79 lines
2.5 KiB
INI
79 lines
2.5 KiB
INI
global
|
|
log stdout format raw local0 info
|
|
maxconn 8192
|
|
|
|
defaults
|
|
log global
|
|
mode http
|
|
option httplog
|
|
option dontlognull
|
|
option forwardfor
|
|
option redispatch
|
|
retries 3
|
|
timeout connect 5000
|
|
timeout client 50000
|
|
timeout server 50000
|
|
|
|
frontend https
|
|
bind *:80
|
|
bind *:443 ssl crt /usr/local/etc/haproxy/mshossa.pem alpn h2,http/1.1 ssl-min-ver TLSv1.2
|
|
|
|
# Force HTTPS
|
|
http-request redirect scheme https code 301 unless { ssl_fc }
|
|
|
|
http-request set-header X-Forwarded-Proto https if { ssl_fc }
|
|
|
|
# Security headers
|
|
http-response set-header Strict-Transport-Security "max-age=31536000; includeSubDomains"
|
|
http-response set-header X-Content-Type-Options "nosniff"
|
|
http-response set-header X-Frame-Options "SAMEORIGIN"
|
|
|
|
acl valid_method method PUT DELETE GET POST HEAD PATCH
|
|
http-request deny if !valid_method
|
|
|
|
# ACLs zuerst deklarieren
|
|
acl is_trusted src 178.19.224.210 152.53.159.169
|
|
acl is_public hdr(host) -i mshossa.de
|
|
acl is_stats hdr(host) -i stats.mshossa.de
|
|
acl is_seafile hdr(host) -i ftp.mshossa.de
|
|
acl is_gitea hdr(host) -i gitea.mshossa.de
|
|
acl is_seafile_login path_beg /accounts/login /api2/auth-token
|
|
|
|
stick-table type ip size 100k expire 60s store http_req_rate(60s)
|
|
|
|
# Allgemeines Limit (nicht für Seafile, dort erzeugen Sync-Clients viele Requests)
|
|
http-request track-sc0 src
|
|
acl rate_too_high sc0_http_req_rate gt 240
|
|
http-request deny deny_status 429 if rate_too_high !is_trusted !is_seafile
|
|
|
|
# Strengeres Limit nur für Seafile-Logins
|
|
http-request track-sc1 src table st_seafile_login if is_seafile is_seafile_login
|
|
acl login_rate_too_high sc1_http_req_rate gt 10
|
|
http-request deny deny_status 429 if is_seafile is_seafile_login login_rate_too_high !is_trusted
|
|
|
|
use_backend stats if is_stats
|
|
use_backend seafile if is_seafile
|
|
use_backend web_gitea if is_gitea
|
|
|
|
default_backend seafile
|
|
|
|
backend st_seafile_login
|
|
stick-table type ip size 100k expire 5m store http_req_rate(1m)
|
|
|
|
backend seafile
|
|
timeout server 300s
|
|
server seafile 172.30.0.12:80 check
|
|
|
|
backend web_gitea
|
|
server gitea 172.30.0.13:3000 check
|
|
|
|
backend stats
|
|
stats enable
|
|
stats uri /
|
|
stats realm Haproxy\ Statistics
|
|
stats auth worker:bBHofurUJWKzPE8Z
|
|
acl is_trusted src 178.19.224.210
|
|
stats admin if TRUE is_trusted
|
|
|
|
# backend web_public: hier muss dein bestehendes Backend stehen
|