|
|
@@ -0,0 +1,152 @@
|
|
|
+# This file managed by hand
|
|
|
+global
|
|
|
+ chroot /var/lib/haproxy
|
|
|
+ daemon
|
|
|
+ group haproxy
|
|
|
+ log /dev/log len 2048 local1 info
|
|
|
+ maxconn 4096
|
|
|
+ pidfile /var/run/haproxy.pid
|
|
|
+ ssl-default-bind-ciphers HIGH+ECDHE:DHE+AES:!DSS:@STRENGTH
|
|
|
+ ssl-default-bind-options ssl-min-ver TLSv1.0
|
|
|
+ ssl-default-server-ciphers HIGH+ECDHE:DHE+AES:!DSS:@STRENGTH
|
|
|
+ ssl-default-server-options ssl-min-ver TLSv1.2
|
|
|
+ ssl-dh-param-file /etc/haproxy/ssl-dh-param-2048.pem
|
|
|
+ stats socket /var/lib/haproxy/admin.sock mode 660 level admin
|
|
|
+ stats socket /var/lib/haproxy/user.sock mode 666 level user
|
|
|
+ stats timeout 30s
|
|
|
+ tune.ssl.default-dh-param 2048
|
|
|
+ user haproxy
|
|
|
+
|
|
|
+defaults
|
|
|
+ fullconn 409
|
|
|
+ log global
|
|
|
+ maxconn 4096
|
|
|
+ mode http
|
|
|
+ option redispatch
|
|
|
+ option abortonclose
|
|
|
+ option dontlognull
|
|
|
+ option httplog
|
|
|
+ option http-server-close
|
|
|
+ option forwardfor except 127.0.0.1
|
|
|
+ option logasap
|
|
|
+ retries 3
|
|
|
+ timeout http-request 10s
|
|
|
+ timeout queue 1m
|
|
|
+ timeout connect 5s
|
|
|
+ timeout client 1m
|
|
|
+ timeout server 1m
|
|
|
+
|
|
|
+frontend ft_http_in
|
|
|
+ bind 0.0.0.0:6000
|
|
|
+ mode http
|
|
|
+ acl domain_validation path,url_dec -m beg -i /.well-known
|
|
|
+ capture request header X-Forwarded-For len 50
|
|
|
+ capture request header Host len 40
|
|
|
+ capture request header User-Agent len 200
|
|
|
+ log-format %ci:%cp\ [%t]\ %ft\ %b/%s\ %Tq/%Tw/%Tc/%Tr/%Tt\ %ST\ %B\ %CC\ %CS\ %tsc\ %ac/%fc/%bc/%sc/%rc\ %sq/%bq\ %hr\ %hs\ {%[ssl_fc_sni]}\ {%sslc|%sslv|%[ssl_fc_is_resumed]|%[ssl_fc_alpn]|%[fc_http_major]}\ \"%[capture.req.method]\ %[capture.req.uri]\ %[capture.req.ver]\"
|
|
|
+ use_backend be_domain_validation if domain_validation
|
|
|
+ use_backend %[req.hdr(host),lower,map_dom(/etc/haproxy/http-domains-to-backends.map,be_redirect_https)]
|
|
|
+
|
|
|
+frontend ft_https_in
|
|
|
+ bind 0.0.0.0:7000 ssl crt /etc/letsencrypt/live/www.sahajayoga.at/bundle.pem crt /etc/ssl/certs/bundles/ alpn h2,http/1.1
|
|
|
+ mode http
|
|
|
+ acl domain_validation path,url_dec -m beg -i /.well-known
|
|
|
+ capture request header X-Forwarded-For len 50
|
|
|
+ capture request header Host len 40
|
|
|
+ capture request header User-Agent len 200
|
|
|
+ http-request set-header X-Forwarded-Port 443
|
|
|
+ http-request set-header X_FORWARDED_PROTO https
|
|
|
+ http-request set-header X-Forwarded-Proto https
|
|
|
+ http-request set-header X-Scheme https
|
|
|
+ http-response add-header Strict-Transport-Security max-age=31536000 if { res.hdr_cnt('Strict-Transport-Security') le 0 }
|
|
|
+ http-response add-header X-Frame-Options SAMEORIGIN if { res.hdr_cnt('X-Frame-Options') le 0 }
|
|
|
+ http-response del-header Server
|
|
|
+ http-response del-header X-Powered-By
|
|
|
+ http-response replace-header Set-Cookie ^((?:(?!\ [Ss]ecure).)*)$ \1;\ Secure
|
|
|
+ log-format %ci:%cp\ [%t]\ %ft\ %b/%s\ %Tq/%Tw/%Tc/%Tr/%Tt\ %ST\ %B\ %CC\ %CS\ %tsc\ %ac/%fc/%bc/%sc/%rc\ %sq/%bq\ %hr\ %hs\ {%[ssl_fc_sni]}\ {%sslc|%sslv|%[ssl_fc_is_resumed]|%[ssl_fc_alpn]|%[fc_http_major]}\ \"%[capture.req.method]\ %[capture.req.uri]\ %[capture.req.ver]\"
|
|
|
+ use_backend be_domain_validation if domain_validation
|
|
|
+ use_backend %[req.hdr(host),lower,map_dom(/etc/haproxy/domains-to-backends.map)]
|
|
|
+
|
|
|
+# Backends
|
|
|
+backend be_mail01
|
|
|
+ option httpchk GET / HTTP/1.1\r\nHost:\ localhost\r\nUser-Agent:\ HAProxy
|
|
|
+ server web01 192.168.122.20:80 check inter 5000
|
|
|
+
|
|
|
+backend be_web01
|
|
|
+ option httpchk GET / HTTP/1.1\r\nHost:\ localhost\r\nUser-Agent:\ HAProxy
|
|
|
+ server web01 192.168.122.10:80 check inter 5000
|
|
|
+
|
|
|
+backend be_vhost01
|
|
|
+ option httpchk GET / HTTP/1.1\r\nHost:\ localhost\r\nUser-Agent:\ HAProxy
|
|
|
+ server vhost01 144.76.238.57:80 check inter 10000
|
|
|
+
|
|
|
+# wlan ctl
|
|
|
+backend be_web02_8080
|
|
|
+ option httpchk GET / HTTP/1.1\r\nHost:\ localhost\r\nUser-Agent:\ HAProxy
|
|
|
+ server web02 192.168.122.19:8080 check inter 5000
|
|
|
+
|
|
|
+backend be_web02_8443
|
|
|
+ option httpchk GET / HTTP/1.1\r\nHost:\ localhost\r\nUser-Agent:\ HAProxy
|
|
|
+ server web02 192.168.122.19:8443 check inter 5000 weight 0 ssl verify none
|
|
|
+
|
|
|
+# captive portal
|
|
|
+backend be_web02_8880
|
|
|
+ acl allowed_url path,url_dec -m beg -i /guest/s/
|
|
|
+ http-request deny if !allowed_url
|
|
|
+ option httpchk GET /guest/s/default/ HTTP/1.1\r\nHost:\ localhost\r\nUser-Agent:\ HAProxy
|
|
|
+ server web02 192.168.122.19:8880 check inter 5000
|
|
|
+#server localhost localhost:9002 check
|
|
|
+#http://192.168.122.19:8880/guest/s/mwandnqf/
|
|
|
+
|
|
|
+backend be_web02_8843
|
|
|
+ option httpchk GET / HTTP/1.1\r\nHost:\ localhost\r\nUser-Agent:\ HAProxy
|
|
|
+ server web02 192.168.122.19:8843 check inter 5000
|
|
|
+
|
|
|
+# Domain Validation for lets encrypt
|
|
|
+backend be_domain_validation
|
|
|
+ server localhost localhost:9001 check
|
|
|
+
|
|
|
+backend be_parked_domains
|
|
|
+ server localhost localhost:9002 check
|
|
|
+
|
|
|
+# Redirects
|
|
|
+backend be_redirect_http
|
|
|
+ redirect scheme http code 301
|
|
|
+
|
|
|
+backend be_redirect_https
|
|
|
+ redirect scheme https code 301 if !{ ssl_fc }
|
|
|
+
|
|
|
+backend be_sahajayoga.at_redirect
|
|
|
+ http-request redirect prefix https://www.sahajayoga.at/ code 301
|
|
|
+
|
|
|
+backend be_sahajayoga.org_redirect_302
|
|
|
+ http-request redirect prefix http://www.sahajayoga.org/ code 302
|
|
|
+
|
|
|
+# backend be_ringring.net
|
|
|
+# acl allowed_hosts_eml src 212.126.215.62 84.112.230.10
|
|
|
+# acl allowed_hosts_user src 80.109.127.112
|
|
|
+# acl allowed_hosts_kath src 80.109.127.112 85.13.177.171 85.13.149.12 80.108.36.11
|
|
|
+# acl allowed_hosts_fax src 10.1.32.63 10.1.32.64
|
|
|
+# acl restricted_services_eml path,url_dec -m beg -i /EML-Speech2Text-Transfer
|
|
|
+# acl restricted_services_user path,url_dec -m beg -i /user_timer.php
|
|
|
+# acl restricted_services_kath path,url_dec -m beg -i /kath
|
|
|
+# acl restricted_services path,url_dec -m beg -i /errors
|
|
|
+# acl restricted_services path,url_dec -m beg -i /fax
|
|
|
+# cookie VOIP insert secure
|
|
|
+# http-request deny if restricted_services_eml !allowed_hosts_eml
|
|
|
+# http-request deny if restricted_services_user !allowed_hosts_user
|
|
|
+# http-request deny if restricted_services_kath !allowed_hosts_kath
|
|
|
+# http-request deny if restricted_services !allowed_hosts_fax
|
|
|
+# option httpchk GET /home.php HTTP/1.1\r\nHost:\ www.ringring.net\r\nUser-Agent:\ HAProxy
|
|
|
+# server voipweb01 voipweb01.app01.prod.rz01.riseops.at:80 cookie voipweb01 check inter 5000
|
|
|
+# server voipweb02 voipweb02.app01.prod.rz01.riseops.at:80 cookie voipweb02 backup check inter 5000
|
|
|
+# server errorpage rhs-prxa-prod.dmz01.prod.rz01.riseops.at:9002 backup
|
|
|
+
|
|
|
+listen stats
|
|
|
+ bind 0.0.0.0:8000
|
|
|
+ stats enable
|
|
|
+ stats hide-version
|
|
|
+ stats realm Haproxy\ Statistics
|
|
|
+ stats uri /
|
|
|
+ stats auth stats:quiekovie0zei9gaTiuNe8engiquohCi
|
|
|
+ stats admin if TRUE
|
