---
#--------------------------------------------------------------#
# Install Haproxy                              [haproxy_install]
#--------------------------------------------------------------#
- name: install haproxy
  tags: haproxy_install
  when: haproxy_enabled|bool
  ignore_errors: "{{ not haproxy_enabled|bool }}"   # ignore errors if not enabled
  block:

    - name: install haproxy
      environment: "{{ proxy_env | default({}) }}"
      package: name=haproxy state=present

    - name: create haproxy config dir
      file: path=/etc/haproxy state=directory owner=root mode=0700

    - name: create haproxy environment file
      file: path=/etc/default/haproxy state=touch mode=0644

    - name: create haproxy systemd service
      copy: src=haproxy.svc dest={{ systemd_dir }}/haproxy.service


#--------------------------------------------------------------#
# Config Haproxy                                [haproxy_config]
#--------------------------------------------------------------#
- name: render haproxy config
  tags: haproxy_config
  when: haproxy_enabled|bool
  block:

    - name: wipe haproxy config dir
      when: haproxy_clean|bool
      shell: "mkdir -p /etc/haproxy; rm -f /etc/haproxy/* ; /bin/true"
      args: { executable: /bin/bash }

    - name: render haproxy default config
      template: src=haproxy.cfg.j2 dest=/etc/haproxy/haproxy.cfg owner=root mode=0644

    - name: render haproxy service config
      when: haproxy_services is defined and haproxy_services|length > 0
      template: src=service.j2 dest=/etc/haproxy/{{ item.name }}.cfg owner=root mode=0644
      vars: { service: "{{ item }}" }
      with_items: "{{ haproxy_services }}"

    - name: setup selinux for haproxy
      tags: haproxy_firewall
      ignore_errors: true
      shell: |
        command -v semanage &>/dev/null || exit 0
        setsebool -P haproxy_connect_any 1 2>/dev/null
        cd /tmp
        cat > haproxy_proc.te <<'EOF'
        module haproxy_proc 1.0;

        require {
            type haproxy_t;
            type proc_t;
            type kernel_t;
            class file { open read getattr };
            class dir { search getattr };
        }

        allow haproxy_t proc_t:dir { search getattr };
        allow haproxy_t proc_t:file { open read getattr };
        allow haproxy_t kernel_t:dir { search getattr };
        allow haproxy_t kernel_t:file { open read getattr };
        EOF
        checkmodule -M -m -o haproxy_proc.mod haproxy_proc.te 2>/dev/null && \
        semodule_package -o haproxy_proc.pp -m haproxy_proc.mod 2>/dev/null && \
        semodule -i haproxy_proc.pp 2>/dev/null
        rm -f haproxy_proc.te haproxy_proc.mod haproxy_proc.pp
        /bin/true
      args: { executable: /bin/bash }


#--------------------------------------------------------------#
# Launch Haproxy                                [haproxy_launch]
#--------------------------------------------------------------#
- name: launch haproxy
  tags: haproxy_launch
  when: haproxy_enabled|bool
  block:

    - name: launch haproxy systemd service
      systemd: name=haproxy state=restarted enabled=yes daemon_reload=yes

    - name: wait for haproxy service online
      wait_for: host=127.0.0.1 port={{ haproxy_exporter_port|default(9101) }} state=started timeout=10


#--------------------------------------------------------------#
# Reload Haproxy                                [haproxy_reload]
#--------------------------------------------------------------#
- name: reload haproxy to register node services
  tags: [ haproxy_reload , haproxy_config ]
  when: haproxy_enabled|bool and haproxy_reload|bool
  block:

    # if the check fails on this step, haproxy will not be reloaded
    - name: check haproxy config before reload
      ignore_errors: false
      command: /usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg -c -q

    # even if you perform haproxy reload on junk config, it will not fail
    - name: reload haproxy
      ignore_errors: false
      systemd: name=haproxy state=reloaded enabled=yes daemon_reload=yes


...