summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--pillar/cluster/denc/web-proxy.sls65
1 files changed, 61 insertions, 4 deletions
diff --git a/pillar/cluster/denc/web-proxy.sls b/pillar/cluster/denc/web-proxy.sls
index 4cf84ab..923369e 100644
--- a/pillar/cluster/denc/web-proxy.sls
+++ b/pillar/cluster/denc/web-proxy.sls
@@ -2,13 +2,70 @@
{%- set trustcrt = '/usr/share/pki/trust/anchors/syscid-ca.crt' -%}
{%- set stapler = 'http://gaia.syscid.com:8900/' -%}
{%- set resolver = '192.168.0.115' -%}
+{%- set mailer = '192.168.0.120' -%}
+{%- set ha4 = '81.16.19.62' -%}
+{%- set ha6 = '2a03:4000:20:21f::' -%}
+
+keepalived:
+ config:
+ global_defs:
+ notification_email:
+ - system@lysergic.dev
+ notification_email_from: failover@{{ grains['host'] }}.lysergic.dev
+ smtp_server: {{ mailer }}
+ smtp_connect_timeout: 30
+ router_id: SSO_FO
+ vrrp_script:
+ check_nginx_port:
+ script: '"/usr/bin/curl -kfsSm2 https://[::1]:443"'
+ weight: 5
+ interval: 3
+ timeout: 3
+ check_nginx_process:
+ {#- this is not a good check but better than nothing #}
+ script: '"/usr/bin/pgrep nginx"'
+ weight: 4
+ interval: 2
+ timeout: 10
+ check_useless_process:
+ {#- this is only used for debugging #}
+ script: '"/usr/bin/pgrep useless.sh"'
+ weight: 4
+ interval: 2
+ timeout: 3
+ vrrp_instance:
+ DENCWC:
+ state: MASTER
+ interface: eth1
+ priority: 100
+ virtual_router_id: 100
+ advert_int: 5
+ smtp_alert: true
+ notify_master: '"/usr/local/bin/failover --all"'
+ promote_secondaries: true
+ mcast_src_ip: 192.168.0.50
+ authentication:
+ auth_type: PASS
+ auth_pass: ${'secret_keepalived:vrrp_instance:DENCWC'}
+ virtual_ipaddress:
+ - {{ ha4 }}/32 dev eth0 label failover
+ virtual_ipaddress_excluded:
+ - {{ ha6 }}/64 dev eth0
+ {%- for i in [1, 2, 3] %}
+ - {{ ha6 }}{{ i }}/64 dev eth0
+ {%- endfor %}
+ track_script:
+ {#- - check_nginx_port # to-do: this is currently bugged, check script locks up #}
+ - check_nginx_process
+ track_interface:
+ - eth0
nginx:
snippets:
listen_ha:
- listen:
- - 81.16.19.62:443 ssl http2
- - '[2a03:4000:20:21f::]:443 ssl http2'
+ - {{ ha4 }}:443 ssl http2
+ - '[{{ ha6 }}]:443 ssl http2'
proxy:
- proxy_set_header:
- Host $host
@@ -75,8 +132,8 @@ nginx:
config:
- server:
- listen:
- - 81.16.19.62:80 default_server
- - '[2a03:4000:20:21f::]:80 default_server'
+ - {{ ha4 }}:80 default_server
+ - '[{{ ha6 }}]:80 default_server'
- include: snippets/robots
- location /:
- return: 301 https://$host$request_uri