80 lines
3.3 KiB
Plaintext
80 lines
3.3 KiB
Plaintext
|
{%- if server %}
|
||
|
|
global
|
||
|
|
log /dev/log local0
|
||
|
|
log /dev/log local1 notice
|
||
|
|
chroot /var/lib/haproxy
|
||
|
|
stats socket /run/haproxy/admin.sock mode 660 level admin
|
||
|
|
stats timeout 30s
|
||
|
|
user {{taskserv.run_user}}
|
||
|
|
group {{taskserv.run_group}}
|
||
|
|
daemon
|
||
|
|
|
||
|
|
# Default SSL material locations
|
||
|
|
ca-base /etc/ssl/certs
|
||
|
|
crt-base /etc/ssl/private
|
||
|
|
|
||
|
|
# See: https://ssl-config.mozilla.org/#server=haproxy&server-version=2.0.3&config=intermediate
|
||
|
|
ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
|
||
|
|
ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
|
||
|
|
ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets
|
||
|
|
|
||
|
|
defaults
|
||
|
|
log global
|
||
|
|
mode http
|
||
|
|
option httplog
|
||
|
|
option dontlognull
|
||
|
|
timeout connect 5000
|
||
|
|
timeout client 50000
|
||
|
|
timeout server 50000
|
||
|
|
errorfile 400 /etc/haproxy/errors/400.http
|
||
|
|
errorfile 403 /etc/haproxy/errors/403.http
|
||
|
|
errorfile 408 /etc/haproxy/errors/408.http
|
||
|
|
errorfile 500 /etc/haproxy/errors/500.http
|
||
|
|
errorfile 502 /etc/haproxy/errors/502.http
|
||
|
|
errorfile 503 /etc/haproxy/errors/503.http
|
||
|
|
errorfile 504 /etc/haproxy/errors/504.http
|
||
|
|
|
||
|
|
frontend https-in
|
||
|
|
{%- for bind in taskserv.https_in_binds %}
|
||
|
|
{%- if bind.ip == "$network_private_ip" %}
|
||
|
|
bind {{server.network_private_ip}}:{{bind.port}}
|
||
|
|
{%- elif bind.ip == "$network_public_ip" and settings[server_pos] and settings[server_pos].ip_addresses.pub %}
|
||
|
|
bind {{settings[server_pos].ip_addresses.pub}}:{{bind.port}}
|
||
|
|
{%- elif bind.ip == "$network_internal_ip" and settings[server_pos] and settings[server_pos].ip_addresses.int %}
|
||
|
|
bind {{settings[server_pos].ip_addresses.int}}:{{bind.port}}
|
||
|
|
{%- elif bind.ip != "$network_internal_ip" %}
|
||
|
|
bind {{bind.ip}}:{{bind.port}}
|
||
|
|
{%- endif %}
|
||
|
|
{%- endfor %}
|
||
|
|
mode tcp
|
||
|
|
{%- for option in taskserv.https_options %}
|
||
|
|
option {{option}}
|
||
|
|
{%- endfor %}
|
||
|
|
#option tcplog
|
||
|
|
#option dontlognull
|
||
|
|
#log-format "%H %ci:%cp [%t] %ft %b/%s %Tw/%Tc/%Tt %B %ts %ac/%fc/%bc/%sc/%rc %sq/%bq"
|
||
|
|
log-format "{{taskserv.https_log_format}}"
|
||
|
|
tcp-request inspect-delay 5s
|
||
|
|
tcp-request content accept if { req_ssl_hello_type 1 }
|
||
|
|
{%- for backend in taskserv.backends %}
|
||
|
|
use_backend {{backend.name}} if { req_ssl_sni -i {{backend.ssl_sni}} }
|
||
|
|
{%- endfor %}
|
||
|
|
|
||
|
|
{%- for backend in taskserv.backends %}
|
||
|
|
backend {{backend.name}}
|
||
|
|
mode {{backend.mode}}
|
||
|
|
balance {{backend.balance}}
|
||
|
|
option {{backend.option}}
|
||
|
|
{% if backend.server_host_ip == "$network_private_ip" -%}
|
||
|
|
server {{backend.server_name}} {{server.network_private_ip}}:{{backend.server_port}} {{backend.server_ops}}
|
||
|
|
{%- elif backend.server_host_ip == "$network_public_ip" and settings[server_pos] and settings[server_pos].ip_addresses.pub -%}
|
||
|
|
server {{backend.server_name}} {{settings[server_pos].ip_addresses.pub}}:{{backend.server_port}} {{backend.server_ops}}
|
||
|
|
{%- elif backend.server_host_ip == "$network_internal_ip" and settings[server_pos] and settings[server_pos].ip_addresses.int -%}
|
||
|
|
server {{backend.server_name}} {{settings[server_pos].ip_addresses.int}}:{{backend.server_port}} {{backend.server_ops}}
|
||
|
|
{%- else -%}
|
||
|
|
server {{backend.server_name}} {{backend.server_host_ip}}:{{backend.server_port}} {{backend.server_ops}}
|
||
|
|
{%- endif %}
|
||
|
|
{%- endfor %}
|
||
|
|
|
||
|
|
{%- endif %}
|