<commit_before>---
named_interfaces::config:
  mgmt:
    - eth0
  public:
    - eth1

corosync::cluster_name:   '%{::location}-ha-test'
corosync::unicast_addresses:
  - "%{hiera('netcfg_public2_netpart')}.190"
  - "%{hiera('netcfg_public2_netpart')}.191"

corosync::quorum_members:
  - "%{hiera('netcfg_public2_netpart')}.190"
  - "%{hiera('netcfg_public2_netpart')}.191"

corosync_cluster_node1:   "%{::location}-ha-test-01.%{hiera('domain_mgmt')}"
corosync_cluster_node2:   "%{::location}-ha-test-02.%{hiera('domain_mgmt')}"

corosync_cluster_vip1:    "%{hiera('netcfg_public2_netpart')}.34"  # pubtestproxy.ha
corosync_cluster_vip2:    "%{hiera('netcfg_public2_netpart')}.35"  # pubtestproxy.ha
corosync_cluster_vip3:    "%{hiera('netcfg_public2_netpart')}.243" # uibtestproxy.ha
corosync_cluster_vip4:    "%{hiera('netcfg_public2_netpart')}.244" # uibtestproxy.ha
corosync_cluster_vip5:    "%{hiera('netcfg_public2_netpart')}.245" # ssltestproxy.ha
corosync_cluster_vip6:    "%{hiera('netcfg_public2_netpart')}.198" # ssltestproxy.ha

# dummy cert, change with correct to test valid certs!
ssl_cert_apps:          'appstest.uib.no.pem'
ssl_cert_apps_admin:    'appstest-admin.uib.no.pem'
ssl_cert_nrec_docs:     'appstest.uib.no.pem'
ssl_cert_nrec_www:      'appstest.uib.no.pem'
ssl_cert_nrec:          'appstest.uib.no.pem'

haproxy::global_options:
  log:          '127.0.0.1 local6 info alert'
  #nbproc:       '2'
  #cpu-map:      ['1 0', '2 2']
  maxconn:      '2000' # per core
  crt-base:     '/etc/pki/tls/certs'
  tune.ssl.default-dh-param:  2048
  ssl-default-bind-options:   'no-sslv3 no-tls-tickets no-tlsv10 no-tlsv11'
  ssl-default-bind-ciphers:   'ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS'
  ssl-default-server-options: 'no-sslv3 no-tls-tickets no-tlsv10 no-tlsv11'
  ssl-default-server-ciphers: 'ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS'


profile::highavailability::loadbalancing::haproxy::haproxy_balancermembers:
# Apps
  'ssl-https-apps':
    listening_service:  'ssl-https-apps'
    ports:              443
    server_names:       ['apps-test05.uib.no', 'apps-test06.uib.no']
    ipaddresses:        ['172.16.17.32', '172.16.31.10']
    options:            'verify none inter 120s check check-ssl ssl'
  'ssl-https-apps-admin':
    listening_service:  'ssl-https-apps-admin'
    ports:              443
    server_names:       ['apps-test02.uib.no']
    ipaddresses:        ['192.168.3.11']
    options:             'verify none inter 120s check check-ssl ssl'
<commit_msg>Added distinct firewall rules for uib-ha-test<commit_after>---
named_interfaces::config:
  mgmt:
    - eth0
  public:
    - eth1

# This should merge in a way where the result is:
# 1) from ha.yaml unless defined here
# 2) use ha-test.yaml if defined here (no deep merge)
profile::highavailability::loadbalancing::haproxy::merge_strategy: 'hash'

corosync::cluster_name:   '%{::location}-ha-test'
corosync::unicast_addresses:
  - "%{hiera('netcfg_public2_netpart')}.190"
  - "%{hiera('netcfg_public2_netpart')}.191"

corosync::quorum_members:
  - "%{hiera('netcfg_public2_netpart')}.190"
  - "%{hiera('netcfg_public2_netpart')}.191"

corosync_cluster_node1:   "%{::location}-ha-test-01.%{hiera('domain_mgmt')}"
corosync_cluster_node2:   "%{::location}-ha-test-02.%{hiera('domain_mgmt')}"

corosync_cluster_vip1:    "%{hiera('netcfg_public2_netpart')}.34"  # pubtestproxy.ha
corosync_cluster_vip2:    "%{hiera('netcfg_public2_netpart')}.35"  # pubtestproxy.ha
corosync_cluster_vip3:    "%{hiera('netcfg_public2_netpart')}.243" # uibtestproxy.ha
corosync_cluster_vip4:    "%{hiera('netcfg_public2_netpart')}.244" # uibtestproxy.ha
corosync_cluster_vip5:    "%{hiera('netcfg_public2_netpart')}.245" # ssltestproxy.ha
corosync_cluster_vip6:    "%{hiera('netcfg_public2_netpart')}.198" # ssltestproxy.ha

# dummy cert, change with correct to test valid certs!
ssl_cert_apps:          'appstest.uib.no.pem'
ssl_cert_apps_admin:    'appstest-admin.uib.no.pem'
ssl_cert_nrec_docs:     'appstest.uib.no.pem'
ssl_cert_nrec_www:      'appstest.uib.no.pem'
ssl_cert_nrec:          'appstest.uib.no.pem'

haproxy::global_options:
  log:          '127.0.0.1 local6 info alert'
  #nbproc:       '2'
  #cpu-map:      ['1 0', '2 2']
  maxconn:      '2000' # per core
  crt-base:     '/etc/pki/tls/certs'
  tune.ssl.default-dh-param:  2048
  ssl-default-bind-options:   'no-sslv3 no-tls-tickets no-tlsv10 no-tlsv11'
  ssl-default-bind-ciphers:   'ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS'
  ssl-default-server-options: 'no-sslv3 no-tls-tickets no-tlsv10 no-tlsv11'
  ssl-default-server-ciphers: 'ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS'

# Firewall
profile::firewall::rules::custom_rules:
  '451 haproxy http for public vip1':
    proto:        'tcp'
    dport:        [ '80', '443', '389', '636' ]
    destination:  "%{hiera('corosync_cluster_vip1')}"
  '452 haproxy http for public vip2':
    proto:        'tcp'
    dport:        [ '80', '443', '389', '636' ]
    destination:  "%{hiera('corosync_cluster_vip2')}"
  '453 haproxy http for internal vip3':
    proto:        'tcp'
    dport:        [ '80', '443', '389', '636' ]
    source:       '172.16.31.10/16'
    destination:  "%{hiera('corosync_cluster_vip3')}"
  '454 haproxy http for internal vip4':
    proto:        'tcp'
    dport:        [ '80', '443', '389', '636' ]
    source:       '172.16.31.10/16'
    destination:  "%{hiera('corosync_cluster_vip4')}"
  '456 haproxy http for public vip5':
    proto:        'tcp'
    dport:        [ '80', '443' ]
    source:
      - '172.16.31.10/16'
      - '172.16.17.32/24'
      - '172.16.31.10/24'
      - '172.16.31.10/24'
      - '172.16.58.3/24'
    destination:  "%{hiera('corosync_cluster_vip5')}"
  '456 haproxy http for public vip6':
    proto:        'tcp'
    dport:        [ '80', '443' ]
    source:
      - '172.16.31.10/16'
      - '172.16.17.32/24'
      - '172.16.31.10/24'
      - '172.16.31.10/24'
      - '172.16.58.3/24'
    destination:  "%{hiera('corosync_cluster_vip6')}"
  '455 haproxy status public':
    proto:        'tcp'
    dport:        ['9000']
    source:
      - '192.168.127.12/24'
      - '192.168.3.11/32' # bgo-login
    destination:  '%{::ipaddress_public1}'
  '456 haproxy status mgmt':
    proto:        'tcp'
    dport:        ['9000']
    source:       '172.31.0.10/32' #bgo-login
    destination:  '%{::ipaddress_mgmt1}'


profile::highavailability::loadbalancing::haproxy::haproxy_balancermembers:
# Apps
  'ssl-https-apps':
    listening_service:  'ssl-https-apps'
    ports:              443
    server_names:       ['apps-test05.uib.no', 'apps-test06.uib.no']
    ipaddresses:        ['172.16.17.32', '172.16.31.10']
    options:            'verify none inter 120s check check-ssl ssl'
  'ssl-https-apps-admin':
    listening_service:  'ssl-https-apps-admin'
    ports:              443
    server_names:       ['apps-test02.uib.no']
    ipaddresses:        ['192.168.3.11']
    options:             'verify none inter 120s check check-ssl ssl'

{'fraction_non_alphanumeric': 0.16687456687456687, 'fraction_numerical': 0.07761607761607761, 'mean_word_length': 3.357487922705314, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 23, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4717056', 'n_tokens_mistral': 3357, 'n_tokens_neox': 3029, 'n_words': 419}