84 lines
2.5 KiB
Django/Jinja
84 lines
2.5 KiB
Django/Jinja
global
|
|
log /dev/log local0
|
|
log /dev/log local1 notice
|
|
chroot /var/lib/haproxy
|
|
#stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
|
|
stats socket /var/lib/haproxy/stats
|
|
stats timeout 30s
|
|
user haproxy
|
|
group haproxy
|
|
daemon
|
|
|
|
# Default SSL material locations
|
|
ca-base /etc/ssl/certs
|
|
crt-base /etc/ssl/private
|
|
|
|
# See: https://ssl-config.mozilla.org/#server=haproxy&server-version=2.0.3&config=intermediate
|
|
ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
|
|
ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
|
|
ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
|
|
tune.ssl.default-dh-param 2048
|
|
tune.h2.initial-window-size 1048576
|
|
|
|
defaults
|
|
log global
|
|
mode http
|
|
option httplog
|
|
option dontlognull
|
|
timeout connect 5000
|
|
timeout client 50000
|
|
timeout server 50000
|
|
{% if ansible_os_family == 'Debian' %}
|
|
errorfile 400 /etc/haproxy/errors/400.http
|
|
errorfile 403 /etc/haproxy/errors/403.http
|
|
errorfile 408 /etc/haproxy/errors/408.http
|
|
errorfile 500 /etc/haproxy/errors/500.http
|
|
errorfile 502 /etc/haproxy/errors/502.http
|
|
errorfile 503 /etc/haproxy/errors/503.http
|
|
errorfile 504 /etc/haproxy/errors/504.http
|
|
{% endif %}
|
|
|
|
frontend ssh-in
|
|
mode tcp
|
|
bind {{ haproxy_shared_ip }}:22
|
|
timeout connect 0ms
|
|
timeout client 0ms
|
|
timeout server 0ms
|
|
use_backend example-ssh-backend
|
|
|
|
frontend http-in
|
|
mode http
|
|
bind {{ haproxy_shared_ip }}:80
|
|
|
|
use_backend example-http-backend
|
|
|
|
frontend https-in
|
|
mode tcp
|
|
tcp-request inspect-delay 1s
|
|
bind {{ haproxy_shared_ip }}:443
|
|
tcp-request content accept if { req.ssl_hello_type 1 }
|
|
|
|
use_backend example-https-backend
|
|
|
|
backend example-ssh-backend
|
|
mode tcp
|
|
timeout connect 0ms
|
|
timeout client 0ms
|
|
timeout server 0ms
|
|
server example 10.1.1.11:22 check
|
|
|
|
backend example-http-backend
|
|
mode http
|
|
log global
|
|
timeout connect 30000
|
|
timeout server 30000
|
|
retries 3
|
|
server example 10.10.2.11:80 check
|
|
|
|
backend example-https-backend
|
|
mode tcp
|
|
log global
|
|
timeout connect 30000
|
|
timeout server 30000
|
|
retries 3
|
|
server example 10.10.2.11:443 check
|