added ssl to port 9200

group_vars/all/main.yml

 ---
 
-dslproxy: "arne-centos2.cert-labs.uninett.no"
+dslproxy: "<CHANGE_ME:hostname>"
 
 # TheHive Button plugin
 THEHIVE_URL: "https://hive.gn4-3-wp8-soc.sunet.se/"

roles/build/files/haproxy-entrypoint.sh

-#!/bin/sh
-set -e
-
-# first arg is `-f` or `--some-option`
-if [ "${1#-}" != "$1" ]; then
-	set -- haproxy "$@"
-fi
-
-if [ "$1" = 'haproxy' ]; then
-	shift # "haproxy"
-	# if the user wants "haproxy", let's add a couple useful flags
-	#   -W  -- "master-worker mode" (similar to the old "haproxy-systemd-wrapper"; allows for reload via "SIGUSR2")
-	#   -db -- disables background mode
-	set -- haproxy -W -db "$@"
-fi
-
-exec "$@"

roles/haproxy/templates/haproxy.cfg.j2

@@ -36,14 +36,14 @@ listen nifiserv
 {% endfor %}
 
 listen odfeserv
-        bind *:9200
+        bind *:9200 ssl crt /etc/ssl/haproxy alpn h2,http/1.1
         mode http
         maxconn 5000
         fullconn 5000
         balance source
         option tcpka
 {% for odfehost in groups['odfeescontainers'] %}
-     	server {{odfehost}} {{odfehost}}:9200 check
+     	server {{odfehost}} {{odfehost}}:9200 ssl check verify none
 {% endfor %}
 	
 listen keycloakserv

roles/nifi/templates/users.xml.j2

@@ -17,7 +17,7 @@
         <user identifier="c78caf19-016f-1000-0001-{{'%012d'|format(loop.index) }}" identity="CN={{ nifi }}"/>
         {% endfor %}
 	{% for user in soctools_users %}
-        <user identifier="c78caf19-016f-1000-0002-{{'%012d'|format(loop.index) }}" identity="{{ user.DN }}"/>
+        <user identifier="c78caf19-016f-1000-0002-{{'%012d'|format(loop.index) }}" identity="{{ user.username }}"/>
         {% endfor %}        
     </users>
 </tenants>