#!/bin/bash
#Nifty: Install Haproxy.

###
curl -s https://nifty.sh/lib/universal/niftylib.sh > /tmp/lib.nifty.sh
. /tmp/lib.nifty.sh
rm -f /tmp/lib.nifty.sh

# Requirements
require_root
require_64bit
require_os alma9 alma10

ce "Updating the system packages..."
dnf update -y

ce "Installing required packages"
dnf install -y haproxy htop

ce "Configuring rsyslog logging"
touch /var/log/haproxy.log
chmod 644 /var/log/haproxy.log
cat <<'EOF' > /etc/rsyslog.d/haproxy.conf
# Enable UDP reception
$ModLoad imudp
$UDPServerAddress 127.0.0.1
$UDPServerRun 514

# Log HAProxy messages
local2.* /var/log/haproxy.log
& stop
EOF

ce "Creating basic config for haproxy"
mkdir /etc/haproxy/certs/
cat <<EOF > /etc/haproxy/haproxy.cfg
#---------------------------------------------------------------------
# Global settings
#---------------------------------------------------------------------
global
    log         127.0.0.1 local2 notice

    chroot      /var/lib/haproxy
    pidfile     /var/run/haproxy.pid
    maxconn     50000
    user        haproxy
    group       haproxy
    daemon

    # turn on stats unix socket
    stats socket /var/lib/haproxy/stats

    # SSL tuning
    ssl-default-bind-options no-sslv3 no-tls-tickets no-tlsv10 no-tlsv11
    ssl-default-bind-ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
    tune.ssl.default-dh-param 2048

#---------------------------------------------------------------------
# Defaults
#---------------------------------------------------------------------
defaults
    mode                    http
    log                     global
    option                  httplog
    option                  dontlognull
    option                  http-server-close
    option                  forwardfor except 127.0.0.0/8
    option                  redispatch
    retries                 3
    timeout http-request    10s
    timeout queue           1m
    timeout connect         10s
    timeout client          1m
    timeout server          1m
    timeout http-keep-alive 10s
    timeout check           10s
    maxconn                 20000

#---------------------------------------------------------------------
# Statistics frontend - enable and set password, if needed
#---------------------------------------------------------------------
#frontend stats
#    bind 0.0.0.0:8040
#    mode http
#    stats enable
#    stats uri /lbstats
#    stats realm Please\ Login
#    stats auth admin:<CREATE PASSWORD>
#    stats admin if TRUE

#---------------------------------------------------------------------
# Prometheus exporter
#---------------------------------------------------------------------
frontend prometheus-exporter
  bind :8405
  mode http
  http-request use-service prometheus-exporter

#---------------------------------------------------------------------
# Frontends
#---------------------------------------------------------------------
frontend https-front
    mode http
    bind 0.0.0.0:80
#    bind 0.0.0.0:443 ssl crt /etc/haproxy/certs/
#    http-request redirect scheme https unless { ssl_fc }

    acl acl_admin path_beg /admin
    use_backend admin if acl_admin

    default_backend http-back


#---------------------------------------------------------------------
# Backends
#---------------------------------------------------------------------
backend http-back
    balance     roundrobin
    server  app1 127.0.0.1:5001 check
    server  app2 127.0.0.1:5002 check

backend admin
    server  admin1 127.0.0.1:5003 check
    server  admin2 127.0.0.1:5004 check
EOF

ce "Starting services"
systemctl restart rsyslog
systemctl restart haproxy
systemctl enable haproxy

ce "All done!"
echo "Loglevel for haproxy is set to notice as default - please edit line 5 in /etc/haproxy/haproxy.cfg to change"
echo "Available loglevel are: debug, info, notice, warning, err, crit, alert, emerg"
echo
echo "To test haproxy config use: haproxy -c -V -f /etc/haproxy/haproxy.cfg"
echo
echo "Haproxy metrics are exposed on port: 8405"
