From 914d0e41a16605d531472947e2efbb21f4b1978e Mon Sep 17 00:00:00 2001 From: Sidharth Jawale Date: Wed, 26 Aug 2026 22:58:32 +0530 Subject: [PATCH 01/16] feat(rustdesk): add support for HAProxy domain expose and documentation - Add $expose and $domains parameters to common::software::rustdesk - Integrate role::web::haproxy domain management with confine validation - Update Puppet Strings documentation comments for new parameters Signed-off-by: Sidharth Jawale --- .../common/manifests/software/rustdesk.pp | 32 +++++++++++++++---- 1 file changed, 25 insertions(+), 7 deletions(-) diff --git a/modules/enableit/common/manifests/software/rustdesk.pp b/modules/enableit/common/manifests/software/rustdesk.pp index ae95d600..47eb925a 100644 --- a/modules/enableit/common/manifests/software/rustdesk.pp +++ b/modules/enableit/common/manifests/software/rustdesk.pp @@ -14,24 +14,42 @@ # # @param server_extra_dependencies Array[String] parameter to install OS specific dependencies. Defaults to []. # +# @param expose Whether to expose the service via HAProxy. Defaults to false. +# +# @param domains HAProxy domain configuration. Defaults to {}. +# # @groups management manage. # # @groups client client_enable, client_version, client_extra_dependencies. # # @groups server server_enable, server_version, server_extra_dependencies. # +# @groups networking expose, domains. class common::software::rustdesk ( - Boolean $manage = false, + Boolean $manage = false, + + Boolean $client_enable = false, + Array[String] $client_extra_dependencies = [], + Eit_types::Version $client_version = '1.4.3', - Boolean $client_enable = false, - Array[String] $client_extra_dependencies = [], - Eit_types::Version $client_version = '1.4.3', + Boolean $server_enable = false, + Array[String] $server_extra_dependencies = [], + Eit_types::Version $server_version = '1.7.1', - Boolean $server_enable = false, - Array[String] $server_extra_dependencies = [], - Eit_types::Version $server_version = '1.7.1', + Boolean $expose = false, + Eit_haproxy::Domains $domains = {}, ) { if $manage { include profile::software::rustdesk + + if $expose { + confine($expose, $domains.empty, 'Exposing rustdesk via HAProxy requires domains to be provided') + + class { 'role::web::haproxy': + domains => $domains, + version => '3.2.0', + encryption_ciphers => 'Intermediate', + } + } } } From bd88a08f413fa3ade0a925d7a9cc744308e130bf Mon Sep 17 00:00:00 2001 From: Sidharth Jawale Date: Mon, 7 Sep 2026 14:12:09 +0530 Subject: [PATCH 02/16] fix: set haproxy 3.2.0 default and remove domains dependency from rustdesk and rustfs Signed-off-by: Sidharth Jawale --- .../enableit/common/manifests/software/rustdesk.pp | 12 +----------- .../enableit/eit_haproxy/manifests/basic_config.pp | 6 +++--- modules/enableit/eit_haproxy/manifests/init.pp | 8 ++++---- modules/enableit/profile/manifests/web/haproxy.pp | 2 +- modules/enableit/role/manifests/storage/rustfs.pp | 10 +--------- modules/enableit/role/manifests/web/haproxy.pp | 4 ++-- 6 files changed, 12 insertions(+), 30 deletions(-) diff --git a/modules/enableit/common/manifests/software/rustdesk.pp b/modules/enableit/common/manifests/software/rustdesk.pp index 47eb925a..faee38a1 100644 --- a/modules/enableit/common/manifests/software/rustdesk.pp +++ b/modules/enableit/common/manifests/software/rustdesk.pp @@ -16,8 +16,6 @@ # # @param expose Whether to expose the service via HAProxy. Defaults to false. # -# @param domains HAProxy domain configuration. Defaults to {}. -# # @groups management manage. # # @groups client client_enable, client_version, client_extra_dependencies. @@ -37,19 +35,11 @@ Eit_types::Version $server_version = '1.7.1', Boolean $expose = false, - Eit_haproxy::Domains $domains = {}, ) { if $manage { include profile::software::rustdesk - if $expose { - confine($expose, $domains.empty, 'Exposing rustdesk via HAProxy requires domains to be provided') - - class { 'role::web::haproxy': - domains => $domains, - version => '3.2.0', - encryption_ciphers => 'Intermediate', - } + include profile::web::haproxy } } } diff --git a/modules/enableit/eit_haproxy/manifests/basic_config.pp b/modules/enableit/eit_haproxy/manifests/basic_config.pp index 6fc27f51..f1f08648 100644 --- a/modules/enableit/eit_haproxy/manifests/basic_config.pp +++ b/modules/enableit/eit_haproxy/manifests/basic_config.pp @@ -20,7 +20,7 @@ # # @param encryption_ciphers The encryption ciphers to use. Defaults to 'Modern'. # -# @param version The version of haproxy. Defaults to 'latest'. +# @param version The version of haproxy. Defaults to '3.2.0'. # # @param native_acme Internal switch for native ACME mode. # @@ -47,8 +47,8 @@ Enum['http','tcp'] $mode = 'http', Array[Stdlib::IP::Address,1] $listen_on = ['0.0.0.0'], Enum['Modern','Intermediate'] $encryption_ciphers = 'Modern', - Eit_types::Version $version = 'latest', - Boolean $native_acme = false, + Eit_types::Version $version = '3.2.0', + Boolean $native_acme = true, Eit_types::Email $acme_contact = $eit_haproxy::acme_contact, String $acme_ca = 'https://acme-v02.api.letsencrypt.org/directory', ) { diff --git a/modules/enableit/eit_haproxy/manifests/init.pp b/modules/enableit/eit_haproxy/manifests/init.pp index 29bd6f63..dca2ff54 100644 --- a/modules/enableit/eit_haproxy/manifests/init.pp +++ b/modules/enableit/eit_haproxy/manifests/init.pp @@ -32,7 +32,7 @@ # # @param encryption_ciphers The encryption ciphers to use. Defaults to 'Modern'. # -# @param version The version of haproxy. Defaults to 'latest'. +# @param version The version of haproxy. Defaults to '3.2.0'. # # @param acme_contact The contact email for Let's Encrypt ACME. Defaults to 'ops@enableit.dk'. # @@ -81,7 +81,7 @@ Enum['http','tcp'] $mode = 'http', Array[Stdlib::IP::Address,1] $listen_on = ['0.0.0.0'], Enum['Modern','Intermediate'] $encryption_ciphers = 'Modern', - Eit_types::Version $version = 'latest', + Eit_types::Version $version = '3.2.0', Eit_types::Email $acme_contact = 'ops@enableit.dk', Enum['production','staging'] $ca_type = 'production', Eit_types::Service_Ensure $service_ensure = true, @@ -102,7 +102,7 @@ if $configure == 'auto' { $_is_ubuntu = $facts['os']['name'] == 'Ubuntu' - $_wants_haproxy3 = String($version) =~ /^\d+(\.\d+)*$/ and versioncmp(String($version), '3.0.0') >= 0 + $_wants_haproxy3 = String($version) =~ /^\d+(\.\d+)*$/ and versioncmp(String($version), '3.2.0') >= 0 if $_wants_haproxy3 and !$_is_ubuntu { fail("HAProxy 3.x is only supported on Ubuntu, not ${facts['os']['name']}") @@ -133,7 +133,7 @@ Class['apt'] -> Apt::Ppa["ppa:vbernat/haproxy-${haproxy_lts_version}"] -> Class['eit_haproxy::basic_config'] } } else { - warning('HAProxy 3.x auto-native ACME path is only supported on Ubuntu') + warning('HAProxy 3.2.x auto-native ACME path is only supported on Ubuntu') } } diff --git a/modules/enableit/profile/manifests/web/haproxy.pp b/modules/enableit/profile/manifests/web/haproxy.pp index a8f5302c..2bb8567c 100644 --- a/modules/enableit/profile/manifests/web/haproxy.pp +++ b/modules/enableit/profile/manifests/web/haproxy.pp @@ -28,7 +28,7 @@ Boolean $http = false, Boolean $use_hsts = true, Boolean $use_lets_encrypt = true, - Eit_types::Version $version = 'latest', + Eit_types::Version $version = '3.2.0', Eit_types::Email $acme_contact = 'ops@enableit.dk', Enum['Modern','Intermediate'] $encryption_ciphers = 'Modern', Hash[Eit_types::IP,Variant[ diff --git a/modules/enableit/role/manifests/storage/rustfs.pp b/modules/enableit/role/manifests/storage/rustfs.pp index d1855c66..39e32313 100644 --- a/modules/enableit/role/manifests/storage/rustfs.pp +++ b/modules/enableit/role/manifests/storage/rustfs.pp @@ -5,7 +5,6 @@ # @param secret_key The S3 secret access key. # @param enable Whether to enable and manage the rustfs component. # @param expose Whether to expose the service via HAProxy. -# @param domains HAProxy domain configuration. # # @example Usage # include role::storage::rustfs @@ -16,17 +15,10 @@ Stdlib::Unixpath $data_dir, Boolean $enable = true, Boolean $expose = false, - Eit_haproxy::Domains $domains = {}, ) inherits role::storage { contain role::virtualization::docker contain profile::storage::rustfs if $expose { - confine($expose, $domains.empty, 'Exposing rustfs via HAProxy requires domains to be provided') - - class { 'role::web::haproxy': - domains => $domains, - version => '3.2.0', - encryption_ciphers => 'Intermediate', - } + include role::web::haproxy } } diff --git a/modules/enableit/role/manifests/web/haproxy.pp b/modules/enableit/role/manifests/web/haproxy.pp index 1d84f8ce..ecd8c102 100644 --- a/modules/enableit/role/manifests/web/haproxy.pp +++ b/modules/enableit/role/manifests/web/haproxy.pp @@ -22,7 +22,7 @@ # # @param firewall The firewall configurations. Defaults to an empty hash. # -# @param version The version of haproxy. Defaults to 'present'. +# @param version The version of haproxy. Defaults to '3.2.0'. # # @param acme_contact The contact email for Let's Encrypt ACME. Defaults to 'ops@enableit.dk'. # @@ -56,7 +56,7 @@ Array[Stdlib::Port], Stdlib::Port ]] $firewall = {}, - Eit_types::Version $version = 'latest', + Eit_types::Version $version = '3.2.0', Eit_types::Email $acme_contact = 'ops@enableit.dk', Boolean $log_compressed = true, Boolean $__blendable, From c4057544ab47ee1a27b8e63ea08b8e8a21c4d7f7 Mon Sep 17 00:00:00 2001 From: Sidharth Jawale Date: Mon, 7 Sep 2026 20:39:04 +0530 Subject: [PATCH 03/16] fix: set default values for manual_config and configure haproxy params Signed-off-by: Sidharth Jawale --- modules/enableit/profile/manifests/web/haproxy.pp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/enableit/profile/manifests/web/haproxy.pp b/modules/enableit/profile/manifests/web/haproxy.pp index 2bb8567c..efd430de 100644 --- a/modules/enableit/profile/manifests/web/haproxy.pp +++ b/modules/enableit/profile/manifests/web/haproxy.pp @@ -19,8 +19,8 @@ # @groups mode http # class profile::web::haproxy ( - Enum['auto', 'manual'] $configure, - Optional[String] $manual_config, + Enum['auto', 'manual'] $configure = 'auto', + Optional[String] $manual_config = undef, Eit_haproxy::Domains $domains = {}, Eit_haproxy::Listen $listens = {}, Boolean $ddos_protection = false, From 28af9964b04c624749065c11fa8149eb73fcbd51 Mon Sep 17 00:00:00 2001 From: Sidharth Jawale Date: Mon, 7 Sep 2026 20:44:25 +0530 Subject: [PATCH 04/16] fix: allow apt to be safely referenced without duplicate declaration errors Signed-off-by: Sidharth Jawale --- modules/enableit/eit_haproxy/manifests/init.pp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/enableit/eit_haproxy/manifests/init.pp b/modules/enableit/eit_haproxy/manifests/init.pp index dca2ff54..4c889654 100644 --- a/modules/enableit/eit_haproxy/manifests/init.pp +++ b/modules/enableit/eit_haproxy/manifests/init.pp @@ -125,7 +125,7 @@ # Newer Ubuntu LTS (26.04+) ships HAProxy 3.x in stock repos, # so the PPA is unnecessary there. if $facts['os']['release']['major'] =~ /^24/ { - contain apt + include apt $haproxy_lts_version = '3.2' apt::ppa { "ppa:vbernat/haproxy-${haproxy_lts_version}": } From 73414cb54a26ce6c9e0d6b0879de08ef342ec874 Mon Sep 17 00:00:00 2001 From: Sidharth Jawale Date: Mon, 7 Sep 2026 21:02:45 +0530 Subject: [PATCH 05/16] fix: wrap apt class to prevent duplicate declaration error Signed-off-by: Sidharth Jawale --- modules/enableit/eit_haproxy/manifests/init.pp | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/modules/enableit/eit_haproxy/manifests/init.pp b/modules/enableit/eit_haproxy/manifests/init.pp index 4c889654..32c81f8c 100644 --- a/modules/enableit/eit_haproxy/manifests/init.pp +++ b/modules/enableit/eit_haproxy/manifests/init.pp @@ -125,7 +125,9 @@ # Newer Ubuntu LTS (26.04+) ships HAProxy 3.x in stock repos, # so the PPA is unnecessary there. if $facts['os']['release']['major'] =~ /^24/ { - include apt + if ! defined(Class['apt']) { + class { 'apt': } + } $haproxy_lts_version = '3.2' apt::ppa { "ppa:vbernat/haproxy-${haproxy_lts_version}": } From 4c66263f899a7c7cd593f27e72c5ce588349a63b Mon Sep 17 00:00:00 2001 From: Sidharth Jawale Date: Mon, 7 Sep 2026 21:08:53 +0530 Subject: [PATCH 06/16] fix: remove apt class declaration to fix eit_repos and eit_haproxy ordering issues Signed-off-by: Sidharth Jawale --- modules/enableit/eit_haproxy/manifests/init.pp | 4 ---- 1 file changed, 4 deletions(-) diff --git a/modules/enableit/eit_haproxy/manifests/init.pp b/modules/enableit/eit_haproxy/manifests/init.pp index 32c81f8c..75e6de74 100644 --- a/modules/enableit/eit_haproxy/manifests/init.pp +++ b/modules/enableit/eit_haproxy/manifests/init.pp @@ -125,10 +125,6 @@ # Newer Ubuntu LTS (26.04+) ships HAProxy 3.x in stock repos, # so the PPA is unnecessary there. if $facts['os']['release']['major'] =~ /^24/ { - if ! defined(Class['apt']) { - class { 'apt': } - } - $haproxy_lts_version = '3.2' apt::ppa { "ppa:vbernat/haproxy-${haproxy_lts_version}": } From 061b1ac28a8acdb442d6db32fd91846821edc686 Mon Sep 17 00:00:00 2001 From: Sidharth Jawale Date: Tue, 8 Sep 2026 14:50:35 +0530 Subject: [PATCH 07/16] fix: move haproxy default values to role heira file and call profile directly via contain in role Signed-off-by: Sidharth Jawale --- .../enableit/profile/manifests/web/haproxy.pp | 28 +++++++++---------- .../role/data/role/role::web::haproxy.yaml | 15 ++++++++++ .../enableit/role/manifests/web/haproxy.pp | 17 +---------- 3 files changed, 30 insertions(+), 30 deletions(-) create mode 100644 modules/enableit/role/data/role/role::web::haproxy.yaml diff --git a/modules/enableit/profile/manifests/web/haproxy.pp b/modules/enableit/profile/manifests/web/haproxy.pp index efd430de..121a31ca 100644 --- a/modules/enableit/profile/manifests/web/haproxy.pp +++ b/modules/enableit/profile/manifests/web/haproxy.pp @@ -19,23 +19,23 @@ # @groups mode http # class profile::web::haproxy ( - Enum['auto', 'manual'] $configure = 'auto', - Optional[String] $manual_config = undef, - Eit_haproxy::Domains $domains = {}, - Eit_haproxy::Listen $listens = {}, - Boolean $ddos_protection = false, - Boolean $https = true, - Boolean $http = false, - Boolean $use_hsts = true, - Boolean $use_lets_encrypt = true, - Eit_types::Version $version = '3.2.0', - Eit_types::Email $acme_contact = 'ops@enableit.dk', - Enum['Modern','Intermediate'] $encryption_ciphers = 'Modern', + Enum['auto', 'manual'] $configure = $role::web::haproxy::configure, + Optional[String] $manual_config = $role::web::haproxy::manual_config, + Eit_haproxy::Domains $domains = $role::web::haproxy::domains, + Eit_haproxy::Listen $listens = $role::web::haproxy::listens, + Boolean $ddos_protection = $role::web::haproxy::ddos_protection, + Boolean $https = $role::web::haproxy::https, + Boolean $http = $role::web::haproxy::http, + Boolean $use_hsts = $role::web::haproxy::use_hsts, + Boolean $use_lets_encrypt = $role::web::haproxy::use_lets_encrypt, + Eit_types::Version $version = $role::web::haproxy::version, + Eit_types::Email $acme_contact = $role::web::haproxy::acme_contact, + Enum['Modern','Intermediate'] $encryption_ciphers = $role::web::haproxy::encryption_ciphers, Hash[Eit_types::IP,Variant[ Array[Stdlib::Port], Stdlib::Port - ]] $firewall = {}, - Boolean $log_compressed = true, + ]] $firewall = $role::web::haproxy::firewall, + Boolean $log_compressed = $role::web::haproxy::log_compressed, ) inherits profile { # Monitoring $facts.dig('haproxy_version').then |$_haproxy_version| { diff --git a/modules/enableit/role/data/role/role::web::haproxy.yaml b/modules/enableit/role/data/role/role::web::haproxy.yaml new file mode 100644 index 00000000..6fbb6522 --- /dev/null +++ b/modules/enableit/role/data/role/role::web::haproxy.yaml @@ -0,0 +1,15 @@ +--- +role::web::haproxy::configure: "auto" +role::web::haproxy::manual_config: +role::web::haproxy::domains: {} +role::web::haproxy::listens: {} +role::web::haproxy::ddos_protection: false +role::web::haproxy::https: true +role::web::haproxy::http: false +role::web::haproxy::use_hsts: true +role::web::haproxy::use_lets_encrypt: true +role::web::haproxy::version: "3.2.0" +role::web::haproxy::acme_contact: "ops@enableit.dk" +role::web::haproxy::encryption_ciphers: "Modern" +role::web::haproxy::firewall: {} +role::web::haproxy::log_compressed: true diff --git a/modules/enableit/role/manifests/web/haproxy.pp b/modules/enableit/role/manifests/web/haproxy.pp index ecd8c102..79057b23 100644 --- a/modules/enableit/role/manifests/web/haproxy.pp +++ b/modules/enableit/role/manifests/web/haproxy.pp @@ -63,20 +63,5 @@ ) inherits role::web { confine($configure == 'manual', !$manual_config, 'Manual configuration need static haproxy config file') - class { 'profile::web::haproxy': - domains => $domains, - listens => $listens, - ddos_protection => $ddos_protection, - https => $https, - http => $http, - use_hsts => $use_hsts, - use_lets_encrypt => $use_lets_encrypt, - manual_config => $manual_config, - version => $version, - acme_contact => $acme_contact, - configure => $configure, - encryption_ciphers => $encryption_ciphers, - firewall => $firewall, - log_compressed => $log_compressed, - } + contain profile::web::haproxy } From 23e8dcf0e2838c51af47497211127e0be95ef676 Mon Sep 17 00:00:00 2001 From: Sidharth Jawale Date: Tue, 8 Sep 2026 15:07:03 +0530 Subject: [PATCH 08/16] fix: define role haproxy default confuigure value in role rustfs values Signed-off-by: Sidharth Jawale --- modules/enableit/role/data/role/role::storage::rustfs.yaml | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 modules/enableit/role/data/role/role::storage::rustfs.yaml diff --git a/modules/enableit/role/data/role/role::storage::rustfs.yaml b/modules/enableit/role/data/role/role::storage::rustfs.yaml new file mode 100644 index 00000000..2b3417e8 --- /dev/null +++ b/modules/enableit/role/data/role/role::storage::rustfs.yaml @@ -0,0 +1,2 @@ +--- +role::web::haproxy::configure: "auto" From d0e27cf24e0635c0e3f1eabe66d4817615f40c57 Mon Sep 17 00:00:00 2001 From: Sidharth Jawale Date: Tue, 8 Sep 2026 15:37:09 +0530 Subject: [PATCH 09/16] fix: remove expose param for rustdesk since it's expected to setup it alongside haproxy role Signed-off-by: Sidharth Jawale --- modules/enableit/common/manifests/software/rustdesk.pp | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/modules/enableit/common/manifests/software/rustdesk.pp b/modules/enableit/common/manifests/software/rustdesk.pp index faee38a1..44870d07 100644 --- a/modules/enableit/common/manifests/software/rustdesk.pp +++ b/modules/enableit/common/manifests/software/rustdesk.pp @@ -14,15 +14,13 @@ # # @param server_extra_dependencies Array[String] parameter to install OS specific dependencies. Defaults to []. # -# @param expose Whether to expose the service via HAProxy. Defaults to false. -# # @groups management manage. # # @groups client client_enable, client_version, client_extra_dependencies. # # @groups server server_enable, server_version, server_extra_dependencies. # -# @groups networking expose, domains. +# @groups networking, domains. class common::software::rustdesk ( Boolean $manage = false, @@ -33,13 +31,8 @@ Boolean $server_enable = false, Array[String] $server_extra_dependencies = [], Eit_types::Version $server_version = '1.7.1', - - Boolean $expose = false, ) { if $manage { include profile::software::rustdesk - if $expose { - include profile::web::haproxy - } } } From 28c3daee1a4c50c8803029043a1792088400fc03 Mon Sep 17 00:00:00 2001 From: Sidharth Jawale Date: Fri, 11 Sep 2026 06:09:51 +0530 Subject: [PATCH 10/16] fix: pin haproxy version to 3.2 as default while adding support for other lts releases and handle version bugs Signed-off-by: Sidharth Jawale --- .../eit_haproxy/manifests/basic_config.pp | 4 +- .../enableit/eit_haproxy/manifests/init.pp | 37 ++++++++++++++----- modules/enableit/eit_types/types/version.pp | 2 +- .../role/data/role/role::web::haproxy.yaml | 4 +- .../enableit/role/manifests/web/haproxy.pp | 8 ++-- 5 files changed, 37 insertions(+), 18 deletions(-) diff --git a/modules/enableit/eit_haproxy/manifests/basic_config.pp b/modules/enableit/eit_haproxy/manifests/basic_config.pp index f1f08648..65c560e1 100644 --- a/modules/enableit/eit_haproxy/manifests/basic_config.pp +++ b/modules/enableit/eit_haproxy/manifests/basic_config.pp @@ -43,11 +43,11 @@ Boolean $https = true, Boolean $http = false, Boolean $use_hsts = true, - Boolean $use_lets_encrypt = true, + Boolean $use_lets_encrypt = false, Enum['http','tcp'] $mode = 'http', Array[Stdlib::IP::Address,1] $listen_on = ['0.0.0.0'], Enum['Modern','Intermediate'] $encryption_ciphers = 'Modern', - Eit_types::Version $version = '3.2.0', + Eit_types::Version $version = '3.2', Boolean $native_acme = true, Eit_types::Email $acme_contact = $eit_haproxy::acme_contact, String $acme_ca = 'https://acme-v02.api.letsencrypt.org/directory', diff --git a/modules/enableit/eit_haproxy/manifests/init.pp b/modules/enableit/eit_haproxy/manifests/init.pp index 75e6de74..03778dbd 100644 --- a/modules/enableit/eit_haproxy/manifests/init.pp +++ b/modules/enableit/eit_haproxy/manifests/init.pp @@ -24,7 +24,7 @@ # # @param use_hsts Boolean to enable or disable HSTS. Defaults to true. # -# @param use_lets_encrypt Boolean to enable or disable Let's Encrypt. Defaults to true. +# @param use_lets_encrypt Boolean to enable or disable Let's Encrypt / certbot legacy mode. Defaults to false (native ACME used for HAProxy 3.2+). # # @param mode The mode of haproxy. Defaults to 'http'. # @@ -32,7 +32,7 @@ # # @param encryption_ciphers The encryption ciphers to use. Defaults to 'Modern'. # -# @param version The version of haproxy. Defaults to '3.2.0'. +# @param version The version or LTS stream of haproxy (e.g. '3.2', '3.4'). Defaults to '3.2'. Even-minor LTS streams (3.2, 3.4, etc.) are supported for HAProxy 3.x. # # @param acme_contact The contact email for Let's Encrypt ACME. Defaults to 'ops@enableit.dk'. # @@ -77,11 +77,11 @@ Boolean $https = true, Boolean $http = false, Boolean $use_hsts = true, - Boolean $use_lets_encrypt = true, + Boolean $use_lets_encrypt = false, Enum['http','tcp'] $mode = 'http', Array[Stdlib::IP::Address,1] $listen_on = ['0.0.0.0'], Enum['Modern','Intermediate'] $encryption_ciphers = 'Modern', - Eit_types::Version $version = '3.2.0', + Eit_types::Version $version = '3.2', Eit_types::Email $acme_contact = 'ops@enableit.dk', Enum['production','staging'] $ca_type = 'production', Eit_types::Service_Ensure $service_ensure = true, @@ -102,7 +102,23 @@ if $configure == 'auto' { $_is_ubuntu = $facts['os']['name'] == 'Ubuntu' - $_wants_haproxy3 = String($version) =~ /^\d+(\.\d+)*$/ and versioncmp(String($version), '3.2.0') >= 0 + if String($version) =~ /^(\d+)\.(\d+)(?:\.(\d+))?$/ { + $major = Integer($1) + $minor = Integer($2) + + if $major >= 3 { + if $minor % 2 != 0 { + fail("HAProxy version ${version} is invalid. Only even minor versions (LTS releases like 3.2, 3.4, etc.) are supported for HAProxy 3.x.") + } + $_wants_haproxy3 = true + $haproxy_lts_version = "${major}.${minor}" + } else { + $_wants_haproxy3 = false + } + } else { + $_wants_haproxy3 = versioncmp(String($version), '3.2.0') >= 0 + $haproxy_lts_version = '3.2' + } if $_wants_haproxy3 and !$_is_ubuntu { fail("HAProxy 3.x is only supported on Ubuntu, not ${facts['os']['name']}") @@ -122,16 +138,16 @@ if $_wants_haproxy3 { if $_is_ubuntu { # Ubuntu 24.04 ships HAProxy 2.8 — need vbernat's PPA for 3.x. + # See: https://launchpad.net/~vbernat/+archive/ubuntu/haproxy-3.2 (adjusting the suffix for newer LTS like haproxy-3.4). # Newer Ubuntu LTS (26.04+) ships HAProxy 3.x in stock repos, # so the PPA is unnecessary there. if $facts['os']['release']['major'] =~ /^24/ { - $haproxy_lts_version = '3.2' apt::ppa { "ppa:vbernat/haproxy-${haproxy_lts_version}": } Class['apt'] -> Apt::Ppa["ppa:vbernat/haproxy-${haproxy_lts_version}"] -> Class['eit_haproxy::basic_config'] } } else { - warning('HAProxy 3.2.x auto-native ACME path is only supported on Ubuntu') + warning("HAProxy ${haproxy_lts_version} auto-native ACME path is only supported on Ubuntu") } } @@ -142,8 +158,11 @@ } $_version = $_wants_haproxy3 ? { - true => 'latest', - default => $version + true => ($version =~ /^\d+\.\d+$/) ? { + true => 'latest', + default => $version, + }, + default => $version, } class { 'eit_haproxy::basic_config': diff --git a/modules/enableit/eit_types/types/version.pp b/modules/enableit/eit_types/types/version.pp index 4a0df2a8..b5202629 100644 --- a/modules/enableit/eit_types/types/version.pp +++ b/modules/enableit/eit_types/types/version.pp @@ -1,3 +1,3 @@ # Version # NOTE: Regex may not work for all types of versioning numbers current -type Eit_types::Version = Variant[Pattern[/^(\d+\.)?(\d+\.)?(\d+)$/],Eit_types::Package_version] +type Eit_types::Version = Variant[Pattern[/^(\d+)\.(\d+)(?:\.(\d+))?$/],Eit_types::Package_version] diff --git a/modules/enableit/role/data/role/role::web::haproxy.yaml b/modules/enableit/role/data/role/role::web::haproxy.yaml index 6fbb6522..067c342b 100644 --- a/modules/enableit/role/data/role/role::web::haproxy.yaml +++ b/modules/enableit/role/data/role/role::web::haproxy.yaml @@ -7,8 +7,8 @@ role::web::haproxy::ddos_protection: false role::web::haproxy::https: true role::web::haproxy::http: false role::web::haproxy::use_hsts: true -role::web::haproxy::use_lets_encrypt: true -role::web::haproxy::version: "3.2.0" +role::web::haproxy::use_lets_encrypt: false +role::web::haproxy::version: "3.2" role::web::haproxy::acme_contact: "ops@enableit.dk" role::web::haproxy::encryption_ciphers: "Modern" role::web::haproxy::firewall: {} diff --git a/modules/enableit/role/manifests/web/haproxy.pp b/modules/enableit/role/manifests/web/haproxy.pp index 79057b23..581f1d44 100644 --- a/modules/enableit/role/manifests/web/haproxy.pp +++ b/modules/enableit/role/manifests/web/haproxy.pp @@ -14,7 +14,7 @@ # # @param use_hsts Boolean to enable or disable HSTS. Defaults to true. # -# @param use_lets_encrypt Boolean to enable or disable Let's Encrypt. Defaults to true. +# @param use_lets_encrypt Boolean to enable or disable Let's Encrypt / certbot legacy mode. Defaults to false (native ACME used for HAProxy 3.2+). # # @param encryption_ciphers The encryption ciphers to use. Defaults to 'Modern'. # @@ -22,7 +22,7 @@ # # @param firewall The firewall configurations. Defaults to an empty hash. # -# @param version The version of haproxy. Defaults to '3.2.0'. +# @param version The version or LTS stream of haproxy (e.g. '3.2', '3.4'). Defaults to '3.2'. Even-minor LTS streams are supported for HAProxy 3.x. # # @param acme_contact The contact email for Let's Encrypt ACME. Defaults to 'ops@enableit.dk'. # @@ -49,14 +49,14 @@ Boolean $https = true, Boolean $http = false, Boolean $use_hsts = true, - Boolean $use_lets_encrypt = true, + Boolean $use_lets_encrypt = false, Enum['Modern','Intermediate'] $encryption_ciphers = 'Modern', Enum['auto', 'manual'] $configure = 'auto', Hash[Eit_types::IP,Variant[ Array[Stdlib::Port], Stdlib::Port ]] $firewall = {}, - Eit_types::Version $version = '3.2.0', + Eit_types::Version $version = '3.2', Eit_types::Email $acme_contact = 'ops@enableit.dk', Boolean $log_compressed = true, Boolean $__blendable, From d2cabfcedb97ff143076e340a8566e5ec70f93a1 Mon Sep 17 00:00:00 2001 From: Sidharth Jawale Date: Sat, 12 Sep 2026 03:18:34 +0530 Subject: [PATCH 11/16] fix: ensure prometheus scrape jobs are filtered and collected based on certname Signed-off-by: Sidharth Jawale --- modules/enableit/common/manifests/monitor/exporter/blackbox.pp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/enableit/common/manifests/monitor/exporter/blackbox.pp b/modules/enableit/common/manifests/monitor/exporter/blackbox.pp index c21868e0..251efa4e 100644 --- a/modules/enableit/common/manifests/monitor/exporter/blackbox.pp +++ b/modules/enableit/common/manifests/monitor/exporter/blackbox.pp @@ -94,7 +94,7 @@ File <| tag == 'prometheus::scrape_job' |> { noop => $noop_value, } - Prometheus::Scrape_job <<| job_name == 'probe_blackbox_domains' and tag == $customer_id |>> { + Prometheus::Scrape_job <<| job_name == 'probe_blackbox_domains' and tag == $trusted['certname'] |>> { notify => Class['prometheus::service_reload'], } } From 768a6c384b1d587514e99c61817a3a75267faa3d Mon Sep 17 00:00:00 2001 From: Sidharth Jawale Date: Sat, 12 Sep 2026 03:39:34 +0530 Subject: [PATCH 12/16] chore: update rustfs container image version to 1.0.0-rc.5 Signed-off-by: Sidharth Jawale --- modules/enableit/profile/manifests/storage/rustfs.pp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/enableit/profile/manifests/storage/rustfs.pp b/modules/enableit/profile/manifests/storage/rustfs.pp index b4b04551..0e450e55 100644 --- a/modules/enableit/profile/manifests/storage/rustfs.pp +++ b/modules/enableit/profile/manifests/storage/rustfs.pp @@ -12,7 +12,7 @@ String[1] $secret_key = $role::storage::rustfs::secret_key, Boolean $enable = $role::storage::rustfs::enable, Stdlib::Unixpath $data_dir = $role::storage::rustfs::data_dir, - String[1] $version = '1.0.0-rc.3', + String[1] $version = '1.0.0-rc.5', Hash $env_vars = {}, ) { # 1. Manage RustFS From 6d852754d330c01f4cd1d35594216f029391386e Mon Sep 17 00:00:00 2001 From: Sidharth Jawale Date: Sun, 13 Sep 2026 22:22:21 +0530 Subject: [PATCH 13/16] fix: update haproxy dump certs script to reduce noise Signed-off-by: Sidharth Jawale --- .../eit_haproxy/files/haproxy-dump-certs.sh | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/modules/enableit/eit_haproxy/files/haproxy-dump-certs.sh b/modules/enableit/eit_haproxy/files/haproxy-dump-certs.sh index 131cc1b3..57691a20 100755 --- a/modules/enableit/eit_haproxy/files/haproxy-dump-certs.sh +++ b/modules/enableit/eit_haproxy/files/haproxy-dump-certs.sh @@ -19,14 +19,18 @@ RETRY_DELAY=10 # Restored argument parsing usage() { cat <&2; exit 2 ;; esac @@ -37,7 +41,9 @@ hap() { socat - "UNIX-CONNECT:${SOCKET}"; } dump_one() { local path="$1" - echo "Attempting dump for: ${path}" >&2 + if [ "${DEBUG:-false}" = true ]; then + echo "Attempting dump for: ${path}" >&2 + fi local dir tmp dir=$(dirname "$path") tmp=$(mktemp "${dir}/.$(basename "$path").XXXXXX") @@ -76,7 +82,9 @@ dump_one() { if cmp -s \ <(sha256sum "$tmp" | cut -d ' ' -f1) \ <(sha256sum "$path" | cut -d ' ' -f1); then - echo "Already up-to-date: ${path}" >&2 + if [ "${DEBUG:-false}" = true ]; then + echo "Already up-to-date: ${path}" >&2 + fi return 0 fi fi From 676cc33aab517a9ec4fa47f30328c3ee806de22b Mon Sep 17 00:00:00 2001 From: Sidharth Jawale Date: Sun, 13 Sep 2026 23:04:27 +0530 Subject: [PATCH 14/16] fix: update haproxy dump certs script to analyze unused domain expiry threshold prom files Signed-off-by: Sidharth Jawale --- .../eit_haproxy/files/haproxy-dump-certs.sh | 24 +++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/modules/enableit/eit_haproxy/files/haproxy-dump-certs.sh b/modules/enableit/eit_haproxy/files/haproxy-dump-certs.sh index 57691a20..ef4663b1 100755 --- a/modules/enableit/eit_haproxy/files/haproxy-dump-certs.sh +++ b/modules/enableit/eit_haproxy/files/haproxy-dump-certs.sh @@ -77,6 +77,12 @@ dump_one() { return 0 fi + local cn + cn=$(openssl x509 -in "$tmp" -noout -subject 2>/dev/null | sed -n 's/.*CN[[:space:]]*=[[:space:]]*\([^,/[:space:]]*\).*/\1/p') + if [ -n "$cn" ]; then + echo "$cn" >> /tmp/active_cert_domains.txt + fi + # Optimization: Content verification with fast sha256sum if [ -f "$path" ]; then if cmp -s \ @@ -105,10 +111,24 @@ else done < /tmp/cert_list.txt echo "----------------------------------------------------------------------------------" - echo "Analyzing for unused certificates..." + echo "Analyzing for unused certificates which can be removed..." comm -23 \ <(ls /etc/haproxy/certs/*.pem 2>/dev/null | sort) \ <(sort /tmp/cert_list.txt) | while read -r unused_cert; do - echo "The following certificate is no longer being used and can be removed: $unused_cert" + echo "$unused_cert" done + + echo "----------------------------------------------------------------------------------" + echo "Analyzing for unused domain expiry threshold .prom files which can be removed..." + if [ -f /tmp/active_cert_domains.txt ]; then + sort -u /tmp/active_cert_domains.txt -o /tmp/active_cert_domains.txt + for prom_file in /var/lib/node_exporter/textfile_collector/threshold_monitor_domains_expiry_*.prom; do + [ -e "$prom_file" ] || continue + prom_domain=$(basename "$prom_file" | sed 's/^threshold_monitor_domains_expiry_//;s/\.prom$//') + if ! grep -q "^${prom_domain}$" /tmp/active_cert_domains.txt; then + echo "$prom_file" + fi + done + rm -f /tmp/active_cert_domains.txt + fi fi From ea6e4b56011da87f2fa0a7b322f28d549ab8d356 Mon Sep 17 00:00:00 2001 From: Sidharth Jawale Date: Mon, 14 Sep 2026 11:17:38 +0530 Subject: [PATCH 15/16] fix: ensure haproxy 3.x correctly maps to the latest version Signed-off-by: Sidharth Jawale --- modules/enableit/eit_haproxy/manifests/init.pp | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/modules/enableit/eit_haproxy/manifests/init.pp b/modules/enableit/eit_haproxy/manifests/init.pp index 03778dbd..8eb0a8ca 100644 --- a/modules/enableit/eit_haproxy/manifests/init.pp +++ b/modules/enableit/eit_haproxy/manifests/init.pp @@ -158,10 +158,7 @@ } $_version = $_wants_haproxy3 ? { - true => ($version =~ /^\d+\.\d+$/) ? { - true => 'latest', - default => $version, - }, + true => 'latest', default => $version, } From 809c814ae464509f32f4762e9428c4b2b6d666b6 Mon Sep 17 00:00:00 2001 From: Sidharth Jawale Date: Mon, 14 Sep 2026 14:21:10 +0530 Subject: [PATCH 16/16] fix: install latest haproxy for both manual and basic config approaches Signed-off-by: Sidharth Jawale --- modules/enableit/eit_haproxy/manifests/basic_config.pp | 2 +- modules/enableit/eit_haproxy/manifests/init.pp | 7 +------ modules/enableit/eit_haproxy/manifests/install.pp | 7 ++++++- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/modules/enableit/eit_haproxy/manifests/basic_config.pp b/modules/enableit/eit_haproxy/manifests/basic_config.pp index 65c560e1..189585e8 100644 --- a/modules/enableit/eit_haproxy/manifests/basic_config.pp +++ b/modules/enableit/eit_haproxy/manifests/basic_config.pp @@ -47,7 +47,7 @@ Enum['http','tcp'] $mode = 'http', Array[Stdlib::IP::Address,1] $listen_on = ['0.0.0.0'], Enum['Modern','Intermediate'] $encryption_ciphers = 'Modern', - Eit_types::Version $version = '3.2', + Eit_types::Version $version = 'latest', Boolean $native_acme = true, Eit_types::Email $acme_contact = $eit_haproxy::acme_contact, String $acme_ca = 'https://acme-v02.api.letsencrypt.org/directory', diff --git a/modules/enableit/eit_haproxy/manifests/init.pp b/modules/enableit/eit_haproxy/manifests/init.pp index 8eb0a8ca..a55b82fb 100644 --- a/modules/enableit/eit_haproxy/manifests/init.pp +++ b/modules/enableit/eit_haproxy/manifests/init.pp @@ -157,14 +157,9 @@ } } - $_version = $_wants_haproxy3 ? { - true => 'latest', - default => $version, - } - class { 'eit_haproxy::basic_config': domains => $domains, - version => $_version, + version => 'latest', native_acme => $_use_native_acme, ddos_protection => $ddos_protection, https => $https, diff --git a/modules/enableit/eit_haproxy/manifests/install.pp b/modules/enableit/eit_haproxy/manifests/install.pp index f71af66e..8e171994 100644 --- a/modules/enableit/eit_haproxy/manifests/install.pp +++ b/modules/enableit/eit_haproxy/manifests/install.pp @@ -3,8 +3,13 @@ String $package_name, Eit_types::Version $ensure = 'present', ) { + $_package_ensure = $eit_haproxy::version =~ /^\d+\.\d+$/ ? { + true => 'present', + default => $eit_haproxy::version, + } + package { $package_name: - ensure => $eit_haproxy::version, + ensure => $_package_ensure, notify => Service[$eit_haproxy::service_name], }