56 lines
1.5 KiB
YAML
56 lines
1.5 KiB
YAML
# Vault connection
|
|
vault_addr: "http://VAULT_IP:VAULT_PORT"
|
|
|
|
# Directory paths
|
|
haproxy_certs_dir: "/etc/haproxy/certs"
|
|
haproxy_cert_path: "{{ haproxy_pem_path }}"
|
|
haproxy_pem_path: "{{ haproxy_certs_dir }}/haproxy.pem"
|
|
haproxy_ca_path: "{{ haproxy_certs_dir }}/haproxy_ca.crt"
|
|
|
|
# Systemd service names
|
|
haproxy_service: "haproxy"
|
|
|
|
# HAProxy tuning
|
|
haproxy_global_maxconn: 4096
|
|
haproxy_timeout_connect_ms: 5000
|
|
haproxy_timeout_client_ms: 60000
|
|
haproxy_timeout_server_ms: 60000
|
|
haproxy_enable_hsts: true
|
|
|
|
vault_agent_templates:
|
|
- src: "haproxy.pem.ctmpl"
|
|
dest: "{{ haproxy_pem_path }}"
|
|
service: "haproxy"
|
|
- src: "haproxy_ca.ctmpl"
|
|
dest: "{{ haproxy_ca_path }}"
|
|
service: "haproxy"
|
|
|
|
# === Services routed internally through HAProxy ===
|
|
securemtls_services:
|
|
vault:
|
|
hostname: vault.local.DOMAIN_PLACEHOLDER
|
|
balance: roundrobin
|
|
mode: http
|
|
timeout_connect: 5s
|
|
timeout_server: 30s
|
|
default_server_inter: 3s
|
|
default_server_rise: 2
|
|
default_server_fall: 3
|
|
backend_servers:
|
|
- address: VAULT_IP
|
|
port: VAULT_PORT
|
|
proto: http
|
|
headers:
|
|
- "http-request set-header Host vault.local.DOMAIN_PLACEHOLDER"
|
|
- "http-request set-header X-Forwarded-Proto https"
|
|
rewrites:
|
|
- "http-response replace-header Location ^http://VAULT_IP:VAULT_PORT/(.*) https://vault.local.DOMAIN_PLACEHOLDER/\\1"
|
|
|
|
technitium:
|
|
hostname: "technitium.local.DOMAIN_PLACEHOLDER"
|
|
backend_mode: http
|
|
backend_servers:
|
|
- address: TECHNITIUM_IP
|
|
port: TECHNITIUM_PORT
|
|
proto: "http"
|