<commit_before>---
# Allow ports in selinux|
profile::base::selinux::ports:
  sfb-https:
    seltype:  'http_port_t'
    protocol: 'tcp'
    port:     4443
  ldaps:
    seltype:  'http_port_t'
    protocol: 'tcp'
    port:     636
  ldap:
    seltype:  'http_port_t'
    protocol: 'tcp'
    port:     389
  grid-https:
    seltype:  'http_port_t'
    protocol: 'tcp'
    port:     18082


mgmt__address__logger: '192.168.3.11'

ssl_cert_apps:          'apps.uib.no.pem'
ssl_cert_nrec_docs:     'docs.nrec.no.pem'
ssl_cert_nrec_www:      'www.nrec.no.pem'
ssl_cert_nrec:          'nrec.no.pem'

#
# Default interfaces
#
named_interfaces::config:
  mgmt:
    - em1
  public:
    - bond0.6

# Access lists
profile::highavailability::loadbalancing::haproxy::access_list:
  uib_vpn_net:
    ips:
      - 172.16.58.3/32 # uib-guest
      - 172.16.17.32/24 # vpn-gw
      - 192.168.3.11/24 # vpn-gw
      - 172.16.31.10/24 # vpn-ansatt
      - 192.168.127.12/24 # vpn-ansatt
      - 172.16.31.10/24 # vpn-student
      - 192.168.127.12/24 # vpn-student
      - 172.16.58.3/26 # vpn
      - 192.168.127.12/23 # new vpn
      - 172.16.31.10/32 # login

corosync::unicast_addresses:
  - "%{hiera('netcfg_public_netpart')}.96"
  - "%{hiera('netcfg_public_netpart')}.97"

corosync::quorum_members:
  - "%{hiera('netcfg_public_netpart')}.96"
  - "%{hiera('netcfg_public_netpart')}.97"

corosync_cluster_node1:   "%{::location}-ha-01.%{hiera('domain_mgmt')}"
corosync_cluster_node2:   "%{::location}-ha-02.%{hiera('domain_mgmt')}"

corosync_cluster_vip1:    "%{hiera('netcfg_public_netpart')}.200" # pubproxy.ha.uib.no
corosync_cluster_vip2:    "%{hiera('netcfg_public_netpart')}.201" # pubproxy.ha.uib.no
corosync_cluster_vip3:    "%{hiera('netcfg_public_netpart')}.91"  # uibproxy.ha.uib.no
corosync_cluster_vip4:    "%{hiera('netcfg_public_netpart')}.114" # uibproxy.ha.uib.no
corosync_cluster_vip5:    "%{hiera('netcfg_public_netpart')}.166" # sslproxy.ha.uib.no
corosync_cluster_vip6:    "%{hiera('netcfg_public_netpart')}.241" # sslproxy.ha.uib.no

# Firewall
profile::firewall::rules::custom_rules:
  '451 haproxy http for public vip1':
    proto:        'tcp'
    dport:        [ '80', '443', '389', '636' ]
    destination:  "%{hiera('corosync_cluster_vip1')}"
  '452 haproxy http for public vip2':
    proto:        'tcp'
    dport:        [ '80', '443', '389', '636' ]
    destination:  "%{hiera('corosync_cluster_vip2')}"
  '453 haproxy http for internal vip3':
    proto:        'tcp'
    dport:        [ '80', '443', '389', '636' ]
    source:       '172.16.17.32/16'
    destination:  "%{hiera('corosync_cluster_vip3')}"
  '454 haproxy http for internal vip4':
    proto:        'tcp'
    dport:        [ '80', '443', '389', '636' ]
    source:       '172.16.17.32/16'
    destination:  "%{hiera('corosync_cluster_vip4')}"
  '456 haproxy http for public vip5':
    proto:        'tcp'
    dport:        [ '80', '443' ]
    source:       '0.0.0.0/0'
    destination:  "%{hiera('corosync_cluster_vip5')}"
  '456 haproxy http for public vip6':
    proto:        'tcp'
    dport:        [ '80', '443' ]
    source:       '0.0.0.0/0'
    destination:  "%{hiera('corosync_cluster_vip6')}"
  '455 haproxy status public':
    proto:        'tcp'
    dport:        ['9000']
    source:
      - '172.16.17.32/24'
      - '172.16.31.10/32' # bgo-login
    destination:  '%{::ipaddress_public1}'
  '456 haproxy status mgmt':
    proto:        'tcp'
    dport:        ['9000']
    source:       '172.31.0.10/32' #bgo-login
    destination:  '%{::ipaddress_mgmt1}'

# HAproxy
haproxy::global_options:
  log:          '127.0.0.1 local6 info alert'
  nbproc:       '2'
  cpu-map:      ['1 0', '2 2']
  maxconn:      '20000' # per core
  crt-base:     '/etc/pki/tls/certs'
  tune.ssl.default-dh-param:  2048
  ssl-default-bind-options:   'no-sslv3 no-tls-tickets no-tlsv10 no-tlsv11'
  ssl-default-bind-ciphers:   'ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS'
  ssl-default-server-options: 'no-sslv3 no-tls-tickets no-tlsv10 no-tlsv11'
  ssl-default-server-ciphers: 'ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS'

haproxy::defaults_options:
  log:          'global'  #FIXME turn of debug logging in production
  stats:        []
  option:       ['dontlognull', 'httplog', 'http-server-close', 'redispatch']
  maxconn:      '2000' # per frontend
  timeout:
    - 'connect 10s'
    - 'http-keep-alive 10s'
    - 'check 10s'
    - 'http-request 10s'
    - 'client 30s'
    - 'server 30s'
    - 'queue 30s'
    - 'tunnel 3m' # needed for exchange

profile::highavailability::loadbalancing::haproxy::haproxy_mapfile:
  uib_https_domains:
    ensure: present
    mappings:
      - 'apps-admin.uib.no':                      'uib-https-apps-admin'
      - 'apps-gw.uib.no':                         'uib-https-apps-gw'
      - 'exch.uib.no':                            'uib-https-exch'
      - 'portal.uib.no':                          'uib-https-adm'
  uib_http_domains:
    ensure: present
    mappings:
      - 'portal.uib.no':                          'uib-http-adm'
  public_https_domains:
    ensure: present
    mappings:
      - 'apps.uib.no':                            'public-https-apps'
      - 'appsanywhere.uib.no':                    'public-https-apps'
      - 'report.uh-iaas.no':                      'public-https-uh-report'
      - 'status.uh-iaas.no':                      'public-https-uh-status'
      - 'report.nrec.no':                         'public-https-uh-report'
      - 'status.nrec.no':                         'public-https-uh-status'
  public_http_domains:
    ensure: present
    mappings:
      - 'apps.uib.no':                            'ssl-https-apps'
      - 'appsanywhere.uib.no':                    'ssl-https-apps'
      - 'docs.uh-iaas.no':                        'public-http-uh-docs'
      - 'report.uh-iaas.no':                      'public-http-nrec-redirect'
      - 'status.uh-iaas.no':                      'public-http-nrec-redirect'
      - 'report.nrec.no':                         'public-http-nrec-redirect'
      - 'status.nrec.no':                         'public-http-nrec-redirect'
  ssl_https_domains:
    ensure: present
    mappings:
      - 'apps.uib.no':                            'ssl-https-apps'
      - 'appsanywhere.uib.no':                    'ssl-https-apps'
      - 'docs.nrec.no':                           'ssl-https-nrec-docs'
      - 'www.nrec.no':                            'ssl-https-nrec-www'
      - 'nrec.no':                                'ssl-https-nrec-www'
  ssl_http_domains:
    ensure: present
    mappings:
      - 'apps.uib.no':                            'ssl-http-apps'
      - 'appsanywhere.uib.no':                    'ssl-http-apps'
      - 'docs.nrec.no':                           'public-http-nrec-redirect'
      - 'www.nrec.no':                            'public-http-nrec-redirect'
      - 'nrec.no':                                'public-http-nrec-redirect'

profile::highavailability::loadbalancing::haproxy::haproxy_balancermembers:
  'public-https-uh-status':
    listening_service:  'public-https-uh-status'
    ports:              443
    server_names:       ['status-osl', 'status-bgo']
    ipaddresses:        ['172.16.31.10', '192.168.3.11']
    options:            'verify none inter 1000 check check-ssl'
  'public-https-uh-report':
    listening_service:  'public-https-uh-report'
    ports:              443
    server_names:       ['report-osl', 'report-bgo']
    ipaddresses:        ['172.16.31.10', '192.168.3.11']
    options:            'verify none inter 1000 check check-ssl'
  'ssl-https-nrec-www':
    listening_service:  'ssl-https-nrec-www'
    ports:              443
    server_names:       ['www01']
    ipaddresses:        ['norcams.github.io']
    options:            'verify none inter 1000 check check-ssl ssl'
  'ssl-https-nrec-docs':
    listening_service:  'ssl-https-nrec-docs'
    ports:              443
    server_names:       ['docs01']
    ipaddresses:        ['uh-iaas.readthedocs.io']
    options:            'verify none inter 1000 check check-ssl ssl'
  'ssl-https-apps':
    listening_service:  'ssl-https-apps'
    ports:              443
    server_names:       ['appsanywhere05.uib.no', 'appsanywhere06.uib.no']
    ipaddresses:        ['192.168.3.11', '172.16.17.32']
    options:            'verify none inter 120 check check-ssl ssl'
#    define_cookies:     true
  'public-https-apps':
    listening_service:  'public-https-apps'
    ports:              443
    server_names:       ['appsanywhere05.uib.no', 'appsanywhere06.uib.no']
    ipaddresses:        ['192.168.3.11', '172.16.17.32']
    options:            'check'
  'public-ldap-prod':
    listening_service:  'public-ldap-prod'
    ports:              '389'
    server_names:       ['p1ldap01.uib.no', 'p2ldap01.uib.no', 'p1ldap02.uib.no', 'p2ldap02.uib.no']
    ipaddresses:        ['192.168.127.12', '192.168.127.12', '172.16.17.32', '172.16.58.3']
    options:
      - 'check'
  'public-ldaps-prod':
    listening_service:  'public-ldaps-prod'
    ports:              '636'
    server_names:       ['p1ldap01.uib.no', 'p2ldap01.uib.no', 'p1ldap02.uib.no', 'p2ldap02.uib.no']
    ipaddresses:        ['192.168.127.12', '192.168.127.12', '172.16.17.32', '172.16.58.3']
    options:
      - 'check'
  'uib-https-exch':
    listening_service:  'uib-https-exch'
    ports:              443
    server_names:       ['exchange01.uib.no', 'exchange02.uib.no']
    ipaddresses:        ['172.16.31.10','172.16.58.3']
    options:            'check'
  'uib-https-adm':
    listening_service:  'uib-https-adm'
    ports:              443
    server_names:       ['rd-web01.uib.no', 'rd-web02.uib.no']
    ipaddresses:        ['192.168.3.11', '192.168.127.12']
    options:
      - 'check'
  'uib-https-apps-admin':
    listening_service:  'uib-https-apps-admin'
    ports:              443
    server_names:       ['apps-admin01.uib.no', 'apps-admin02.uib.no']
    ipaddresses:        ['172.16.17.32', '192.168.127.12']
    options:
      - 'check'
  'uib-https-apps-gw':
    listening_service:  'uib-https-apps-gw'
    ports:              443
    server_names:       ['apps-gw01.uib.no', 'apps-gw02.uib.no']
    ipaddresses:        ['172.16.17.32', '172.16.17.32']
    options:
      - 'check'
  'uib-http-adm':
    listening_service:  'uib-http-adm'
    ports:              80
    server_names:       ['rd-web01.uib.no', 'rd-web02.uib.no']
    ipaddresses:        ['192.168.3.11', '192.168.127.12']
    options:
      - 'check'
  'uib-ldap-test':
    listening_service:  'uib-ldap-test'
    ports:              '389'
    server_names:       ['t1ldap01.uib.no']
    ipaddresses:        ['192.168.127.12']
    options:
      - 'check'
  'uib-ldaps-test':
    listening_service:  'uib-ldaps-test'
    ports:              '636'
    server_names:       ['t1ldap01.uib.no']
    ipaddresses:        ['192.168.127.12']
    options:
      - 'check'
  'uib-https-grid':
    listening_service:  'uib-https-grid'
    ports:              18082
    server_names:       ['uib-grid-01.grid.uib.no', 'uib-grid-02.grid.uib.no', 'uib-grid-03.grid.uib.no', 'uib-grid-04.grid.uib.no']
    ipaddresses:        ['172.16.31.10', '192.168.127.12', '172.16.17.32', '172.16.17.32']
    options:
      - 'check'
      - 'check-ssl'
      - 'verify none'

profile::highavailability::loadbalancing::haproxy::haproxy_backends:
  public-https-apps:
    mode:             'tcp'
    options:
      - balance:      'source'
      - http-check: 'expect status 200'
      # Session stick table and based on source IP
      - stick-table: 'type ip size 1m expire 1h'
      - stick: 'on src'
      - timeout:
        - 'server 1m'
        - 'queue 1m'
  ssl-https-apps:
    mode:             'http'
    options:
      - balance:      'leastconn'
      - option:
        - 'forwardfor except 127.0.0.1'
        - 'httpchk GET /healthcheck'
      - http-check: 'expect status 200'
      # Session stick table and based on source IP
      - stick-table: 'type ip size 1m expire 1h'
      - stick: 'on src'
      - timeout:
        - 'server 1m'
        - 'queue 1m'
  ssl-http-apps:
    mode:             'http'
    options:
      - balance:      'roundrobin'
      - redirect:     'scheme https if !{ ssl_fc }'
  ssl-https-nrec-www:
    mode:             'http'
    options:
      - balance:      'source'
      - option:
        - 'forwardfor except 127.0.0.1'
      - http-request:
        - 'set-header Host norcams.github.io'
  ssl-https-nrec-docs:
    mode:             'http'
    options:
      - balance:      'source'
      - option:
        - 'forwardfor except 127.0.0.1'
      - http-request:
        - 'set-header Host uh-iaas.readthedocs.io'
  public-http-nrec-redirect:
    mode:             'http'
    options:
      - balance:      'roundrobin'
      - redirect:     'scheme https if !{ ssl_fc }'
  public-http-uh-docs:
    mode:             'http'
    options:
      - redirect:     'code 301 location https://docs.nrec.no'
  public-https-uh-status:
    mode:             'tcp'
    options:
      - balance:      'source'
      - option:
        - 'httpchk HEAD /api/health HTTP/1.1\r\nHost:\ status.uh-iaas.no'
  public-https-uh-report:
    mode:             'tcp'
    options:
      - balance:      'source'
      - option:
        - 'httpchk HEAD /health HTTP/1.1\r\nHost:\ report.uh-iaas.no'
  public-ldap-prod:
    mode:             'tcp'
    options:
      - balance:      'leastconn'
  public-ldaps-prod:
    mode:             'tcp'
    options:
      - balance:      'leastconn'
  uib-https-exch:
    mode:             'tcp'
    options:
      - balance:      'source'
  uib-https-apps-admin:
    mode:             'tcp'
    options:
      - balance:      'source'
      # - option:
      #   - 'httpchk HEAD /jukeboxserver/do/license/token/renew.tok?msid=ping HTTP/1.1\r\nHost:\ apps-admin.uib.no'
  uib-https-apps-gw:
    mode:             'tcp'
    options:
      - balance:      'roundrobin'
      #- cookie:       'ASP.NET_SessionId prefix nocache'
      # - option:
      #   - 'httpchk HEAD /jukeboxserver/do/license/token/renew.tok?msid=ping HTTP/1.1\r\nHost:\ apps-admin.uib.no'
  uib-https-adm:
    mode:             'tcp'
    options:
      - balance:      'roundrobin'
      - tcp-request:  'content reject if { src -f /etc/haproxy/uib_vpn_net.list }'
  uib-http-adm:
    mode:             'tcp'
    options:
      - balance:      'roundrobin'
      - tcp-request:  'content reject if { src -f /etc/haproxy/uib_vpn_net.list }'
  uib-ldap-test:
    mode:             'tcp'
    options:
      - balance:      'leastconn'
  uib-ldaps-test:
    mode:             'tcp'
    options:
      - balance:      'leastconn'
  uib-https-grid:
    mode:             'tcp'
    options:
      - balance:      'leastconn'
      - option:
        - 'httpchk OPTIONS / HTTP/1.1'

#  uib-https-uh-dashboard:
#    mode: 'tcp'
#    options:
#      - balance:      'source'
#      - option:       ['ssl-hello-chk']
#      - stick-table:  'type binary len 32 size 30k expire 30m'
#      - acl:
#        - 'clienthello req_ssl_hello_type 1'
#        - 'serverhello rep_ssl_hello_type 2'
#      - tcp-request:
#        - 'inspect-delay 15s'
#        - 'content reject unless clienthello'
#      - tcp-response:
#        - 'content reject unless serverhello'
#      - stick:
#        - 'on payload_lv(43,1) if clienthello'
#        - 'store-response payload_lv(43,1) if serverhello'

profile::highavailability::loadbalancing::haproxy::haproxy_frontends:
  public-http:
    mode:               'http'
    bind:
      "%{hiera('corosync_cluster_vip1')}:80": []
      "%{hiera('corosync_cluster_vip2')}:80": []
    options:
      - option:         'httplog'
      - use_backend:    '%[req.hdr(host),lower,map(/etc/haproxy/public_http_domains.map)]'
      - capture:        'request header Host len 32' #for debug
  public-https:
    mode:               'tcp'
    bind:
      "%{hiera('corosync_cluster_vip1')}:443": []
      "%{hiera('corosync_cluster_vip2')}:443": []
    options:
      - option:         'tcplog'
      - tcp-request:
        - 'inspect-delay 5s'
        - 'content accept if { req_ssl_hello_type 1 }'
      - use_backend:      '%[req_ssl_sni,lower,map(/etc/haproxy/public_https_domains.map)]'
  public-ldap:
    mode:               'tcp'
    bind:
      "%{hiera('corosync_cluster_vip1')}:389": []
      "%{hiera('corosync_cluster_vip2')}:389": []
    options:
      - option:         'tcplog'
      - use_backend:    'public-ldap-prod'
  public-ldaps:
    mode:               'tcp'
    bind:
      "%{hiera('corosync_cluster_vip1')}:636": []
      "%{hiera('corosync_cluster_vip2')}:636": []
    options:
      - option:         'tcplog'
      - use_backend:    'public-ldaps-prod'
  uib-http:
    mode:               'http'
    bind:
      "%{hiera('corosync_cluster_vip3')}:80": []
      "%{hiera('corosync_cluster_vip4')}:80": []
    options:
      - maxconn:        '16000' # max internal http connections
      - option:         'httplog'
      - use_backend:    '%[req.hdr(host),lower,map(/etc/haproxy/uib_http_domains.map)]'
      - capture:        'request header Host len 32' #for debug
  uib-https:
    mode:               'tcp'
    bind:
      "%{hiera('corosync_cluster_vip3')}:443": []
      "%{hiera('corosync_cluster_vip4')}:443": []
    options:
      - maxconn:        '16000' # max internal https connections
      - option:         'tcplog'
      - tcp-request:
        - 'inspect-delay 5s'
        - 'content accept if { req_ssl_hello_type 1 }'
      - use_backend:      '%[req_ssl_sni,lower,map(/etc/haproxy/uib_https_domains.map)]'
  uib-ldap:
    mode:               'tcp'
    bind:
      "%{hiera('corosync_cluster_vip3')}:389": []
      "%{hiera('corosync_cluster_vip4')}:389": []
    options:
      - option:         'tcplog'
      - use_backend:    'uib-ldap-test'
  uib-ldaps:
    mode:               'tcp'
    bind:
      "%{hiera('corosync_cluster_vip3')}:636": []
      "%{hiera('corosync_cluster_vip4')}:636": []
    options:
      - option:         'tcplog'
      - use_backend:    'uib-ldaps-test'
  ssl-http: #for redirect
    mode:               'http'
    bind:
      "%{hiera('corosync_cluster_vip5')}:80": []
      "%{hiera('corosync_cluster_vip6')}:80": []
    options:
      - option:         'httplog'
      - use_backend:    '%[req.hdr(host),lower,map(/etc/haproxy/ssl_http_domains.map)]'
      - capture:        'request header Host len 32' #for debug
  ssl-https:
    mode:               'http'
    bind:
      "%{hiera('corosync_cluster_vip5')}:443":
        - 'ssl'
        - 'crt'
        - "%{hiera('ssl_cert_apps')}"
        - 'ssl'
        - 'crt'
        - "%{hiera('ssl_cert_nrec')}"
        - 'ssl'
        - 'crt'
        - "%{hiera('ssl_cert_nrec_www')}"
        - 'ssl'
        - 'crt'
        - "%{hiera('ssl_cert_nrec_docs')}"
      "%{hiera('corosync_cluster_vip6')}:443":
        - 'ssl'
        - 'crt'
        - "%{hiera('ssl_cert_apps')}"
        - 'ssl'
        - 'crt'
        - "%{hiera('ssl_cert_nrec')}"
        - 'ssl'
        - 'crt'
        - "%{hiera('ssl_cert_nrec_www')}"
        - 'ssl'
        - 'crt'
        - "%{hiera('ssl_cert_nrec_docs')}"
    options:
      - option:         'http-server-close'
      - option:         'forwardfor'
      - use_backend:    '%[req.hdr(host),lower,map(/etc/haproxy/ssl_https_domains.map)]'
      # Prevents X-Forwarded-For spoofing
      - http-request:   'del-header ^X-Forwarded-For:.*'
      # - http-request:
      #   - 'add-header X-Forwarded-Proto https if { ssl_fc }'
      #   - 'set-header X-Forwarded-Port %[dst_port]'
  # uib-https-grid:
  #   mode:               'tcp'
  #   bind:
  #     "%{hiera('corosync_cluster_vip5')}:443": []
  #   options:
  #     - maxconn:        '5000' # max grid https connections
  #     - timeout:
  #       - 'connect 5s'
  #       - 'client 50s'
  #       - 'server 50s'
  #     - option:         'tcplog'
  #     - tcp-request:
  #       - 'inspect-delay 5s'
  #       - 'content accept if { req_ssl_hello_type 1 }'
  #     - use_backend:    'uib-https-grid'

# Corosync VIP and HAproxy
profile::highavailability::corosync::primitives:
  'pubip1':
    'primitive_class':    'ocf'
    'primitive_type':     'IPaddr2'
    'provided_by':        'heartbeat'
    'parameters':
      'ip':               "%{hiera('corosync_cluster_vip1')}"
      'cidr_netmask':     '24'
    operations:
      'monitor':          { 'interval': '10s', 'timeout': '20s' }
      'start':            { 'interval': '0s', 'timeout': '20s' }
      'stop':             { 'interval': '0s', 'timeout': '20s' }
  'pubip2':
    'primitive_class':    'ocf'
    'primitive_type':     'IPaddr2'
    'provided_by':        'heartbeat'
    'parameters':
      'ip':               "%{hiera('corosync_cluster_vip2')}"
      'cidr_netmask':     '24'
    operations:
      'monitor':          { 'interval': '10s', 'timeout': '20s' }
      'start':            { 'interval': '0s', 'timeout': '20s' }
      'stop':             { 'interval': '0s', 'timeout': '20s' }
  'uibip1':
    'primitive_class':    'ocf'
    'primitive_type':     'IPaddr2'
    'provided_by':        'heartbeat'
    'parameters':
      'ip':               "%{hiera('corosync_cluster_vip3')}"
      'cidr_netmask':     '24'
    operations:
      'monitor':          { 'interval': '10s', 'timeout': '20s' }
      'start':            { 'interval': '0s', 'timeout': '20s' }
      'stop':             { 'interval': '0s', 'timeout': '20s' }
  'uibip2':
    'primitive_class':    'ocf'
    'primitive_type':     'IPaddr2'
    'provided_by':        'heartbeat'
    'parameters':
      'ip':               "%{hiera('corosync_cluster_vip4')}"
      'cidr_netmask':     '24'
    operations:
      'monitor':          { 'interval': '10s', 'timeout': '20s' }
      'start':            { 'interval': '0s', 'timeout': '20s' }
      'stop':             { 'interval': '0s', 'timeout': '20s' }
  'sslip1':
    'primitive_class':    'ocf'
    'primitive_type':     'IPaddr2'
    'provided_by':        'heartbeat'
    'parameters':
      'ip':               "%{hiera('corosync_cluster_vip5')}"
      'cidr_netmask':     '24'
    operations:
      'monitor':          { "interval": "10s", "timeout": "20s" }
      'start':            { "interval": "0s", "timeout": "20s" }
      'stop':             { "interval": "0s", "timeout": "20s" }
  'sslip2':
    'primitive_class':    'ocf'
    'primitive_type':     'IPaddr2'
    'provided_by':        'heartbeat'
    'parameters':
      'ip':               "%{hiera('corosync_cluster_vip6')}"
      'cidr_netmask':     '24'
    operations:
      'monitor':          { "interval": "10s", "timeout": "20s" }
      'start':            { "interval": "0s", "timeout": "20s" }
      'stop':             { "interval": "0s", "timeout": "20s" }
  'haproxy':
    'primitive_class':    'systemd'
    'primitive_type':     'haproxy'
    'operations':
      'monitor':          { 'interval': '5s', 'timeout': '20s' }
      'start':            { 'interval': '0s', 'timeout': '20s' }
      'stop':             { 'interval': '0s', 'timeout': '20s' }

profile::highavailability::corosync::locations:
  'pubip_location1':
    primitive:  'pubip1'
    node_name:  "%{hiera('corosync_cluster_node1')}"
    score:      'INFINITY'
  'pubip_location2':
    primitive:  'pubip2'
    node_name:  "%{hiera('corosync_cluster_node2')}"
    score:      'INFINITY'
  'uibip_location1':
    primitive:  'uibip1'
    node_name:  "%{hiera('corosync_cluster_node1')}"
    score:      'INFINITY'
  'uibip_location2':
    primitive:  'uibip2'
    node_name:  "%{hiera('corosync_cluster_node2')}"
    score:      'INFINITY'
  'sslip_location1':
    primitive:  'sslip1'
    node_name:  "%{hiera('corosync_cluster_node1')}"
    score:      'INFINITY'
  'sslip_location2':
    primitive:  'sslip2'
    node_name:  "%{hiera('corosync_cluster_node2')}"
    score:      'INFINITY'

profile::highavailability::corosync::colocations:
  'pubip1_haproxy':
    primitives:   ['clone_haproxy', 'pubip1']
  'pubip2_haproxy':
    primitives:   ['clone_haproxy', 'pubip2']
  'uibip1_haproxy':
    primitives:   ['clone_haproxy', 'uibip1']
  'uibip2_haproxy':
    primitives:   ['clone_haproxy', 'uibip2']
  'sslip1_haproxy':
    primitives:   ['clone_haproxy', 'sslip1']
  'sslip2_haproxy':
    primitives:   ['clone_haproxy', 'sslip2']
<commit_msg>Fix iptables merge strategy for uib-ha<commit_after>---
# Allow ports in selinux|
profile::base::selinux::ports:
  sfb-https:
    seltype:  'http_port_t'
    protocol: 'tcp'
    port:     4443
  ldaps:
    seltype:  'http_port_t'
    protocol: 'tcp'
    port:     636
  ldap:
    seltype:  'http_port_t'
    protocol: 'tcp'
    port:     389
  grid-https:
    seltype:  'http_port_t'
    protocol: 'tcp'
    port:     18082


mgmt__address__logger: '192.168.3.11'

ssl_cert_apps:          'apps.uib.no.pem'
ssl_cert_nrec_docs:     'docs.nrec.no.pem'
ssl_cert_nrec_www:      'www.nrec.no.pem'
ssl_cert_nrec:          'nrec.no.pem'

#
# Default interfaces
#
named_interfaces::config:
  mgmt:
    - em1
  public:
    - bond0.6

# Access lists
profile::highavailability::loadbalancing::haproxy::access_list:
  uib_vpn_net:
    ips:
      - 172.16.58.3/32 # uib-guest
      - 172.16.17.32/24 # vpn-gw
      - 192.168.3.11/24 # vpn-gw
      - 172.16.31.10/24 # vpn-ansatt
      - 192.168.127.12/24 # vpn-ansatt
      - 172.16.31.10/24 # vpn-student
      - 192.168.127.12/24 # vpn-student
      - 172.16.58.3/26 # vpn
      - 192.168.127.12/23 # new vpn
      - 172.16.31.10/32 # login

corosync::unicast_addresses:
  - "%{hiera('netcfg_public_netpart')}.96"
  - "%{hiera('netcfg_public_netpart')}.97"

corosync::quorum_members:
  - "%{hiera('netcfg_public_netpart')}.96"
  - "%{hiera('netcfg_public_netpart')}.97"

corosync_cluster_node1:   "%{::location}-ha-01.%{hiera('domain_mgmt')}"
corosync_cluster_node2:   "%{::location}-ha-02.%{hiera('domain_mgmt')}"

corosync_cluster_vip1:    "%{hiera('netcfg_public_netpart')}.200" # pubproxy.ha.uib.no
corosync_cluster_vip2:    "%{hiera('netcfg_public_netpart')}.201" # pubproxy.ha.uib.no
corosync_cluster_vip3:    "%{hiera('netcfg_public_netpart')}.91"  # uibproxy.ha.uib.no
corosync_cluster_vip4:    "%{hiera('netcfg_public_netpart')}.114" # uibproxy.ha.uib.no
corosync_cluster_vip5:    "%{hiera('netcfg_public_netpart')}.166" # sslproxy.ha.uib.no
corosync_cluster_vip6:    "%{hiera('netcfg_public_netpart')}.241" # sslproxy.ha.uib.no

# Firewall
profile::firewall::rules::merge_strategy: first
profile::firewall::rules::custom_rules:
  '451 haproxy http for public vip1':
    proto:        'tcp'
    dport:        [ '80', '443', '389', '636' ]
    destination:  "%{hiera('corosync_cluster_vip1')}"
  '452 haproxy http for public vip2':
    proto:        'tcp'
    dport:        [ '80', '443', '389', '636' ]
    destination:  "%{hiera('corosync_cluster_vip2')}"
  '453 haproxy http for internal vip3':
    proto:        'tcp'
    dport:        [ '80', '443', '389', '636' ]
    source:       '172.16.17.32/16'
    destination:  "%{hiera('corosync_cluster_vip3')}"
  '454 haproxy http for internal vip4':
    proto:        'tcp'
    dport:        [ '80', '443', '389', '636' ]
    source:       '172.16.17.32/16'
    destination:  "%{hiera('corosync_cluster_vip4')}"
  '456 haproxy http for public vip5':
    proto:        'tcp'
    dport:        [ '80', '443' ]
    source:       '0.0.0.0/0'
    destination:  "%{hiera('corosync_cluster_vip5')}"
  '456 haproxy http for public vip6':
    proto:        'tcp'
    dport:        [ '80', '443' ]
    source:       '0.0.0.0/0'
    destination:  "%{hiera('corosync_cluster_vip6')}"
  '455 haproxy status public':
    proto:        'tcp'
    dport:        ['9000']
    source:
      - '172.16.17.32/24'
      - '172.16.31.10/32' # bgo-login
    destination:  '%{::ipaddress_public1}'
  '456 haproxy status mgmt':
    proto:        'tcp'
    dport:        ['9000']
    source:       '172.31.0.10/32' #bgo-login
    destination:  '%{::ipaddress_mgmt1}'

# HAproxy
haproxy::global_options:
  log:          '127.0.0.1 local6 info alert'
  nbproc:       '2'
  cpu-map:      ['1 0', '2 2']
  maxconn:      '20000' # per core
  crt-base:     '/etc/pki/tls/certs'
  tune.ssl.default-dh-param:  2048
  ssl-default-bind-options:   'no-sslv3 no-tls-tickets no-tlsv10 no-tlsv11'
  ssl-default-bind-ciphers:   'ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS'
  ssl-default-server-options: 'no-sslv3 no-tls-tickets no-tlsv10 no-tlsv11'
  ssl-default-server-ciphers: 'ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS'

haproxy::defaults_options:
  log:          'global'  #FIXME turn of debug logging in production
  stats:        []
  option:       ['dontlognull', 'httplog', 'http-server-close', 'redispatch']
  maxconn:      '2000' # per frontend
  timeout:
    - 'connect 10s'
    - 'http-keep-alive 10s'
    - 'check 10s'
    - 'http-request 10s'
    - 'client 30s'
    - 'server 30s'
    - 'queue 30s'
    - 'tunnel 3m' # needed for exchange

profile::highavailability::loadbalancing::haproxy::haproxy_mapfile:
  uib_https_domains:
    ensure: present
    mappings:
      - 'apps-admin.uib.no':                      'uib-https-apps-admin'
      - 'apps-gw.uib.no':                         'uib-https-apps-gw'
      - 'exch.uib.no':                            'uib-https-exch'
      - 'portal.uib.no':                          'uib-https-adm'
  uib_http_domains:
    ensure: present
    mappings:
      - 'portal.uib.no':                          'uib-http-adm'
  public_https_domains:
    ensure: present
    mappings:
      - 'apps.uib.no':                            'public-https-apps'
      - 'appsanywhere.uib.no':                    'public-https-apps'
      - 'report.uh-iaas.no':                      'public-https-uh-report'
      - 'status.uh-iaas.no':                      'public-https-uh-status'
      - 'report.nrec.no':                         'public-https-uh-report'
      - 'status.nrec.no':                         'public-https-uh-status'
  public_http_domains:
    ensure: present
    mappings:
      - 'apps.uib.no':                            'ssl-https-apps'
      - 'appsanywhere.uib.no':                    'ssl-https-apps'
      - 'docs.uh-iaas.no':                        'public-http-uh-docs'
      - 'report.uh-iaas.no':                      'public-http-nrec-redirect'
      - 'status.uh-iaas.no':                      'public-http-nrec-redirect'
      - 'report.nrec.no':                         'public-http-nrec-redirect'
      - 'status.nrec.no':                         'public-http-nrec-redirect'
  ssl_https_domains:
    ensure: present
    mappings:
      - 'apps.uib.no':                            'ssl-https-apps'
      - 'appsanywhere.uib.no':                    'ssl-https-apps'
      - 'docs.nrec.no':                           'ssl-https-nrec-docs'
      - 'www.nrec.no':                            'ssl-https-nrec-www'
      - 'nrec.no':                                'ssl-https-nrec-www'
  ssl_http_domains:
    ensure: present
    mappings:
      - 'apps.uib.no':                            'ssl-http-apps'
      - 'appsanywhere.uib.no':                    'ssl-http-apps'
      - 'docs.nrec.no':                           'public-http-nrec-redirect'
      - 'www.nrec.no':                            'public-http-nrec-redirect'
      - 'nrec.no':                                'public-http-nrec-redirect'

profile::highavailability::loadbalancing::haproxy::haproxy_balancermembers:
  'public-https-uh-status':
    listening_service:  'public-https-uh-status'
    ports:              443
    server_names:       ['status-osl', 'status-bgo']
    ipaddresses:        ['172.16.31.10', '192.168.3.11']
    options:            'verify none inter 1000 check check-ssl'
  'public-https-uh-report':
    listening_service:  'public-https-uh-report'
    ports:              443
    server_names:       ['report-osl', 'report-bgo']
    ipaddresses:        ['172.16.31.10', '192.168.3.11']
    options:            'verify none inter 1000 check check-ssl'
  'ssl-https-nrec-www':
    listening_service:  'ssl-https-nrec-www'
    ports:              443
    server_names:       ['www01']
    ipaddresses:        ['norcams.github.io']
    options:            'verify none inter 1000 check check-ssl ssl'
  'ssl-https-nrec-docs':
    listening_service:  'ssl-https-nrec-docs'
    ports:              443
    server_names:       ['docs01']
    ipaddresses:        ['uh-iaas.readthedocs.io']
    options:            'verify none inter 1000 check check-ssl ssl'
  'ssl-https-apps':
    listening_service:  'ssl-https-apps'
    ports:              443
    server_names:       ['appsanywhere05.uib.no', 'appsanywhere06.uib.no']
    ipaddresses:        ['192.168.3.11', '172.16.17.32']
    options:            'verify none inter 120 check check-ssl ssl'
#    define_cookies:     true
  'public-https-apps':
    listening_service:  'public-https-apps'
    ports:              443
    server_names:       ['appsanywhere05.uib.no', 'appsanywhere06.uib.no']
    ipaddresses:        ['192.168.3.11', '172.16.17.32']
    options:            'check'
  'public-ldap-prod':
    listening_service:  'public-ldap-prod'
    ports:              '389'
    server_names:       ['p1ldap01.uib.no', 'p2ldap01.uib.no', 'p1ldap02.uib.no', 'p2ldap02.uib.no']
    ipaddresses:        ['192.168.127.12', '192.168.127.12', '172.16.17.32', '172.16.58.3']
    options:
      - 'check'
  'public-ldaps-prod':
    listening_service:  'public-ldaps-prod'
    ports:              '636'
    server_names:       ['p1ldap01.uib.no', 'p2ldap01.uib.no', 'p1ldap02.uib.no', 'p2ldap02.uib.no']
    ipaddresses:        ['192.168.127.12', '192.168.127.12', '172.16.17.32', '172.16.58.3']
    options:
      - 'check'
  'uib-https-exch':
    listening_service:  'uib-https-exch'
    ports:              443
    server_names:       ['exchange01.uib.no', 'exchange02.uib.no']
    ipaddresses:        ['172.16.31.10','172.16.58.3']
    options:            'check'
  'uib-https-adm':
    listening_service:  'uib-https-adm'
    ports:              443
    server_names:       ['rd-web01.uib.no', 'rd-web02.uib.no']
    ipaddresses:        ['192.168.3.11', '192.168.127.12']
    options:
      - 'check'
  'uib-https-apps-admin':
    listening_service:  'uib-https-apps-admin'
    ports:              443
    server_names:       ['apps-admin01.uib.no', 'apps-admin02.uib.no']
    ipaddresses:        ['172.16.17.32', '192.168.127.12']
    options:
      - 'check'
  'uib-https-apps-gw':
    listening_service:  'uib-https-apps-gw'
    ports:              443
    server_names:       ['apps-gw01.uib.no', 'apps-gw02.uib.no']
    ipaddresses:        ['172.16.17.32', '172.16.17.32']
    options:
      - 'check'
  'uib-http-adm':
    listening_service:  'uib-http-adm'
    ports:              80
    server_names:       ['rd-web01.uib.no', 'rd-web02.uib.no']
    ipaddresses:        ['192.168.3.11', '192.168.127.12']
    options:
      - 'check'
  'uib-ldap-test':
    listening_service:  'uib-ldap-test'
    ports:              '389'
    server_names:       ['t1ldap01.uib.no']
    ipaddresses:        ['192.168.127.12']
    options:
      - 'check'
  'uib-ldaps-test':
    listening_service:  'uib-ldaps-test'
    ports:              '636'
    server_names:       ['t1ldap01.uib.no']
    ipaddresses:        ['192.168.127.12']
    options:
      - 'check'
  'uib-https-grid':
    listening_service:  'uib-https-grid'
    ports:              18082
    server_names:       ['uib-grid-01.grid.uib.no', 'uib-grid-02.grid.uib.no', 'uib-grid-03.grid.uib.no', 'uib-grid-04.grid.uib.no']
    ipaddresses:        ['172.16.31.10', '192.168.127.12', '172.16.17.32', '172.16.17.32']
    options:
      - 'check'
      - 'check-ssl'
      - 'verify none'

profile::highavailability::loadbalancing::haproxy::haproxy_backends:
  public-https-apps:
    mode:             'tcp'
    options:
      - balance:      'source'
      - http-check: 'expect status 200'
      # Session stick table and based on source IP
      - stick-table: 'type ip size 1m expire 1h'
      - stick: 'on src'
      - timeout:
        - 'server 1m'
        - 'queue 1m'
  ssl-https-apps:
    mode:             'http'
    options:
      - balance:      'leastconn'
      - option:
        - 'forwardfor except 127.0.0.1'
        - 'httpchk GET /healthcheck'
      - http-check: 'expect status 200'
      # Session stick table and based on source IP
      - stick-table: 'type ip size 1m expire 1h'
      - stick: 'on src'
      - timeout:
        - 'server 1m'
        - 'queue 1m'
  ssl-http-apps:
    mode:             'http'
    options:
      - balance:      'roundrobin'
      - redirect:     'scheme https if !{ ssl_fc }'
  ssl-https-nrec-www:
    mode:             'http'
    options:
      - balance:      'source'
      - option:
        - 'forwardfor except 127.0.0.1'
      - http-request:
        - 'set-header Host norcams.github.io'
  ssl-https-nrec-docs:
    mode:             'http'
    options:
      - balance:      'source'
      - option:
        - 'forwardfor except 127.0.0.1'
      - http-request:
        - 'set-header Host uh-iaas.readthedocs.io'
  public-http-nrec-redirect:
    mode:             'http'
    options:
      - balance:      'roundrobin'
      - redirect:     'scheme https if !{ ssl_fc }'
  public-http-uh-docs:
    mode:             'http'
    options:
      - redirect:     'code 301 location https://docs.nrec.no'
  public-https-uh-status:
    mode:             'tcp'
    options:
      - balance:      'source'
      - option:
        - 'httpchk HEAD /api/health HTTP/1.1\r\nHost:\ status.uh-iaas.no'
  public-https-uh-report:
    mode:             'tcp'
    options:
      - balance:      'source'
      - option:
        - 'httpchk HEAD /health HTTP/1.1\r\nHost:\ report.uh-iaas.no'
  public-ldap-prod:
    mode:             'tcp'
    options:
      - balance:      'leastconn'
  public-ldaps-prod:
    mode:             'tcp'
    options:
      - balance:      'leastconn'
  uib-https-exch:
    mode:             'tcp'
    options:
      - balance:      'source'
  uib-https-apps-admin:
    mode:             'tcp'
    options:
      - balance:      'source'
      # - option:
      #   - 'httpchk HEAD /jukeboxserver/do/license/token/renew.tok?msid=ping HTTP/1.1\r\nHost:\ apps-admin.uib.no'
  uib-https-apps-gw:
    mode:             'tcp'
    options:
      - balance:      'roundrobin'
      #- cookie:       'ASP.NET_SessionId prefix nocache'
      # - option:
      #   - 'httpchk HEAD /jukeboxserver/do/license/token/renew.tok?msid=ping HTTP/1.1\r\nHost:\ apps-admin.uib.no'
  uib-https-adm:
    mode:             'tcp'
    options:
      - balance:      'roundrobin'
      - tcp-request:  'content reject if { src -f /etc/haproxy/uib_vpn_net.list }'
  uib-http-adm:
    mode:             'tcp'
    options:
      - balance:      'roundrobin'
      - tcp-request:  'content reject if { src -f /etc/haproxy/uib_vpn_net.list }'
  uib-ldap-test:
    mode:             'tcp'
    options:
      - balance:      'leastconn'
  uib-ldaps-test:
    mode:             'tcp'
    options:
      - balance:      'leastconn'
  uib-https-grid:
    mode:             'tcp'
    options:
      - balance:      'leastconn'
      - option:
        - 'httpchk OPTIONS / HTTP/1.1'

#  uib-https-uh-dashboard:
#    mode: 'tcp'
#    options:
#      - balance:      'source'
#      - option:       ['ssl-hello-chk']
#      - stick-table:  'type binary len 32 size 30k expire 30m'
#      - acl:
#        - 'clienthello req_ssl_hello_type 1'
#        - 'serverhello rep_ssl_hello_type 2'
#      - tcp-request:
#        - 'inspect-delay 15s'
#        - 'content reject unless clienthello'
#      - tcp-response:
#        - 'content reject unless serverhello'
#      - stick:
#        - 'on payload_lv(43,1) if clienthello'
#        - 'store-response payload_lv(43,1) if serverhello'

profile::highavailability::loadbalancing::haproxy::haproxy_frontends:
  public-http:
    mode:               'http'
    bind:
      "%{hiera('corosync_cluster_vip1')}:80": []
      "%{hiera('corosync_cluster_vip2')}:80": []
    options:
      - option:         'httplog'
      - use_backend:    '%[req.hdr(host),lower,map(/etc/haproxy/public_http_domains.map)]'
      - capture:        'request header Host len 32' #for debug
  public-https:
    mode:               'tcp'
    bind:
      "%{hiera('corosync_cluster_vip1')}:443": []
      "%{hiera('corosync_cluster_vip2')}:443": []
    options:
      - option:         'tcplog'
      - tcp-request:
        - 'inspect-delay 5s'
        - 'content accept if { req_ssl_hello_type 1 }'
      - use_backend:      '%[req_ssl_sni,lower,map(/etc/haproxy/public_https_domains.map)]'
  public-ldap:
    mode:               'tcp'
    bind:
      "%{hiera('corosync_cluster_vip1')}:389": []
      "%{hiera('corosync_cluster_vip2')}:389": []
    options:
      - option:         'tcplog'
      - use_backend:    'public-ldap-prod'
  public-ldaps:
    mode:               'tcp'
    bind:
      "%{hiera('corosync_cluster_vip1')}:636": []
      "%{hiera('corosync_cluster_vip2')}:636": []
    options:
      - option:         'tcplog'
      - use_backend:    'public-ldaps-prod'
  uib-http:
    mode:               'http'
    bind:
      "%{hiera('corosync_cluster_vip3')}:80": []
      "%{hiera('corosync_cluster_vip4')}:80": []
    options:
      - maxconn:        '16000' # max internal http connections
      - option:         'httplog'
      - use_backend:    '%[req.hdr(host),lower,map(/etc/haproxy/uib_http_domains.map)]'
      - capture:        'request header Host len 32' #for debug
  uib-https:
    mode:               'tcp'
    bind:
      "%{hiera('corosync_cluster_vip3')}:443": []
      "%{hiera('corosync_cluster_vip4')}:443": []
    options:
      - maxconn:        '16000' # max internal https connections
      - option:         'tcplog'
      - tcp-request:
        - 'inspect-delay 5s'
        - 'content accept if { req_ssl_hello_type 1 }'
      - use_backend:      '%[req_ssl_sni,lower,map(/etc/haproxy/uib_https_domains.map)]'
  uib-ldap:
    mode:               'tcp'
    bind:
      "%{hiera('corosync_cluster_vip3')}:389": []
      "%{hiera('corosync_cluster_vip4')}:389": []
    options:
      - option:         'tcplog'
      - use_backend:    'uib-ldap-test'
  uib-ldaps:
    mode:               'tcp'
    bind:
      "%{hiera('corosync_cluster_vip3')}:636": []
      "%{hiera('corosync_cluster_vip4')}:636": []
    options:
      - option:         'tcplog'
      - use_backend:    'uib-ldaps-test'
  ssl-http: #for redirect
    mode:               'http'
    bind:
      "%{hiera('corosync_cluster_vip5')}:80": []
      "%{hiera('corosync_cluster_vip6')}:80": []
    options:
      - option:         'httplog'
      - use_backend:    '%[req.hdr(host),lower,map(/etc/haproxy/ssl_http_domains.map)]'
      - capture:        'request header Host len 32' #for debug
  ssl-https:
    mode:               'http'
    bind:
      "%{hiera('corosync_cluster_vip5')}:443":
        - 'ssl'
        - 'crt'
        - "%{hiera('ssl_cert_apps')}"
        - 'ssl'
        - 'crt'
        - "%{hiera('ssl_cert_nrec')}"
        - 'ssl'
        - 'crt'
        - "%{hiera('ssl_cert_nrec_www')}"
        - 'ssl'
        - 'crt'
        - "%{hiera('ssl_cert_nrec_docs')}"
      "%{hiera('corosync_cluster_vip6')}:443":
        - 'ssl'
        - 'crt'
        - "%{hiera('ssl_cert_apps')}"
        - 'ssl'
        - 'crt'
        - "%{hiera('ssl_cert_nrec')}"
        - 'ssl'
        - 'crt'
        - "%{hiera('ssl_cert_nrec_www')}"
        - 'ssl'
        - 'crt'
        - "%{hiera('ssl_cert_nrec_docs')}"
    options:
      - option:         'http-server-close'
      - option:         'forwardfor'
      - use_backend:    '%[req.hdr(host),lower,map(/etc/haproxy/ssl_https_domains.map)]'
      # Prevents X-Forwarded-For spoofing
      - http-request:   'del-header ^X-Forwarded-For:.*'
      # - http-request:
      #   - 'add-header X-Forwarded-Proto https if { ssl_fc }'
      #   - 'set-header X-Forwarded-Port %[dst_port]'
  # uib-https-grid:
  #   mode:               'tcp'
  #   bind:
  #     "%{hiera('corosync_cluster_vip5')}:443": []
  #   options:
  #     - maxconn:        '5000' # max grid https connections
  #     - timeout:
  #       - 'connect 5s'
  #       - 'client 50s'
  #       - 'server 50s'
  #     - option:         'tcplog'
  #     - tcp-request:
  #       - 'inspect-delay 5s'
  #       - 'content accept if { req_ssl_hello_type 1 }'
  #     - use_backend:    'uib-https-grid'

# Corosync VIP and HAproxy
profile::highavailability::corosync::primitives:
  'pubip1':
    'primitive_class':    'ocf'
    'primitive_type':     'IPaddr2'
    'provided_by':        'heartbeat'
    'parameters':
      'ip':               "%{hiera('corosync_cluster_vip1')}"
      'cidr_netmask':     '24'
    operations:
      'monitor':          { 'interval': '10s', 'timeout': '20s' }
      'start':            { 'interval': '0s', 'timeout': '20s' }
      'stop':             { 'interval': '0s', 'timeout': '20s' }
  'pubip2':
    'primitive_class':    'ocf'
    'primitive_type':     'IPaddr2'
    'provided_by':        'heartbeat'
    'parameters':
      'ip':               "%{hiera('corosync_cluster_vip2')}"
      'cidr_netmask':     '24'
    operations:
      'monitor':          { 'interval': '10s', 'timeout': '20s' }
      'start':            { 'interval': '0s', 'timeout': '20s' }
      'stop':             { 'interval': '0s', 'timeout': '20s' }
  'uibip1':
    'primitive_class':    'ocf'
    'primitive_type':     'IPaddr2'
    'provided_by':        'heartbeat'
    'parameters':
      'ip':               "%{hiera('corosync_cluster_vip3')}"
      'cidr_netmask':     '24'
    operations:
      'monitor':          { 'interval': '10s', 'timeout': '20s' }
      'start':            { 'interval': '0s', 'timeout': '20s' }
      'stop':             { 'interval': '0s', 'timeout': '20s' }
  'uibip2':
    'primitive_class':    'ocf'
    'primitive_type':     'IPaddr2'
    'provided_by':        'heartbeat'
    'parameters':
      'ip':               "%{hiera('corosync_cluster_vip4')}"
      'cidr_netmask':     '24'
    operations:
      'monitor':          { 'interval': '10s', 'timeout': '20s' }
      'start':            { 'interval': '0s', 'timeout': '20s' }
      'stop':             { 'interval': '0s', 'timeout': '20s' }
  'sslip1':
    'primitive_class':    'ocf'
    'primitive_type':     'IPaddr2'
    'provided_by':        'heartbeat'
    'parameters':
      'ip':               "%{hiera('corosync_cluster_vip5')}"
      'cidr_netmask':     '24'
    operations:
      'monitor':          { "interval": "10s", "timeout": "20s" }
      'start':            { "interval": "0s", "timeout": "20s" }
      'stop':             { "interval": "0s", "timeout": "20s" }
  'sslip2':
    'primitive_class':    'ocf'
    'primitive_type':     'IPaddr2'
    'provided_by':        'heartbeat'
    'parameters':
      'ip':               "%{hiera('corosync_cluster_vip6')}"
      'cidr_netmask':     '24'
    operations:
      'monitor':          { "interval": "10s", "timeout": "20s" }
      'start':            { "interval": "0s", "timeout": "20s" }
      'stop':             { "interval": "0s", "timeout": "20s" }
  'haproxy':
    'primitive_class':    'systemd'
    'primitive_type':     'haproxy'
    'operations':
      'monitor':          { 'interval': '5s', 'timeout': '20s' }
      'start':            { 'interval': '0s', 'timeout': '20s' }
      'stop':             { 'interval': '0s', 'timeout': '20s' }

profile::highavailability::corosync::locations:
  'pubip_location1':
    primitive:  'pubip1'
    node_name:  "%{hiera('corosync_cluster_node1')}"
    score:      'INFINITY'
  'pubip_location2':
    primitive:  'pubip2'
    node_name:  "%{hiera('corosync_cluster_node2')}"
    score:      'INFINITY'
  'uibip_location1':
    primitive:  'uibip1'
    node_name:  "%{hiera('corosync_cluster_node1')}"
    score:      'INFINITY'
  'uibip_location2':
    primitive:  'uibip2'
    node_name:  "%{hiera('corosync_cluster_node2')}"
    score:      'INFINITY'
  'sslip_location1':
    primitive:  'sslip1'
    node_name:  "%{hiera('corosync_cluster_node1')}"
    score:      'INFINITY'
  'sslip_location2':
    primitive:  'sslip2'
    node_name:  "%{hiera('corosync_cluster_node2')}"
    score:      'INFINITY'

profile::highavailability::corosync::colocations:
  'pubip1_haproxy':
    primitives:   ['clone_haproxy', 'pubip1']
  'pubip2_haproxy':
    primitives:   ['clone_haproxy', 'pubip2']
  'uibip1_haproxy':
    primitives:   ['clone_haproxy', 'uibip1']
  'uibip2_haproxy':
    primitives:   ['clone_haproxy', 'uibip2']
  'sslip1_haproxy':
    primitives:   ['clone_haproxy', 'sslip1']
  'sslip2_haproxy':
    primitives:   ['clone_haproxy', 'sslip2']

{'fraction_non_alphanumeric': 0.1616750596342433, 'fraction_numerical': 0.047054985830496034, 'mean_word_length': 1.9376534706833564, 'pattern_counts': {'":': 66, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 2, 'lorem ipsum': 0, 'www.': 24, 'xml': 0}, 'pii_count': 108, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '939670', 'n_tokens_mistral': 19817, 'n_tokens_neox': 18612, 'n_words': 2857}