infrastructure/ansible
1
0
Fork 0
Code Pull requests 7 Activity Actions

proxies / reverseproxy: Try and clean up logic and whitespace.

Browse source 
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
This commit is contained in:
Kevin Fenzi 2022-06-05 11:24:24 -07:00
parent bf979b32ba
commit 7e90378b30
1 changed files with 38 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

74
roles/httpd/reverseproxy/templates/reversepassproxy.conf
View file

@ -18,39 +18,40 @@ ProxyPreserveHost On
{% endif %}
{% if balancer_name is defined %}
# This is using openshift or another thing we want to balance in httpd
{% if targettype == 'openshift' or if ( 'iad2' in inventory_hostname and ocp4|bool ) %}
# This is a openshift3 app on a proxy anywhere, or a openshift4 one only in iad2
# This is something that wants a apache balancer
{% if 'iad2' in inventory_hostname %}
# This proxy is in iad2 and so we setup the balancer.
# Non iad2 proxies just send a 421 for this application to avoid firefox h2 reuse bug
SSLProxyEngine On
{% if targettype is defined and targettype == "openshift" %}
SSLProxyVerify require
SSLProxyCheckPeerName Off
{% if ocp4 and env == "production" %}
SSLProxyCACertificateFile "/etc/haproxy/ocp-prod.pem"
{% elif ocp4 and env == "staging" %}
SSLProxyCACertificateFile "/etc/haproxy/ocp-stg.pem"
{% else %}
SSLProxyCACertificateFile "/etc/haproxy/os-master.pem"
{% endif %}
SSLProxyVerify require
SSLProxyCheckPeerName Off
{% if ocp4 and env == "production" %}
SSLProxyCACertificateFile "/etc/haproxy/ocp-prod.pem"
{% elif ocp4 and env == "staging" %}
SSLProxyCACertificateFile "/etc/haproxy/ocp-stg.pem"
{% else %}
SSLProxyCACertificateFile "/etc/haproxy/os-master.pem"
{% endif %}
{% endif %}
<Proxy "balancer://{{balancer_name}}-websocket">
{% for member in balancer_members %}
{% if http_not_https_yes_this_is_insecure_and_i_feel_bad %}
{% if remotepath is defined and remotepath != "/" %}
BalancerMember "ws://{{ member }}{{ remotepath }}"
{% else %}
BalancerMember "ws://{{ member }}"
{% endif %}
{% else %}
{% if remotepath is defined and remotepath != "/" %}
BalancerMember "wss://{{ member }}{{ remotepath }}"
{% else %}
BalancerMember "wss://{{ member }}"
{% endif %}
{% endif %}
{% endfor %}
{% for member in balancer_members %}
{% if http_not_https_yes_this_is_insecure_and_i_feel_bad %}
{% if remotepath is defined and remotepath != "/" %}
BalancerMember "ws://{{ member }}{{ remotepath }}"
{% else %}
BalancerMember "ws://{{ member }}"
{% endif %}
{% else %}
{% if remotepath is defined and remotepath != "/" %}
BalancerMember "wss://{{ member }}{{ remotepath }}"
{% else %}
BalancerMember "wss://{{ member }}"
{% endif %}
{% endif %}
{% endfor %}
</Proxy>
RewriteEngine on
@ -62,22 +63,23 @@ RewriteCond %{REQUEST_URI} ^{{ remotepath }}/(.)*
RewriteRule .* "balancer://{{ balancer_name }}-websocket%{REQUEST_URI}" [P]
<Proxy "balancer://{{balancer_name}}">
{% for member in balancer_members %}
{% if http_not_https_yes_this_is_insecure_and_i_feel_bad %}
BalancerMember "http://{{ member }}"
{% else %}
BalancerMember "https://{{ member }}"
{% endif %}
{% endfor %}
{% for member in balancer_members %}
{% if http_not_https_yes_this_is_insecure_and_i_feel_bad %}
BalancerMember "http://{{ member }}"
{% else %}
BalancerMember "https://{{ member }}"
{% endif %}
{% endfor %}
</Proxy>
ProxyPass {{ localpath }} "balancer://{{balancer_name}}{{remotepath}}"
ProxyPassReverse {{ localpath }} "balancer://{{balancer_name}}{{remotepath}}"
{% elif ocp4|bool and not 'iad2' in inventory_hostname %}
# This is a non iad2 proxy and an openshift4 app
{% else %}
# This is a non iad2 proxy and an app that only exists in iad2
# We do this to avoid a h2 connection reuse bug by firefox.
Redirect 421 /
{% endif %}
{% else %}
# This is an application that just goes to one url, not a balancer
ProxyPass {{ localpath }} {{ proxyurl }}{{remotepath}} {{ proxyopts }}
ProxyPassReverse {{ localpath }} {{ proxyurl }}{{remotepath}}
{% endif %}