Sort more host lists in templates

roles/acme/templates/config.yml.j2

@@ -14,7 +14,7 @@ dns:
   tsig_key_algo: "{{ acme_tsig_key.algo }}"
   tsig_key_secret: "{{ acme_tsig_key.private }}"
   nameservers:
-{% for h in groups['frontend'] %}
+{% for h in groups['frontend']|sort %}
     - {{ hostvars[h]['ip'] }}
 {% endfor %}
 output:

roles/dns/templates/dns/infra.yml

@@ -2,7 +2,7 @@
 
 "@base":
   _:
-{% for h in groups['frontend'] %}
+{% for h in groups['frontend']|sort %}
     - {{ hostvars[h]['ip'] }}
 {% if 'ip6' in hostvars[h] %}
     - AAAA {{ hostvars[h]['ip6'] }}
@@ -17,7 +17,7 @@
   EXTENDS: "@base"
   www:
     - $FRONTENDS4
-{% for h in groups['frontend'] %}
+{% for h in groups['frontend']|sort %}
   ns{{ loop.index }}: {{ hostvars[h]['ip'] }}
   mx{{ loop.index }}: {{ hostvars[h]['ip'] }}
 {% endfor %}
@@ -26,7 +26,7 @@
 {% for pe in s.get('public_endpoints', []) %}
   {{ pe.name }}: CNAME www
 {% if pe.get('sharded') %}
-{% for h in groups[service_name] %}
+{% for h in groups[service_name]|sort %}
   {{ hostvars[h]['shard_id'] }}.{{ pe.name }}: CNAME www
 {% endfor %}
 {% endif %}

roles/dns/templates/zonetool.yml

 ---
 
 FRONTENDS4:
-{% for h in groups['frontend'] %}
+{% for h in groups['frontend']|sort %}
   - {{ hostvars[h]['ip'] }}
 {% endfor %}
 
 FRONTENDS6:
-{% for h in groups['frontend'] %}
+{% for h in groups['frontend']|sort %}
 {% if 'ip6' in hostvars[h] %}
   - {{ hostvars[h]['ip6'] }}
 {% endif %}

roles/haproxy/templates/haproxy.cfg.j2

@@ -33,7 +33,7 @@ backend be_{{ service_name }}_{{ ep.name }}
         log global
         balance leastconn
         option independant-streams
-{% for s in groups[service_name] %}   
+{% for s in groups[service_name]|sort %}   
         server task{{ loop.index -1 }} {{ s }}.{{ service_name }}.{{ domain }}:{{ port }} check fall 3 id {{ loop.index + 999 }} inter 5000 rise 3 slowstart 60000 weight 50
 {% endfor %}
 
@@ -49,7 +49,7 @@ backend be_{{ service_name }}_{{ ep.name }}
         log global
         balance leastconn
         option independant-streams
-{% for s in groups[service_name] %}   
+{% for s in groups[service_name]|sort %}
         server task{{ loop.index -1 }} {{ s }}.{{ service_name }}.{{ domain }}:{{ ep.port }} check fall 3 id {{ loop.index + 999 }} inter 5000 rise 3 slowstart 60000 weight 50
 {% endfor %}
 

roles/net-overlay/templates/firewall/11net-overlay.j2

 # Allow peer nodes to communicate with our tinc daemon.
 create_chain allow-vpn-{{ tinc_net }}
-{% for h in groups['overlay-' + tinc_net] %}
+{% for h in groups['overlay-' + tinc_net]|sort %}
 {% if h != inventory_hostname %}
 add_rule4 -A allow-vpn-{{ tinc_net }} -s {{ hostvars[h]['ip'] }} -j ACCEPT
 {% if hostvars[h].get('ip6') %}

roles/net-overlay/templates/tinc/tinc.conf.j2

@@ -14,7 +14,7 @@ Broadcast = no
 ReplayWindow = 32
 
 # Connect to all other known nodes (full mesh).
-{% for host in groups['overlay-' + tinc_net] %}
+{% for host in groups['overlay-' + tinc_net]|sort %}
 ConnectTo = {{ host }}
 {% endfor %}
 

roles/nginx/templates/nginx-upstream.j2

@@ -19,7 +19,7 @@ upstream {{ upstream.name }}{% if shard %}_{{ shard }}{% endif %} {
 
 {% for upstream in float_http_upstreams.values() %}
 {% if upstream.sharded %}
-{% for h in groups[upstream.service_name] %}
+{% for h in groups[upstream.service_name]|sort %}
 {{ config_upstream(upstream, hostvars[h]['shard_id']) }}
 {% endfor %}
 {% else %}

roles/nginx/templates/nginx-vhost.j2

@@ -57,7 +57,7 @@ server {
     disable generation of the entire virtual host.
 #}
 {% set root_upstream = float_http_upstreams[endpoint.float_path_map['/'].float_upstream_name] %}
-{% for h in groups[root_upstream.service_name] %}
+{% for h in groups[root_upstream.service_name]|sort %}
 {{ config_vhost(endpoint, hostvars[h]['shard_id']) }}
 {% endfor %}
 {% else %}

roles/nginx/templates/replds.j2

 server:
   addr: ":5005"
   path: "/var/lib/replds/acme"
+{% if groups['frontend']|length > 1 %}
   peers:
-{% for h in groups['frontend'] %}
-{% if h != inventory_hostname %}
+{% for h in groups['frontend']|sort %}{% if h != inventory_hostname %}
     - https://{{ h }}.frontend.{{ domain }}:5005
+{% endif %}{% endfor %}
+{% else %}
+  peers: []
 {% endif %}
-{% endfor %}
   tls_client:
     cert: "/etc/credentials/x509/replds-acme/client/cert.pem"
     key: "/etc/credentials/x509/replds-acme/client/private_key.pem"

roles/prometheus/templates/alertmanager.default.j2

@@ -6,5 +6,5 @@ then hope that if there are multiple alertmanagers, they are all on
 the same overlay network.
 
 #}
-ARGS="--web.external-url=https://alertmanager.{{ domain_public[0] }} --cluster.listen-address=:9094 --cluster.advertise-address={{ float_host_dns_map[inventory_hostname + '.prometheus'][0] }}:9094{% for h in groups['prometheus'] %}{% if h != inventory_hostname %} --cluster.peer={{ h }}.prometheus.{{ domain }}:9094{% endif %}{% endfor %}"
+ARGS="--web.external-url=https://alertmanager.{{ domain_public[0] }} --cluster.listen-address=:9094 --cluster.advertise-address={{ float_host_dns_map[inventory_hostname + '.prometheus'][0] }}:9094{% for h in groups['prometheus']|sort %}{% if h != inventory_hostname %} --cluster.peer={{ h }}.prometheus.{{ domain }}:9094{% endif %}{% endfor %}"
 

roles/sso-server/templates/server.yml.j2

@@ -69,7 +69,7 @@ device_manager:
   trusted_forwarders:
     - 127.0.0.1
     - ::1
-{% for h in groups['frontend'] %}
+{% for h in groups['frontend']|sort %}
     - {{ hostvars[h]['ip'] }}
 {% for n in net_overlays %}{% if hostvars[h].get('ip_' + n.name) %}
     - {{ hostvars[h]['ip_' + n.name] }}