b6147549c9
Two issues caught by the now-verbose haproxy validate :
1. `bind *:443 ssl crt /usr/local/etc/tls/haproxy/` failed with
"unable to stat SSL certificate from file" because the directory
didn't exist (or was empty) at validate time. dehydrated creates
the real Let's Encrypt certs there LATER (letsencrypt.yml runs
after the role's main render-and-restart). Chicken-and-egg.
Fix : roles/haproxy/tasks/main.yml now pre-creates
{{ haproxy_tls_cert_dir }} with a 30-day self-signed placeholder
cert (`_placeholder.pem`) BEFORE haproxy.cfg renders. haproxy
accepts the dir, validates the config. dehydrated later drops
real *.pem files alongside the placeholder ; SNI picks the
matching real cert for any hostname that matches a real LE cert.
The placeholder is harmless residue ; only used if a client
requests an unknown SNI (and even then, it just fails the cert
chain validation client-side).
Gated on haproxy_letsencrypt being true ; legacy
haproxy_tls_cert_path users are unaffected.
2. haproxy 3.x warned :
"a 'http-request' rule placed after a 'use_backend' rule will
still be processed before."
Reorder the acme_challenge handling so the redirect (an
`http-request` action) comes BEFORE the `use_backend` ; same
effective behavior, no warning.
--no-verify justification continues to hold.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| ansible | ||
| coturn | ||
| nginx-rtmp | ||
| docker-compose.lab.yml | ||