158 lines
5.4 KiB
INI
158 lines
5.4 KiB
INI
frontend external
|
|
acl example_com_domains hdr(host) -i example.com
|
|
acl foo_bar_domains hdr(host) -i foo-bar.com foo-bar.org
|
|
[…]
|
|
use_backend example_com if example_com_domains
|
|
use_backend foo_bar if foo_bar_domains
|
|
----
|
|
backend varnish
|
|
option httpchk HEAD /varnishcheck
|
|
server varnish_sock /run/varnish.sock check observe layer7 maxconn 3000 inter 1s send-proxy-v2
|
|
----
|
|
frontend external
|
|
# Is the request routable to Varnish ?
|
|
acl varnish_available nbsrv(varnish) gt 0
|
|
|
|
# Use Varnish if available
|
|
use_backend varnish if varnish_available
|
|
|
|
# … or use normal backend
|
|
use_backend default_backend
|
|
|
|
backend varnish
|
|
option httpchk HEAD /varnishcheck
|
|
server varnish_sock /run/varnish.sock check observe layer7 maxconn 3000 inter 1s send-proxy-v2
|
|
|
|
backend default_backend
|
|
server example-hostname 1.2.3.4:443 check observe layer4 ssl
|
|
----
|
|
frontend external
|
|
acl example_com_domains hdr(host) -i example.com
|
|
[…]
|
|
use_backend varnish if example_com_domains
|
|
----
|
|
frontend external
|
|
acl use_cache if hdr(host) -f /etc/haproxy/cached_domains
|
|
[…]
|
|
use_backend varnish if use_cache
|
|
----
|
|
frontend external
|
|
acl varnish_http_verb method GET HEAD PURGE
|
|
[…]
|
|
use_backend varnish if varnish_http_verb
|
|
----
|
|
backend varnish
|
|
server varnish_sock /run/varnish.sock check observe layer7 maxconn 3000 inter 1s send-proxy-v2
|
|
|
|
frontend internal
|
|
bind /run/haproxy-frontend-default.sock user root mode 666 accept-proxy
|
|
|
|
backend example_com
|
|
server example-hostname 1.2.3.4:443 check observe layer4 ssl verify none send-proxy-v2
|
|
----
|
|
frontend external
|
|
bind 0.0.0.0:80,:::80
|
|
bind 0.0.0.0:443,:::443 ssl […]
|
|
|
|
option forwardfor
|
|
|
|
http-request set-header X-Forwarded-Port %[dst_port]
|
|
|
|
http-request set-header X-Forwarded-Proto http if !{ ssl_fc }
|
|
http-request set-header X-Forwarded-Proto https if { ssl_fc }
|
|
----
|
|
frontend external
|
|
[…]
|
|
http-request set-header X-Unique-ID %[uuid()] unless { hdr(X-Unique-ID) -m found }
|
|
----
|
|
frontend external
|
|
[…]
|
|
http-request add-header X-Boost-Step1 haproxy-external
|
|
|
|
http-response add-header X-Boost-Step1 "haproxy-external; client-https" if { ssl_fc }
|
|
http-response add-header X-Boost-Step1 "haproxy-external; client-http" if !{ ssl_fc }
|
|
http-response set-header X-Boost-Server my-hostname
|
|
----
|
|
frontend internal
|
|
[…]
|
|
http-request add-header X-Boost-Step3 haproxy-internal
|
|
|
|
http-response add-header X-Boost-Step3 "haproxy-internal; SSL to backend" if { ssl_bc }
|
|
http-response add-header X-Boost-Step3 "haproxy-internal; no SSL to backend" if !{ ssl_bc }
|
|
----
|
|
backend example_com
|
|
[…]
|
|
http-response set-header X-Boost-Proto https if { ssl_bc }
|
|
http-response set-header X-Boost-Proto http if !{ ssl_bc }
|
|
server example-hostname 1.2.3.4:443 check observe layer4 ssl verify none
|
|
----
|
|
frontend external
|
|
http-response add-header X-Haproxy-Log-external "%ci:%cp [%tr] %ft %b/%s %TR/%Tw/%Tc/%Tr/%Ta %ST %B %CC %CS %tsc %ac/%fc/%bc/%sc/%rc %sq/%bq %hr %hs %{+Q}r"
|
|
|
|
frontend internal
|
|
http-response add-header X-Haproxy-Log-Internal "%ci:%cp [%tr] %ft %b/%s %TR/%Tw/%Tc/%Tr/%Ta %ST %B %CC %CS %tsc %ac/%fc/%bc/%sc/%rc %sq/%bq %hr %hs %{+Q}r"
|
|
----
|
|
frontend external
|
|
[…]
|
|
# Reject the request at the TCP level if source is in the denylist
|
|
tcp-request connection reject if { src -f /etc/haproxy/deny_ips }
|
|
----
|
|
frontend external
|
|
[…]
|
|
# List of IP that will not go the maintenance backend
|
|
acl maintenance_ips src -f /etc/haproxy/maintenance_ips
|
|
# Go to maintenance backend, unless your IP is whitelisted
|
|
use_backend maintenance if !maintenance_ips
|
|
|
|
backend maintenance
|
|
http-request set-log-level silent
|
|
# Custom 503 error page
|
|
errorfile 503 /etc/haproxy/errors/maintenance.http
|
|
# With no server defined, a 503 is returned for every request
|
|
----
|
|
frontend external
|
|
[…]
|
|
# Is the request coming for the server itself (stats…)
|
|
acl self hdr(host) -i my-hostname my-hostname.domain.tld
|
|
acl munin hdr(host) -i munin
|
|
|
|
# Detect Let's Encrypt challenge requests
|
|
acl letsencrypt path_dir -i /.well-known/acme-challenge
|
|
|
|
use_backend local if self
|
|
use_backend local if munin
|
|
|
|
use_backend letsencrypt if letsencrypt
|
|
|
|
backend letsencrypt
|
|
# Use this if the challenge is managed locally
|
|
server localhost 127.0.0.1:81 send-proxy-v2 maxconn 10
|
|
# Use this if the challenge is managed remotely
|
|
### server my-certbot-challenge-manager 192.168.2.1:80 maxconn 10
|
|
|
|
backend local
|
|
option httpchk HEAD /haproxy-check
|
|
server localhost 127.0.0.1:81 send-proxy-v2 maxconn 10
|
|
----
|
|
frontend external
|
|
[…]
|
|
# List of IP that will not go the maintenance backend
|
|
acl maintenance_ips src -f /etc/haproxy/maintenance_ips
|
|
# Go to maintenance backend, unless your IP is whitelisted
|
|
use_backend maintenance if !maintenance_ips
|
|
|
|
backend maintenance
|
|
http-request set-log-level silent
|
|
# Custom 503 error page
|
|
errorfile 503 /etc/haproxy/errors/maintenance.http
|
|
# With no server defined, a 503 is returned for every request
|
|
----
|
|
frontend external
|
|
[…]
|
|
acl example_com_domains hdr(host) -i example.com
|
|
|
|
acl maintenance_ips src -f /etc/haproxy/maintenance_ips
|
|
acl example_com_maintenance_ips src -f /etc/haproxy/example_com/maintenance_ips
|
|
|
|
use_backend example_com_maintenance if example_com_domains !example_com_maintenance_ips !maintenance_ips
|
|
---- |