First version in Galaxy

seb4itik/byow/roles/keepalived/README.md

@@ -0,0 +1,5 @@
+# BYOW - Build Your Own WAF
+
+A WAF _à la carte_.
+
+## Keepalived

seb4itik/byow/roles/keepalived/defaults/main.yml

@@ -0,0 +1,16 @@
+# Required
+keepalived_script_user: null
+keepalived_monitored_process: null
+keepalived_vrrp_password: null     # Max 8 characters
+keepalived_vrrp_ips: null
+# - master: <string>
+#   virtual_router_id: <int>
+#   addr: <string>
+
+# Optionnal
+keepalived_alerts_to: []
+keepalived_unicast_peers: []
+
+# Required if length keepalived_alerts_to > 0
+keepalived_smtp_from: null
+keepalived_smtp_relay: null

seb4itik/byow/roles/keepalived/handlers/main.yml

@@ -0,0 +1,4 @@
+- name: Restart keepalived
+  ansible.builtin.service:
+    name: "keepalived"
+    state: "restarted"

seb4itik/byow/roles/keepalived/tasks/main.yml

@@ -0,0 +1,28 @@
+- name: Installation des paquetages
+  ansible.builtin.apt:
+    name:
+      - "keepalived"
+  notify:
+    - "Restart keepalived"
+
+- name: Tell kernel to allow binding non-local IP
+  ansible.posix.sysctl:
+    name: "net.ipv4.ip_nonlocal_bind"
+    value: "1"
+    sysctl_set: true
+  notify:
+    - "Restart keepalived"
+
+- name: Generate keepalived.conf file
+  ansible.builtin.template:
+    src: "templates/keepalived.conf"
+    dest: "/etc/keepalived/keepalived.conf"
+    mode: "0640"
+  notify:
+    - "Restart keepalived"
+
+- name: Activate and start keepalived
+  ansible.builtin.service:
+    name: "keepalived"
+    state: "started"
+    enabled: true

seb4itik/byow/roles/keepalived/templates/keepalived.conf

@@ -0,0 +1,58 @@
+# FIXME: NOTICE: setting config option max_auto_priority should result in better keepalived performance
+
+global_defs {
+  enable_script_security
+  script_user "{{ keepalived_script_user }}"
+{% if keepalived_alerts_to | length > 0 %}
+
+  notification_email {
+{% for dest in keepalived_alerts_to %}
+    {{ dest }}
+{% endfor %}
+  }
+  notification_email_from {{ keepalived_smtp_from }}
+  smtp_server {{ keepalived_smtp_relay }}
+  smtp_connect_timeout 30
+  router_id {{ ansible_hostname }}
+{% endif %}
+}
+
+vrrp_script chk_{{ keepalived_monitored_process }} {
+  script "/usr/bin/killall -0 {{ keepalived_monitored_process }}"   # Check if process is running
+  interval 2                             # Check every 2 seconds
+  weight 2                               # Weight to influence master election
+}
+{% for ip in keepalived_vrrp_ips %}
+
+# master: {{ ip.master }}
+vrrp_instance VI_{{ ip.virtual_router_id }} {
+  state {{ (ansible_hostname==ip.master) | ternary('MASTER', 'BACKUP') }}
+  interface {{ ansible_default_ipv4.interface }}
+  virtual_router_id {{ ip.virtual_router_id }}
+  priority {{ (ansible_hostname==ip.master) | ternary('101', '100') }}
+  advert_int 1
+  promote_secondaries
+{% if keepalived_alerts_to | length > 0 %}
+  smtp_alert true
+{% endif %}
+  authentication {
+    auth_type PASS
+    auth_pass {{ keepalived_vrrp_password }}
+  }
+  virtual_ipaddress {
+    {{ ip.addr }}
+  }
+{% if keepalived_unicast_peers | length > 0 %}
+  unicast_peer {
+{% for peer in keepalived_unicast_peers %}
+{% if peer != ansible_default_ipv4.address %}
+    {{ peer }}
+{% endif %}
+{% endfor %}
+  }
+{% endif %}
+  track_script {
+    chk_{{ keepalived_monitored_process }}
+  }
+}
+{% endfor %}