-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathhaproxy.template
114 lines (100 loc) · 4.26 KB
/
haproxy.template
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
global
log /dev/log local0
log /dev/log local1 notice
log-send-hostname
maxconn 200000
user {{{settings.haproxy.user}}}
group {{{settings.haproxy.group}}}
stats socket /tmp/haproxy.sock mode 660 level admin
{{#if ssl}}
tune.ssl.default-dh-param 2048
ssl-default-bind-ciphers ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
ssl-default-bind-options no-sslv3 no-tls-tickets
ssl-default-server-ciphers ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
ssl-default-server-options no-sslv3 no-tls-tickets
{{/if}}
defaults
maxconn 200000
log global
mode http
option httplog
option dontlognull
option forwardfor
option contstats
stats enable
stats auth {{{settings.stats.user}}}:{{{settings.stats.pass}}}
stats uri {{{settings.stats.path}}}
timeout connect 10000ms
timeout client 50000ms
timeout server 50000ms
timeout check 5s
retries 3
frontend http
bind *:80
# If real errors then show mainentance page
errorfile 503 {{{settings.maintenance_page}}}
http-request set-header X-Forwarded-Proto http
default_backend web_maintenance
# ACLs for hostnames
{{#each loadbalancers}}
acl {{{name}}}_acl hdr(host) -i {{{hostname}}}
{{#if network}}
# Network whitelist
acl {{{name}}}_whitelist_acl src {{{network}}}
{{/if}}
{{/each}}
# Backends
{{#each loadbalancers}}
{{#if network}}
# Network whitelisted backend for {{name}}
use_backend {{{name}}}-backend if {{{name}}}_acl {{{name}}}_whitelist_acl
{{else}}
# Normal backend for {{name}}
use_backend {{{name}}}-backend if {{{name}}}_acl
{{/if}}
{{/each}}
{{#if ssl}}
frontend https
bind *:443 ssl no-sslv3 no-tlsv10 crt {{{settings.cert_path}}}
# If real errors then show mainentance page
errorfile 503 {{{settings.maintenance_page}}}
http-request set-header X-Forwarded-Proto https
default_backend web_maintenance
# ACLs for hostnames
{{#each loadbalancers}}
acl {{{name}}}_acl hdr(host) -i {{{hostname}}}
{{#if network}}
# Network whitelist
acl {{{name}}}_whitelist_acl src {{{network}}}
{{/if}}
{{/each}}
# Backends
{{#each loadbalancers}}
{{#if network}}
# Network whitelisted backend for {{name}}
use_backend {{{name}}}-backend if {{{name}}}_acl {{{name}}}_whitelist_acl
{{else}}
# Normal backend for {{name}}
use_backend {{{name}}}-backend if {{{name}}}_acl
{{/if}}
{{/each}}
{{/if}}
{{#each loadbalancers}}
# ===================================================
# LB {{{loadbalancer_id}}}
# SERVICE {{{service_id}}}
# ===================================================
backend {{{name}}}-backend
balance roundrobin
option forwardfor
{{#if force_https}}
redirect scheme https if !{ ssl_fc }
{{/if}}
# Servers
{{#each backends}}
server {{{instance_id}}} {{{address}}}:{{{port}}} check
{{/each}}
{{/each}}
backend web_maintenance
mode http
errorfile 503 {{settings.maintenance_page}}