Playbooks to a new Lilik
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

56 lines
2.5 KiB

  1. .. highlight:: yaml
  2. reverse_proxy
  3. =============
  4. This role provides the mean of exposing a machine to the web (http and https), it is currently bound to the *reverse_proxy* host but it will be extended to be available to other as well.
  5. Usage
  6. -----
  7. To expose the web services to the internet (http and https) for the resource pippo (a machine or a group) add the role **reverse_proxy** to the playbook.
  8. This will first connect to the `pippo` hosts, execute the `role1` and then connect to the `reverse_proxy` host to add the proxy rules for `pippo`.
  9. .. code-block:: yaml
  10. - hosts: pippo
  11. roles:
  12. - role: role1
  13. - role: reverse_proxy
  14. By default the domain exposed is created from the resource name, i.e. `pippo.lilik.it` but this can be changed by setting the `hostname` variable for the role `reverse_proxy`.
  15. .. code-block:: yaml
  16. - hosts: pippo
  17. roles:
  18. - role: role1
  19. - role: reverse_proxy
  20. hostname: pluto
  21. Rationale behind this role
  22. --------------------------
  23. We have choosen to use **nginx** as our reverse proxy and because of the number of targets this can't be accomplished using a unique configuration file for nginx as it would need to know every rule every time it's configuration changes.
  24. Nginx provides the featuer to load configuration files from multiple directories and then merge the into one so we have choose to use three different directories.
  25. .. code-block:: bash
  26. nginx.conf
  27. map.conf.d/
  28. upstream.conf.d/
  29. http.conf.d/
  30. `nginx.conf` is the nginx configuration file, there we specify to include the the three directories in specific directives.
  31. `http.conf.d` contains the files for the *http* reverse proxy directive.
  32. `upstream.conf.d` contains the files where we specify a map from an id to the pool of the machines associated.
  33. `map.conf.d` contains the files where we specify the list of domains and their mappings to a resource id.
  34. We have choosen to separate this relation domain <-> machine by using an id because it will be used to make fun things such as high-availability or mapping more domains to the same resource id (but in different files) without the assle of checking if the nginx configuration will be broken by our automation.
  35. As an example take the mapping from `ca.lilik.it` to the machine `10.150.42.x`, we can have another mapping from `certificationauthority.lilik.it` to the same machine without the hassle of checking if a upstream rule is used by some mappings when we want to deprecate `certificationauthority.lilik.it`