87 lines
2.8 KiB
Django/Jinja
87 lines
2.8 KiB
Django/Jinja
# ==========================================
|
|
# HAProxy global settings
|
|
# ==========================================
|
|
global
|
|
log /dev/log local0
|
|
log /dev/log local1 notice
|
|
chroot /var/lib/haproxy
|
|
pidfile /run/haproxy.pid
|
|
maxconn {{ haproxy_global_maxconn | default(4096) }}
|
|
user haproxy
|
|
group haproxy
|
|
daemon
|
|
|
|
defaults
|
|
log global
|
|
option httplog
|
|
option dontlognull
|
|
timeout connect {{ haproxy_timeout_connect_ms | default('5000') }}
|
|
timeout client {{ haproxy_timeout_client_ms | default('60000') }}
|
|
timeout server {{ haproxy_timeout_server_ms | default('60000') }}
|
|
option http-server-close
|
|
option forwardfor
|
|
retries 3
|
|
maxconn 2000
|
|
|
|
# ==========================================
|
|
# HAProxy frontends and backends template
|
|
# ==========================================
|
|
|
|
frontend https-in
|
|
mode http
|
|
bind *:443 ssl crt {{ haproxy_pem_path }} ca-file {{ haproxy_ca_path }} verify required alpn h2,http/1.1
|
|
option httplog
|
|
option forwardfor
|
|
timeout client 30s
|
|
|
|
http-request set-header X-Client-Cert %[ssl_c_der,base64]
|
|
|
|
{% for service_name, service in securemtls_services.items() %}
|
|
acl host_{{ service_name }} hdr(host) -i {{ service.hostname }}
|
|
use_backend {{ service_name }} if host_{{ service_name }}
|
|
{% endfor %}
|
|
|
|
# ==========================================
|
|
# Backends
|
|
# ==========================================
|
|
{% for service_name, service in securemtls_services.items() %}
|
|
backend {{ service_name }}
|
|
balance {{ service.balance | default('roundrobin') }}
|
|
mode {{ service.mode | default('http') }}
|
|
timeout connect {{ service.timeout_connect | default('5s') }}
|
|
timeout server {{ service.timeout_server | default('30s') }}
|
|
option {{ service.options | default('http-server-close') }}
|
|
default-server inter {{ service.default_server_inter | default('3s') }}
|
|
default-server rise {{ service.default_server_rise | default('2') }}
|
|
default-server fall {{ service.default_server_fall | default('3') }}
|
|
|
|
{% for server in service.backend_servers %}
|
|
{% if server.proto == "https" %}
|
|
server {{ service_name }}-{{ loop.index }} {{ server.address }}:{{ server.port }} ssl verify none check
|
|
{% else %}
|
|
server {{ service_name }}-{{ loop.index }} {{ server.address }}:{{ server.port }} check
|
|
{% endif %}
|
|
{% endfor %}
|
|
|
|
{% if service.headers is defined %}
|
|
{% for hdr in service.headers %}
|
|
{{ hdr }}
|
|
{% endfor %}
|
|
{% endif %}
|
|
|
|
{% if service.rewrites is defined %}
|
|
{% for rewrite in service.rewrites %}
|
|
{{ rewrite }}
|
|
{% endfor %}
|
|
{% endif %}
|
|
|
|
{% endfor %}
|
|
|
|
# ==========================================
|
|
# Vault backend for HAProxy
|
|
# ==========================================
|
|
backend vault_backend
|
|
mode tcp
|
|
option ssl-hello-chk
|
|
server vault1 VAULT_IP:VAULT_PORT ssl verify required ca-file {{ haproxy_ca_path }} crt {{ haproxy_cert_path }}
|