New option to require http auth for all requests if not from a private IP

tasks/configure.yml

@@ -85,6 +85,16 @@
     - 'blacklist.agent'
   notify: "Check HAProxy Config"
 
+- name: "Update private ips"
+  template:
+    src='privatelist.ip.jinja2'
+    dest='/etc/haproxy/privatelist.ip'
+    owner='root'
+    group='root'
+    mode='644'
+  when: haproxy_private is defined
+  notify: "Check HAProxy Config"
+
 - name: "Create config file"
   template:
     src='haproxy_cfg.jinja2'

templates/haproxy_cfg.jinja2

@@ -49,10 +49,22 @@ userlist kibana
   user {{ user.username }} insecure-password '{{ user.password }}'
 {% endfor %}
 {% endif %}
+{% if haproxy_private is defined %}
+
+userlist notprivate
+{% for user in haproxy_private.auth %}
+  user {{ user.username }} insecure-password '{{ user.password }}'
+{% endfor %}
+{% endif %}
 
 frontend http_in
   bind *:80
   http-request del-header Proxy
+{% if haproxy_private is defined %}
+  acl privateip src -f /etc/haproxy/privatelist.ip
+  acl private_auth http_auth(notprivate) if !privateip
+  http-request auth realm notprivate if !privateip !private_auth
+{% endif %}
   acl blockedip src -f /etc/haproxy/blacklist.ip
   http-request deny if blockedip
   acl blockedreferer hdr_sub(referer) -i -f /etc/haproxy/blacklist.referer
@@ -170,6 +182,11 @@ frontend http_in
 frontend https_in_{{ cert.ip }}
   bind {{ cert.ip }}:443 ssl crt /etc/haproxy/certs/{{ cert.file }} no-sslv3
   http-request del-header Proxy
+{% if haproxy_private is defined %}
+  acl privateip src -f /etc/haproxy/privatelist.ip
+  acl private_auth http_auth(notprivate) if !privateip
+  http-request auth realm notprivate if !privateip !private_auth
+{% endif %}
   acl blockedip src -f /etc/haproxy/blacklist.ip
   http-request deny if blockedip
   acl blockedreferer hdr_sub(referer) -i -f /etc/haproxy/blacklist.referer

templates/privatelist.ip.jinja2

+{% for ip in haproxy_private.ip %}
+{{ ip }}
+{% endfor %}