Replace ingress proxy with nginx

This enables HTTPS redirecting at it too much more easily, and matches the gateway configuration.

Requires using upstream versions of nginx to enable https://nginx.org/en/docs/stream/ngx_stream_realip_module.html

ansible/main.yml

@@ -58,6 +58,8 @@
   roles:
     - role: chmduquesne.iptables_persistent
       become: true
+    - role: nginxinc.nginx  # The nginx in debian's repos is very old
+      become: true
     - ingress
     - nebula
 

ansible/roles/ingress/files/haproxy.cfg

@@ -1,37 +0,0 @@
-global
-  log /dev/log	local0
-  log /dev/log	local1 notice
-  pidfile /run/haproxy.pid
-  stats timeout 30s
-  user haproxy
-  group haproxy
-  daemon
-  maxconn 10000
-
-defaults
-  log global
-  mode	http
-  option httplog
-  option dontlognull
-
-# Internal LAN routes
-listen http_internal
-    bind *:80
-    mode http
-    server default {{ pve_hosts.docker.ip }}:80 send-proxy-v2
-
-listen https_internal
-    bind *:443
-    mode tcp
-    server default {{ pve_hosts.docker.ip }}:443 send-proxy-v2
-
-listen matrix_internal
-    bind *:8448
-    mode tcp
-    server default {{ pve_hosts.docker.ip }}:443 send-proxy-v2
-
-# External routes
-listen https_external
-    bind *:8443 accept-proxy
-    mode tcp
-    server default {{ pve_hosts.docker.ip }}:443 send-proxy-v2

ansible/roles/ingress/files/nginx.conf

@@ -0,0 +1,58 @@
+worker_processes 1;
+
+events {
+    worker_connections  1024;
+}
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+
+    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+    #                  '$status $body_bytes_sent "$http_referer" '
+    #                  '"$http_user_agent" "$http_x_forwarded_for"';
+
+    #access_log  logs/access.log  main;
+
+    sendfile        on;
+    #tcp_nopush     on;
+
+    #keepalive_timeout  0;
+    keepalive_timeout  65;
+
+    #gzip  on;
+
+    server_tokens off;
+
+    server {
+        listen 80;
+        server_name _;
+        return 308 https://$host$request_uri;
+    }
+}
+
+stream {
+
+    log_format access '$remote_addr [$time_local] '
+                    '$protocol $status $bytes_sent $bytes_received '
+                    '$session_time "$upstream_addr" '
+                    '"$upstream_bytes_sent" "$upstream_bytes_received" "$upstream_connect_time"';
+
+    access_log /var/log/nginx/access.log access;
+
+    # Internal LAN route
+    server {
+        listen 443;
+        listen 8448;
+        proxy_pass {{ pve_hosts.docker.ip }}:443;
+        proxy_protocol on;
+    }
+
+    # External routes
+    server {
+        listen 8443 proxy_protocol;
+        proxy_protocol on;
+        proxy_pass {{ pve_hosts.docker.ip }}:443;
+        set_real_ip_from {{ wireguard.server.ip }};
+    }
+}

ansible/roles/ingress/handlers/main.yml

@@ -4,8 +4,8 @@
     state: restarted
   become: true
 
-- name: restart haproxy
+- name: restart nginx
   service:
-    name: haproxy
+    name: nginx
     state: restarted
   become: true

ansible/roles/ingress/tasks/haproxy.yml

@@ -1,20 +0,0 @@
-- name: Install Haproxy
-  package:
-    name: haproxy
-  become: true
-
-- name: Haproxy config
-  template:
-    src: files/haproxy.cfg
-    dest: /etc/haproxy/haproxy.cfg
-    validate: /usr/sbin/haproxy -c -- %s
-    mode: "0644"
-    backup: yes
-  become: true
-  notify: restart haproxy
-
-- name: Enable Haproxy
-  service:
-    name: haproxy
-    enabled: true
-  become: true

ansible/roles/ingress/tasks/main.yml

@@ -1,5 +1,5 @@
 - name: Configure wireguard
   include: wireguard.yml
 
-- name: Configure haproxy
-  include: haproxy.yml
+- name: Configure nginx
+  include: nginx.yml

ansible/roles/ingress/tasks/nginx.yml

@@ -0,0 +1,19 @@
+- name: Install nginx
+  package:
+    name: nginx
+  become: true
+
+- name: Nginx config
+  template:
+    src: files/nginx.conf
+    dest: /etc/nginx/nginx.conf
+    validate: nginx -t -c %s
+    mode: "0644"
+  become: true
+  notify: restart nginx
+
+- name: Enable nginx
+  service:
+    name: nginx
+    enabled: true
+  become: true