Add Haproxy Configuration
parent
01356744f1
commit
49302b4117
182
Haproxy-Configuration.md
Normal file
182
Haproxy-Configuration.md
Normal file
@ -0,0 +1,182 @@
|
||||
# Setting up haproxy
|
||||
|
||||
We need a few configuration files for haproxy. All these files go in the haproxy directory `/srv/docker/clrghouz/haproxy`). Make adjustments as appropriate.
|
||||
|
||||
This is `10-default.cfg`
|
||||
```cfg
|
||||
global
|
||||
log stdout format raw local0
|
||||
ssl-default-bind-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
|
||||
ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets
|
||||
user haproxy
|
||||
group haproxy
|
||||
|
||||
defaults
|
||||
mode tcp
|
||||
timeout connect 5s
|
||||
timeout client 10m
|
||||
timeout server 10m
|
||||
|
||||
# email-alert mailers mailers
|
||||
# email-alert from me@example.com
|
||||
# email-alert to me@example.com
|
||||
|
||||
option tcplog
|
||||
log global
|
||||
|
||||
#mailers mailers
|
||||
# mailer smtp [YOUR MAIL SERVER]:25
|
||||
|
||||
#resolvers dns
|
||||
# nameserver dns1 [YOUR DNS SERVER]:53
|
||||
|
||||
frontend stats
|
||||
bind :::8080
|
||||
mode http
|
||||
stats uri /
|
||||
stats enable
|
||||
stats refresh 10s
|
||||
```
|
||||
|
||||
This is `20-clrghouz.cfg`
|
||||
```cfg
|
||||
# EMSI
|
||||
frontend fe-clrg-emsi
|
||||
bind :::60179 v4v6
|
||||
default_backend be-clrg-emsi
|
||||
maxconn 4
|
||||
|
||||
# Track the backend state - and reject any attempts if its down
|
||||
acl be-emsi-dead nbsrv(be-clrg-emsi) lt 1
|
||||
tcp-request connection reject if be-emsi-dead
|
||||
|
||||
# stick table definition for storing rates
|
||||
stick-table type ipv6 size 500k expire 30m store conn_cur,conn_rate(60s)
|
||||
|
||||
## Allow clean known IPs to bypass the filter
|
||||
tcp-request connection accept if { src -f /usr/local/etc/haproxy/config/whitelist.lst }
|
||||
# Only allow 1 connections per IP opened
|
||||
tcp-request connection reject if { src_conn_cur ge 1 }
|
||||
# Only allow 1 connections per 60s
|
||||
tcp-request connection reject if { src_conn_rate ge 3 }
|
||||
tcp-request connection track-sc1 src
|
||||
|
||||
backend be-clrg-emsi
|
||||
balance roundrobin
|
||||
server clrghouz clrghouz-web-1:60179 send-proxy-v2
|
||||
|
||||
# BINKP
|
||||
frontend fe-clrg-binkp
|
||||
bind :::24554 v4v6
|
||||
default_backend be-clrg-binkp
|
||||
maxconn 10
|
||||
|
||||
stick-table type ipv6 size 500k expire 30m store conn_cur,conn_rate(60s)
|
||||
|
||||
## Allow clean known IPs to bypass the filter
|
||||
tcp-request connection accept if { src -f /usr/local/etc/haproxy/config/whitelist.lst }
|
||||
# Only allow 1 connections per IP opened
|
||||
tcp-request connection reject if { src_conn_cur ge 1 }
|
||||
# Only allow 1 connections per 60s
|
||||
tcp-request connection reject if { src_conn_rate ge 3 }
|
||||
tcp-request connection track-sc1 src
|
||||
|
||||
# BINKPS
|
||||
frontend fe-clrg-binkps
|
||||
bind :::24553 v4v6 tfo ssl crt /usr/local/etc/haproxy/config/binkps.pem
|
||||
default_backend be-clrg-binkp
|
||||
maxconn 10
|
||||
|
||||
backend be-clrg-binkp
|
||||
balance roundrobin
|
||||
server clrghouz clrghouz-web-1:24554 send-proxy-v2
|
||||
```
|
||||
|
||||
This is `20-https.cfg`
|
||||
```cfg
|
||||
frontend fe-http
|
||||
mode http
|
||||
bind :::80
|
||||
bind :::443 ssl crt-list /usr/local/etc/haproxy/config/crt-list.conf
|
||||
http-request add-header X-Forwarded-Proto https
|
||||
http-request redirect scheme https unless { ssl_fc }
|
||||
use_backend be-http-clrghouz if { ssl_fc_sni -i clrghouz.bbs.dege.au }
|
||||
# default_backend be-http-docker
|
||||
|
||||
backend be-http-clrghouz
|
||||
mode http
|
||||
balance leastconn
|
||||
server clrghouz clrghouz-web-1:80
|
||||
|
||||
#backend be-http-docker
|
||||
# mode http
|
||||
# balance leastconn
|
||||
# server docker [YOUR WEBSERVER]:80
|
||||
```
|
||||
|
||||
This is `binkps.pem`:
|
||||
```ssl
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIEKjCCAxKgAwIBAgIJALsoV61BAIR7MA0GCSqGSIb3DQEBCwUAMGAxCzAJBgNV
|
||||
BAYTAkFVMQwwCgYDVQQIEwNWSUMxEjAQBgNVBAcTCU1lbGJvdXJuZTENMAsGA1UE
|
||||
ChMEQUNNRTEMMAoGA1UECxMDV2ViMRIwEAYDVQQDEwlsb2NhbGhvc3QwHhcNMTgw
|
||||
NjE5MjAxNTE5WhcNMjgwNjE2MjAxNTE5WjBgMQswCQYDVQQGEwJBVTEMMAoGA1UE
|
||||
CBMDVklDMRIwEAYDVQQHEwlNZWxib3VybmUxDTALBgNVBAoTBEFDTUUxDDAKBgNV
|
||||
BAsTA1dlYjESMBAGA1UEAxMJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOC
|
||||
AQ8AMIIBCgKCAQEAv0hEQONbM1iz6nwTWwFuByY0sBK8hXlgyOTJftnQr+ffhKXn
|
||||
f30WovFmy1FBTUDa42T5Fsa6aihw+QAuLFtnMogZRIqp8Ow9ovGLv7Wo6KRoQ6Db
|
||||
JJ0FofUBiMVQy79/alUlgEYwuPlgjWwl7+pPZobXjaytAfK7WcGxMKiy6cBpFHMD
|
||||
LOGNsnjSyFDZtRSMyOd07SZDhS1J5IV25v76URsyYQU+kriqZK8AkC2emz/hkcVF
|
||||
10nlli2R6JsidiwN4JAPG1zKA3p0Ki0R6uG//1dQ9MuCIiCZkJklmg3ZmhjpBCY0
|
||||
n+nB+F3XSDsyYR7MWZvfRHyx3w/WVpGdVymmrwIDAQABo4HmMIHjMBEGCWCGSAGG
|
||||
+EIBAQQEAwIGQDAdBgNVHQ4EFgQUV31E9ULcEQkSmlgq1uQ0WiyR/DswgZIGA1Ud
|
||||
IwSBijCBh4AUV31E9ULcEQkSmlgq1uQ0WiyR/DuhZKRiMGAxCzAJBgNVBAYTAkFV
|
||||
MQwwCgYDVQQIEwNWSUMxEjAQBgNVBAcTCU1lbGJvdXJuZTENMAsGA1UEChMEQUNN
|
||||
RTEMMAoGA1UECxMDV2ViMRIwEAYDVQQDEwlsb2NhbGhvc3SCCQC7KFetQQCEezAa
|
||||
BgNVHREEEzARhwR/AAABgglsb2NhbGhvc3QwDQYJKoZIhvcNAQELBQADggEBAAZL
|
||||
WWeY7sbVX6noNjiQWe9jzBKG994f5/Q5dpqT6ZHpLsSU2AQ85QfUXma3rAPwSj0+
|
||||
C4V7IRlrwlFXXqe8LxWxEJo0DlHOqDZTxQpHvmwATRxTBHDOS4kMjbj5oAwq0yXz
|
||||
dNxxOI5Pv9j6VIMMIgW6dFnh/GRG5w5lndtWisCU8ydG/PkeMkvi3OTQDTq64qgp
|
||||
lt0OTDkTyoWmpq46k3NDR2n6ar7DwEmamMWPkR9rNLjOde2AlKMuNZ4wUMVAYasr
|
||||
xDMmMCe/matHd6Ry2kvBkBRFkFaJyR2+D2vpYSbT8fSFOKv6w+5qJI8pOQ1Yn+Di
|
||||
3+EttBcVhrZfxoL8jYw=
|
||||
-----END CERTIFICATE-----
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC/SERA41szWLPq
|
||||
fBNbAW4HJjSwEryFeWDI5Ml+2dCv59+Eped/fRai8WbLUUFNQNrjZPkWxrpqKHD5
|
||||
AC4sW2cyiBlEiqnw7D2i8Yu/tajopGhDoNsknQWh9QGIxVDLv39qVSWARjC4+WCN
|
||||
bCXv6k9mhteNrK0B8rtZwbEwqLLpwGkUcwMs4Y2yeNLIUNm1FIzI53TtJkOFLUnk
|
||||
hXbm/vpRGzJhBT6SuKpkrwCQLZ6bP+GRxUXXSeWWLZHomyJ2LA3gkA8bXMoDenQq
|
||||
LRHq4b//V1D0y4IiIJmQmSWaDdmaGOkEJjSf6cH4XddIOzJhHsxZm99EfLHfD9ZW
|
||||
kZ1XKaavAgMBAAECggEAaJje4dCxZVGDCJ0ShHgyr2wf8Yw9VIt79j7NRDVdXWNh
|
||||
IYsLHPbM8wsoV9O17sWhLClh4CeJdlVo+XA0z4Kn2sT7dDSTGzBDwB9veMSgeZ61
|
||||
eQ2z58CJfPeaAC1NsiykQwQOfqdjKzMKrirOT/QDuR/RLSKYdHFEK5+0AdSuCQ2A
|
||||
PV68FX6BnKfR/LDt6auN43ISdrnXRFna5Helyel2l3Jv/ooz9FeeTbXUa9cQcrXM
|
||||
tMvd8GMr4oLnhKROcec0bTOy/3ZymbEvjjQvgxukivLLOUbQiwp2lfQWcFna4cOL
|
||||
apGeameOHQceF4iIibnbDo073jS3m02WBH0ScRsj2QKBgQDxRWZWSGuJkFQOoW/b
|
||||
uuwu26RAFdXLsxr2G9XMIZR+rpmhq5EoM4CL/YI5syChgYgxAj8UfwYg93wuGkN8
|
||||
5VPhuytH5MIDsXq9Ci2b+WQrF5sxDK3MA3FieFZByVX80JNXtVUudzqQ6wJ1OEsY
|
||||
wB+h2Uu9zssNZVugPh3wb5BsLQKBgQDK9aN97C3JtLW+xOoEYW1iCputwoDWIIqk
|
||||
i6fi0mTQiQ+YbliaXWS/F7tJrUHvFFgJLZcpDKaEaN5WFjFHU+1zUDtotEiJ7bTQ
|
||||
fuoyWY/8VpWn6RKwukL+mfIm2n7ZT6FC8YBU6lRPEmuGwrvuUstmIcKaAJ2bPvRt
|
||||
vhRRY3u7ywKBgDIjPOADTq2Ym48qxyb/UiNuq1RR9UrOXnT0VdqEw+oLeIubLqAP
|
||||
C9CLjutUqRxG4bllgRxORUTGiTy/YnTq5yKKlbTr+dFwqVPtcIrwKXu2/R4VR2yU
|
||||
7pQK88naAA94fJYGbbwpNLd2ztzzJM/w5OHqWQ4JkjKndIH5Rpl3ZajFAoGABWqa
|
||||
y2CDNE/bTdUJfcZv2d74mqGHOK+zo4KKn3YH9LzDqsi/GpeFecgTWnsCOHQtiUkr
|
||||
MJBC3WPDEz8SX5nwy1QH0dqF2RB789h/PYrAWfahldKVihveb9cB7GGGYxxJ7HRv
|
||||
fVSnnVibgAQwacLR5M7f16ZOjncWpNsexbFG+xMCgYEAj1V64k9Lz554EDCNZMQS
|
||||
mzgqYg6ck+GYL/W6hdE/N3zc+KJKF4ztM/c987BbFgpJQp+uYF43jRmOcv1Oab43
|
||||
mpuvZ2rDSPqrqM+fdHIx2oLPNBdBc9abTX7sQtK4WSTp16gs+MqfMWRklxWsMwWE
|
||||
fO6SmAU27aAzfOccuvx3glQ=
|
||||
-----END PRIVATE KEY-----
|
||||
```
|
||||
|
||||
This is `crt-list.cfg`
|
||||
```cfg
|
||||
/usr/local/etc/haproxy/ssl/cert.pem *.[YOUR DOMAIN]
|
||||
```
|
||||
|
||||
This is `whitelist.cfg`
|
||||
```cfg
|
||||
#[IP6_PREFIX]::/MASK
|
||||
```
|
||||
Loading…
Reference in New Issue
Block a user