113 lines
3.8 KiB
INI
Executable File
113 lines
3.8 KiB
INI
Executable File
global
|
|
log stdout format raw local0 info
|
|
maxconn 8192
|
|
|
|
defaults
|
|
log global
|
|
mode http
|
|
option httplog
|
|
option dontlognull
|
|
option forwardfor
|
|
option redispatch
|
|
retries 3
|
|
timeout connect 5000
|
|
timeout client 50000
|
|
timeout server 50000
|
|
|
|
userlist users
|
|
user alex password $6$kW4zFajpkGGupxHU$KgzNS59z9OvJwAMvFg.EtU/hlgXWbGANoazzedpYRExZE9tJzw8kQlivIDUtvLgcsHYrFTpldRzeTaekBFtIW0
|
|
# TODO: worker currently shares alex's hash - generate a distinct one:
|
|
# mkpasswd -m sha-512
|
|
user worker password $6$kW4zFajpkGGupxHU$KgzNS59z9OvJwAMvFg.EtU/hlgXWbGANoazzedpYRExZE9tJzw8kQlivIDUtvLgcsHYrFTpldRzeTaekBFtIW0
|
|
|
|
frontend https
|
|
bind *:80
|
|
bind *:443 ssl crt /usr/local/etc/haproxy/mrhossa.pem alpn h2,http/1.1 ssl-min-ver TLSv1.2
|
|
|
|
# Force HTTPS
|
|
http-request redirect scheme https code 301 unless { ssl_fc }
|
|
|
|
http-request set-header X-Forwarded-Proto https if { ssl_fc }
|
|
|
|
# Security headers
|
|
http-response set-header Strict-Transport-Security "max-age=31536000; includeSubDomains"
|
|
http-response set-header X-Content-Type-Options "nosniff"
|
|
http-response set-header X-Frame-Options "SAMEORIGIN"
|
|
|
|
acl valid_method method PUT DELETE GET POST HEAD PATCH
|
|
http-request deny if !valid_method
|
|
|
|
acl is_trusted src 178.19.224.210 80.153.174.251 153.92.79.159 152.53.159.169 159.195.49.220 152.53.162.220
|
|
|
|
stick-table type ip size 100k expire 30s store http_req_rate(60s)
|
|
|
|
http-request track-sc0 src
|
|
acl rate_too_high sc0_http_req_rate gt 240
|
|
http-request deny status 429 if rate_too_high !is_trusted
|
|
|
|
acl is_public hdr(host) -i mrhossa.de
|
|
acl is_backend hdr(host) -i backend.mrhossa.de
|
|
acl is_gitea hdr(host) -i gitea.mrhossa.de
|
|
acl is_stats hdr(host) -i stats.mrhossa.de
|
|
acl is_jenkins hdr(host) -i jenkins.mrhossa.de
|
|
acl is_flatnotes hdr(host) -i flatnotes.mrhossa.de
|
|
acl is_portainer hdr(host) -i portainer.mrhossa.de
|
|
acl is_homarr hdr(host) -i homarr.mrhossa.de
|
|
acl is_vaultwarden hdr(host) -i vaultwarden.mrhossa.de
|
|
acl is_grafana hdr(host) -i grafana.mrhossa.de
|
|
|
|
http-request deny if is_jenkins !is_trusted
|
|
http-request deny if is_portainer !is_trusted
|
|
http-request deny if is_homarr !is_trusted
|
|
http-request deny if is_grafana !is_trusted
|
|
|
|
use_backend web_public if is_public
|
|
use_backend web_backend if is_backend
|
|
use_backend web_gitea if is_gitea
|
|
use_backend web_jenkins if is_jenkins
|
|
use_backend web_flatnotes if is_flatnotes
|
|
use_backend web_vaultwarden if is_vaultwarden
|
|
use_backend web_portainer if is_portainer
|
|
use_backend web_homarr if is_homarr
|
|
use_backend web_grafana if is_grafana
|
|
use_backend stats if is_stats
|
|
|
|
default_backend web_public
|
|
|
|
backend web_public
|
|
cookie SESSSRV insert preserve nocache httponly secure
|
|
server node1 152.53.159.169:8001 cookie node1 check
|
|
|
|
backend web_backend
|
|
cookie SESSSRV insert preserve nocache httponly secure
|
|
server node1 152.53.159.169:8002 cookie node1 check
|
|
|
|
backend web_gitea
|
|
server gitea 152.53.159.169:3000 check
|
|
|
|
backend web_jenkins
|
|
server jenkins 152.53.159.169:8080 check
|
|
|
|
backend web_flatnotes
|
|
server flatnotes 152.53.159.169:8003 check
|
|
|
|
backend web_vaultwarden
|
|
server vaultwarden 152.53.159.169:8004 check
|
|
|
|
backend web_portainer
|
|
server portainer 152.53.159.169:8005 check
|
|
|
|
backend web_homarr
|
|
server homarr 152.53.159.169:8006 check
|
|
|
|
backend web_grafana
|
|
server grafana 152.53.159.169:8007 check
|
|
|
|
backend stats
|
|
stats enable
|
|
stats uri /
|
|
stats realm Haproxy\ Statistics
|
|
stats auth worker:souIfurULCSDnoKuPNxrLCTi
|
|
acl is_trusted src 178.19.224.210
|
|
stats admin if TRUE is_trusted
|