SV-50578 Implement blacklist for haproxy

defaults/main.yml

 default_proxy: ''
 proxy_default_backend: ''
+proxy_blacklist_ips: []

tasks/configure.yml

@@ -67,3 +67,12 @@
         hour='*'
         minute='*/1'
         job='/etc/haproxy/update/update.sh >/dev/null 2>&1'
+
+- name: "Proxy | Update blacklist"
+  template: src=blacklist
+            dest=/etc/haproxy/blacklist
+            owner=root
+            group=root
+            mode=644
+  when: scope == 'all'
+  notify: 'Proxy | Restart HAProxy'

templates/blacklist

+{% for line in hostvars[item]['proxy_blacklist_ips'] %}
+{{line}}
+{% endfor %}

templates/haproxy_cfg

@@ -43,6 +43,8 @@ listen stats 127.0.0.1:7000
 
 frontend http-in
   bind *:80
+  acl blockedip src  -i -f /etc/haproxy/blacklist
+  http-request deny if blockedip
 {% for host in groups['all'] %}
 {% if hostvars[host]['proxy_redirect'] %}
 {% for redirect in hostvars[host]['proxy_redirect'] %}
@@ -67,6 +69,8 @@ frontend http-in
 
 frontend https-in
   bind :443 ssl crt /etc/haproxy/certs/s-verein.de.pem no-sslv3
+  acl blockedip src  -i -f /etc/haproxy/blacklist
+  http-request deny if blockedip
 {% for host in groups['all'] %}
 {% if hostvars[host]['proxy_redirect'] %}
 {% for redirect in hostvars[host]['proxy_redirect'] %}