139 lines
6.9 KiB
YAML
139 lines
6.9 KiB
YAML
---
|
|
docker_swarm_cluster_haproxy_install: true
|
|
# mesh, keepalive, global
|
|
docker_swarm_haproxy_installation_type: 'global'
|
|
docker_swarm_haproxy_accept_proxy_var: "{% if docker_swarm_haproxy_installation_type == 'global' %}true{% else %}false{% endif %}"
|
|
docker_swarm_haproxy_accept_proxy: '{{ docker_swarm_haproxy_accept_proxy_var | bool }}'
|
|
# I did not find any way to make it dependant on docker_swarm_haproxy_installation_type
|
|
docker_swarm_haproxy_keepalive_installation: false
|
|
docker_swarm_haproxy_swarm_port: '{{ docker_api_port }}'
|
|
docker_swarm_haproxy_plain_http_api: true
|
|
docker_swarm_haproxy_ipv4_only: true
|
|
docker_swarm_haproxy_ipv6_only: false
|
|
#
|
|
docker_swarm_expose_api_via_haproxy: true
|
|
docker_swarm_expose_api_hostname: 'swarm.example.com'
|
|
docker_swarm_api_backend: 'dockersocket /var/run/docker.sock'
|
|
docker_swarm_api_accept_proxy: false
|
|
docker_swarm_api_check_availability: false
|
|
docker_swarm_api_networks_acl:
|
|
- '127.0.0.1/8'
|
|
docker_swarm_api_haproxy_mode: http
|
|
|
|
# Portainer
|
|
docker_swarm_cluster_portainer_install: true
|
|
docker_swarm_portainer_hostname: 'portainer-swarm.example.com'
|
|
docker_swarm_portainer_additional_constraints: []
|
|
# - 'node.hostname != docker01'
|
|
docker_swarm_portainer_nfs_volume: false
|
|
docker_swarm_portainer_nfs_type: 'nfs4'
|
|
docker_swarm_portainer_nfs_o: 'nfsvers=4,addr=127.0.0.1,rw,nolock,soft'
|
|
docker_swarm_portainer_nfs_device: ':/tmp'
|
|
# This is ugly
|
|
docker_swarm_haproxy_shinyproxy_metrics: false
|
|
|
|
docker_swarm_portainer_network: 'agent_network'
|
|
docker_swarm_portainer_http_port: '9000'
|
|
docker_swarm_portainer_service_port: '8000'
|
|
|
|
docker_swarm_keepalived_vrouter_id: 205
|
|
docker_swarm_keepalived_floating_ip: '127.0.0.1/8'
|
|
docker_swarm_keepalived_instance_name: 'VI_HAPROXY_1'
|
|
docker_swarm_haproxy_loglevel: '{{ haproxy_loglevel }}'
|
|
docker_swarm_haproxy_http2_enabled: true
|
|
docker_swarm_haproxy_backends_redirect_to_https: true
|
|
|
|
# NOTE ON PATHS. On Swarm, HAProxy runs in a container, so every path below is a
|
|
# path *inside that container*, not on the manager node. In the D4Science setup
|
|
# `haproxy_docker_mount_conf_file: true` already bind-mounts
|
|
# /etc/haproxy -> /usr/local/etc/haproxy:ro, so anything Ansible renders under
|
|
# /etc/haproxy/ on the managers is visible to HAProxy with no extra volume, and
|
|
# an in-place reload still picks it up. The defaults below assume that layout.
|
|
#
|
|
# Directory of the files served directly by HAProxy (robots.txt, user agent
|
|
# blacklists): render them into /etc/haproxy/static/ on the manager nodes.
|
|
docker_swarm_haproxy_static_dir: '/usr/local/etc/haproxy/static'
|
|
|
|
# HTTP basic authentication. Add one entry per userlist and reference it from a
|
|
# service with "basic_auth: <name>". Passwords are hashes, as produced by
|
|
# `mkpasswd -m sha-512` (do not commit them in clear text).
|
|
# docker_swarm_haproxy_userlists:
|
|
# - name: 'admins'
|
|
# users:
|
|
# - name: 'ops'
|
|
# password_hash: '$6$...'
|
|
docker_swarm_haproxy_userlists: []
|
|
docker_swarm_haproxy_basic_auth_realm: 'Restricted area'
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# CORS, via https://github.com/haproxytech/haproxy-lua-cors
|
|
# Enable globally, then opt in per service with "cors: true" or with a dict
|
|
# overriding methods/origins/headers.
|
|
# ---------------------------------------------------------------------------
|
|
# cors.lua is plain Lua with no external module dependencies, so the stock
|
|
# haproxytech/haproxy-debian image runs it as soon as the file is reachable:
|
|
# render it into /etc/haproxy/lua/ on the manager nodes.
|
|
docker_swarm_haproxy_cors_enabled: false
|
|
docker_swarm_haproxy_cors_lua_path: '/usr/local/etc/haproxy/lua/cors.lua'
|
|
docker_swarm_haproxy_cors_methods: 'GET, POST, OPTIONS, PUT, DELETE'
|
|
docker_swarm_haproxy_cors_origins: '*'
|
|
docker_swarm_haproxy_cors_headers: 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With,Accept-Language,X-CustomHeader,Content-Range,Range'
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Bot mitigation: user agent blacklist, per-source flood control and a
|
|
# browser-validation challenge. Enable globally, then opt in per service with
|
|
# "bot_mitigation: true" or with a dict overriding rate/bypass_networks/
|
|
# exempt_paths/validate_path.
|
|
#
|
|
# The counters live in a single table-holder backend shared by every service
|
|
# that opts in, so a client flooding one service is throttled everywhere. Set
|
|
# a per-service table only if you need independent counters.
|
|
# ---------------------------------------------------------------------------
|
|
docker_swarm_haproxy_bot_mitigation_enabled: false
|
|
docker_swarm_haproxy_bot_agents_blacklist_file: '/usr/local/etc/haproxy/static/agents_blacklist.txt'
|
|
docker_swarm_haproxy_bot_flood_table: 'bot_flood_st'
|
|
docker_swarm_haproxy_bot_flood_table_size: '100k'
|
|
docker_swarm_haproxy_bot_flood_table_expire: '10m'
|
|
docker_swarm_haproxy_bot_flood_rate_period: '30s'
|
|
docker_swarm_haproxy_bot_flood_rate: 3
|
|
docker_swarm_haproxy_bot_validate_path: '/validate-browser'
|
|
docker_swarm_haproxy_bot_validate_cookie: 'SERVER_VALIDATED'
|
|
docker_swarm_haproxy_bot_validate_cookie_max_age: 86400
|
|
docker_swarm_haproxy_bot_bypass_networks: []
|
|
docker_swarm_haproxy_bot_exempt_paths: []
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# OIDC authentication and authorization, via the Lua scripts deployed by the
|
|
# haproxy_setup role (jwks_cache, jwt_oidc_auth, oidc_callback and optionally
|
|
# the accounting pair). Enable globally, then opt in per service:
|
|
#
|
|
# oidc:
|
|
# client_id: '{{ some_vaulted_client_id }}'
|
|
# service_key: 'api_d4science' # key in the Lua config.json "services"
|
|
# mode: 'authorize' # validate a token when presented
|
|
# # mode: 'authenticate' # no credentials, no entry: browsers are
|
|
# # # redirected to Keycloak, API clients 401
|
|
# protected_paths: ['/rest/']
|
|
# exempt_paths: ['/rest/public']
|
|
# ---------------------------------------------------------------------------
|
|
# WARNING: unlike cors.lua, these scripts require external Lua modules (cjson,
|
|
# socket, ssl, ltn12). The stock haproxytech/haproxy-debian image ships HAProxy
|
|
# built with Lua support but NO Lua module at all, and they cannot be installed
|
|
# at run time, so enabling this needs a custom image. Building one is easy (the
|
|
# image is Debian based: apt-get install lua-cjson lua-socket lua-sec, which ship
|
|
# modules for every Lua ABI including the 5.4 the image links). The real
|
|
# questions are whether we want to own an image build pipeline and whether we
|
|
# trust the Lua code: see the role README before turning it on.
|
|
docker_swarm_haproxy_oidc_enabled: false
|
|
docker_swarm_haproxy_oidc_lua_dir: '/usr/local/etc/haproxy/lua'
|
|
docker_swarm_haproxy_oidc_callback_path: '/oidc/callback'
|
|
docker_swarm_haproxy_oidc_realm: 'd4science'
|
|
docker_swarm_haproxy_oidc_accounting_enabled: false
|
|
docker_swarm_haproxy_oidc_exempt_paths:
|
|
- '/health'
|
|
- '/status'
|
|
- '/metrics'
|
|
- '/robots.txt'
|
|
- '/.well-known'
|
|
- '/favicon.ico'
|