO: route web roots for each container in haproxy.conf
-# NOTE: can use *.lxd domain names in haproxy container
+  - name: add certbot hooks
+    include_tasks: install_certbot_hooks.yml
+    loop: [ "stop", "start" ]
+
+  - name: add certbot autorenew cron job
+    template:
+      src: templates/certbot_renew_cron.sh.j2
+      dest: /etc/periodic/weekly/certbot_renew.sh
+      mode: 0755
+
+
+# TODO: add task to upload existing certificates
+# TODO: add task to create initial certificates
diff --git a/roles/haproxy/templates/certbot_renew_cron.sh.j2 b/roles/haproxy/templates/certbot_renew_cron.sh.j2
new file mode 100644
index 0000000..06ea986
--- /dev/null
+++ b/roles/haproxy/templates/certbot_renew_cron.sh.j2
@@ -0,0 +1,3 @@
+#!/usr/bin/env sh
+
+certbot renew
diff --git a/roles/haproxy/templates/haproxy.cfg.j2 b/roles/haproxy/templates/haproxy.cfg.j2
index 26b793f..d6503b2 100644
--- a/roles/haproxy/templates/haproxy.cfg.j2
+++ b/roles/haproxy/templates/haproxy.cfg.j2
@@ -29,6 +29,10 @@ defaults
 
 frontend main
 	bind *:80
+{% if install_certbot %}
+	bind *:443 ssl crt "/etc/letsencrypt/live/{{ domain_name }}/{{ domain_name }}.pem"
+	http-request redirect scheme https unless { ssl_fc }
+{% endif %}
 
 {% for c in groups['containers'] %}
 {% if c != 'haproxy' %}
@@ -37,7 +41,6 @@ frontend main
 
 {% endif %}
 {% endfor %}
-	# default_backend dokuwiki
 
 {% for c in groups['containers'] %}
 {# NOTE: don't add haproxy to list of containers :P #}
diff --git a/roles/haproxy/templates/renewal_hook.sh.j2 b/roles/haproxy/templates/renewal_hook.sh.j2
new file mode 100644
index 0000000..24c85c8
--- /dev/null
+++ b/roles/haproxy/templates/renewal_hook.sh.j2
@@ -0,0 +1,9 @@
+#!/usr/bin/env sh
+
+{% if folder == "post" %}
+# combine keys for haproxy
+cat "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem" \
+	"/etc/letsencrypt/live/{{ domain_name }}/privkey.pem" \
+	> /etc/letsencrypt/live/{{ domain_name }}/{{ domain_name }}.pem
+{% endif %}
+service haproxy "{{ service_state }}"