574 lines
28 KiB
Django/Jinja
574 lines
28 KiB
Django/Jinja
#
|
|
# https://www.haproxy.com/blog/haproxy-on-docker-swarm-load-balancing-and-dns-service-discovery/
|
|
#
|
|
# This file is managed by Ansible. Optional features, all disabled by default:
|
|
#
|
|
# docker_swarm_haproxy_cors_enabled CORS handling via haproxy-lua-cors
|
|
# docker_swarm_haproxy_bot_mitigation_enabled user-agent blacklist + flood control
|
|
# + browser-validation challenge
|
|
# docker_swarm_haproxy_oidc_enabled JWT validation / OIDC login via Lua
|
|
# docker_swarm_haproxy_userlists HTTP basic auth for admin UIs
|
|
#
|
|
# All four need files to be reachable *inside the HAProxy container*: see
|
|
# "Optional HAProxy features" in the role README. In short: render them under
|
|
# /etc/haproxy/ on the manager nodes, which is already bind-mounted to
|
|
# /usr/local/etc/haproxy. The OIDC scripts additionally need Lua modules that the
|
|
# stock image does not carry.
|
|
#
|
|
# Per-service opt-in fields (in docker_swarm_haproxy_additional_services and
|
|
# docker_swarm_haproxy_plain_http_services), all optional:
|
|
#
|
|
# robots_txt: 'ckan_robots.txt' serve this file on /robots.txt
|
|
# cors: true | {methods: '', origins: '', headers: ''}
|
|
# bot_mitigation: true | {rate: 5, bypass_networks: [], exempt_paths: []}
|
|
# basic_auth: 'userlist_name'
|
|
# oidc: {client_id: '', service_key: '', mode: authorize|authenticate,
|
|
# protected_paths: [], exempt_paths: []}
|
|
#
|
|
{#
|
|
############################################################################
|
|
Macros
|
|
############################################################################
|
|
#}
|
|
{% macro bot_mitigation(srv) %}
|
|
{% set bm = srv.bot_mitigation if srv.bot_mitigation is mapping else {} %}
|
|
{% set p = srv.acl_name %}
|
|
{% set bypass_nets = bm.bypass_networks | default(docker_swarm_haproxy_bot_bypass_networks) %}
|
|
{% set exempt_paths = bm.exempt_paths | default(docker_swarm_haproxy_bot_exempt_paths) %}
|
|
{% set validate_path = bm.validate_path | default(docker_swarm_haproxy_bot_validate_path) %}
|
|
{% set flood_rate = bm.rate | default(docker_swarm_haproxy_bot_flood_rate) %}
|
|
{% set cookie_name = docker_swarm_haproxy_bot_validate_cookie %}
|
|
{% set table = docker_swarm_haproxy_bot_flood_table %}
|
|
{# Conditions shared by the tracking, the deny and the challenge redirect.
|
|
Everything that is already identified, exempt or trusted is left alone. #}
|
|
{% set skip = '!' ~ p ~ '_has_validated_cookie !' ~ p ~ '_is_validate_path !' ~ p ~ '_has_auth_header !' ~ p ~ '_has_gcube_token !' ~ p ~ '_is_options'
|
|
~ (' !' ~ p ~ '_exempt_paths' if exempt_paths else '')
|
|
~ (' !' ~ p ~ '_bypass_nets' if bypass_nets else '') %}
|
|
# Bot mitigation. Counters live in the "{{ table }}" table holder below.
|
|
acl {{ p }}_has_validated_cookie hdr_sub(cookie) {{ cookie_name }}=true
|
|
acl {{ p }}_is_validate_path path_beg {{ validate_path }}
|
|
acl {{ p }}_has_auth_header req.hdr(Authorization) -m found
|
|
acl {{ p }}_has_gcube_token req.hdr(gcube-token) -m found
|
|
# A CORS preflight carries no cookie and no credentials: challenging it
|
|
# would break every cross-origin call.
|
|
acl {{ p }}_is_options method OPTIONS
|
|
{% if exempt_paths %}
|
|
acl {{ p }}_exempt_paths path_beg{% for path in exempt_paths %} {{ path }}{% endfor %}
|
|
|
|
{% endif %}
|
|
{% if bypass_nets %}
|
|
acl {{ p }}_bypass_nets src{% for net in bypass_nets %} {{ net }}{% endfor %}
|
|
|
|
{% endif %}
|
|
http-request track-sc1 src table {{ table }} if {{ skip }}
|
|
http-request sc-inc-gpc0(1) if {{ skip }}
|
|
acl {{ p }}_is_rate_flooding sc_gpc0_rate(1) ge {{ flood_rate }}
|
|
acl {{ p }}_is_blocked sc_get_gpc1(1) gt 0
|
|
http-request sc-inc-gpc1(1) if {{ p }}_is_rate_flooding !{{ p }}_is_blocked
|
|
http-request deny deny_status 429 if {{ p }}_is_blocked
|
|
http-request deny deny_status 429 if {{ p }}_is_rate_flooding
|
|
# Browser validation challenge: bounce once through {{ validate_path }} and
|
|
# hand out the cookie, so that only clients that follow redirects get in.
|
|
http-request redirect code 302 location {{ validate_path }}?url=%[url,url_enc] if {{ skip }}
|
|
acl {{ p }}_url_param_is_relative url_param(url),url_dec -m reg ^/[^/]
|
|
http-request return status 302 hdr Location %[url_param(url),url_dec] hdr Set-Cookie "{{ cookie_name }}=true; Max-Age={{ docker_swarm_haproxy_bot_validate_cookie_max_age }}; Path=/; HttpOnly; Secure" if {{ p }}_is_validate_path {{ p }}_url_param_is_relative
|
|
http-request return status 302 hdr Location / hdr Set-Cookie "{{ cookie_name }}=true; Max-Age={{ docker_swarm_haproxy_bot_validate_cookie_max_age }}; Path=/; HttpOnly; Secure" if {{ p }}_is_validate_path !{{ p }}_url_param_is_relative
|
|
{% endmacro %}
|
|
{% macro user_agent_blacklist(srv) %}
|
|
acl {{ srv.acl_name }}_blocked_user_agent hdr_sub(user-agent) -i -f {{ docker_swarm_haproxy_bot_agents_blacklist_file }}
|
|
http-request deny if {{ srv.acl_name }}_blocked_user_agent
|
|
{% endmacro %}
|
|
{% macro cors_request(srv) %}
|
|
{% set c = srv.cors if srv.cors is mapping else {} %}
|
|
# See https://github.com/haproxytech/haproxy-lua-cors/blob/master/README.md
|
|
http-request lua.cors "{{ c.methods | default(docker_swarm_haproxy_cors_methods) }}" "{{ c.origins | default(docker_swarm_haproxy_cors_origins) }}" "{{ c.headers | default(docker_swarm_haproxy_cors_headers) }}"
|
|
{% endmacro %}
|
|
{% macro global_acl_rules(rules) %}
|
|
{% for rule in rules %}
|
|
acl {{ rule.acl_name }} {{ rule.acl_args }}
|
|
{{ rule.http_action }}
|
|
{% endfor %}
|
|
{% endmacro %}
|
|
{% macro service_acls(srv) %}
|
|
acl {{ srv.acl_name }} {{ srv.acl_rule }}
|
|
{% if srv.acl_path_rule is defined %}
|
|
acl {{ srv.acl_name }}_path {{ srv.acl_path_rule }}
|
|
{% endif %}
|
|
{% if srv.allowed_networks is defined %}
|
|
acl {{ srv.acl_name }}_nets src{% for net in srv.allowed_networks %} {{ net }}{% endfor %}
|
|
|
|
http-request deny if {{ srv.acl_name }} !{{ srv.acl_name }}_nets
|
|
{% endif %}
|
|
{% if srv.basic_auth is defined %}
|
|
http-request auth realm "{{ docker_swarm_haproxy_basic_auth_realm }}" if {{ srv.acl_name }} !{ http_auth({{ srv.basic_auth }}) }
|
|
{% endif %}
|
|
{% endmacro %}
|
|
{% macro service_use_backend(srv) %}
|
|
use_backend {{ srv.acl_name }}_bck if {{ srv.acl_name }}{% if srv.acl_path_rule is defined %} {{ srv.acl_name }}_path{% endif %}
|
|
|
|
{% endmacro %}
|
|
{#
|
|
############################################################################
|
|
Global
|
|
############################################################################
|
|
#}
|
|
global
|
|
log fd@2 local2 {{ docker_swarm_haproxy_loglevel }}
|
|
chroot /var/lib/haproxy
|
|
pidfile /var/run/haproxy.pid
|
|
maxconn {{ haproxy_maxconns }}
|
|
user haproxy
|
|
group haproxy
|
|
stats socket {{ haproxy_admin_socket }} expose-fd listeners level admin
|
|
master-worker
|
|
ca-base /etc/ssl/certs
|
|
crt-base /etc/ssl/private
|
|
# https://ssl-config.mozilla.org/#server=haproxy&version=2.2&config=intermediate&openssl=1.1.1d&guideline=5.6
|
|
tune.ssl.default-dh-param 2048
|
|
ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
|
|
ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
|
|
ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
|
|
ssl-default-server-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
|
|
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
|
|
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
|
|
{% if docker_swarm_haproxy_cors_enabled or docker_swarm_haproxy_oidc_enabled %}
|
|
{% if haproxy_version is defined and haproxy_version is version('3.1', '>=') %}
|
|
# HAProxy 3.1+: proper boolean handling in Lua fetch methods. This MUST come
|
|
# before any lua-load directive, or HAProxy ignores it and warns.
|
|
tune.lua.bool-sample-conversion normal
|
|
{% endif %}
|
|
{% endif %}
|
|
{% if docker_swarm_haproxy_cors_enabled %}
|
|
# CORS handling
|
|
lua-load {{ docker_swarm_haproxy_cors_lua_path }}
|
|
{% endif %}
|
|
{% if docker_swarm_haproxy_oidc_enabled %}
|
|
# OIDC/JWT authentication. Load order matters: jwks_cache first.
|
|
lua-load {{ docker_swarm_haproxy_oidc_lua_dir }}/jwks_cache.lua
|
|
{% if docker_swarm_haproxy_oidc_accounting_enabled %}
|
|
lua-load {{ docker_swarm_haproxy_oidc_lua_dir }}/accounting.lua
|
|
{% endif %}
|
|
lua-load {{ docker_swarm_haproxy_oidc_lua_dir }}/jwt_oidc_auth.lua
|
|
lua-load {{ docker_swarm_haproxy_oidc_lua_dir }}/oidc_callback.lua
|
|
{% if docker_swarm_haproxy_oidc_accounting_enabled %}
|
|
lua-load {{ docker_swarm_haproxy_oidc_lua_dir }}/accounting_response.lua
|
|
{% endif %}
|
|
{% endif %}
|
|
|
|
resolvers docker
|
|
nameserver dns1 127.0.0.11:53
|
|
resolve_retries 3
|
|
timeout resolve 1s
|
|
timeout retry 1s
|
|
hold other 10s
|
|
hold refused 10s
|
|
hold nx 10s
|
|
hold timeout 10s
|
|
hold valid 10s
|
|
hold obsolete 10s
|
|
|
|
defaults
|
|
log global
|
|
monitor-uri /_haproxy_health_check
|
|
timeout http-keep-alive {{ haproxy_global_keepalive_timeout }}
|
|
timeout connect {{ haproxy_connect_timeout }}
|
|
timeout client {{ haproxy_client_timeout }}
|
|
timeout server {{ haproxy_server_timeout }}
|
|
timeout check {{ haproxy_check_timeout }}
|
|
timeout http-request 10s # slowloris protection
|
|
default-server inter 3s fall 2 rise 2 slowstart 60s
|
|
option dontlognull
|
|
option log-health-checks
|
|
|
|
# Needed to preserve the stick tables
|
|
peers mypeers
|
|
peer local_haproxy 127.0.0.1:1024
|
|
{% for ul in docker_swarm_haproxy_userlists %}
|
|
|
|
userlist {{ ul.name }}
|
|
{% for user in ul.users %}
|
|
user {{ user.name }} password {{ user.password_hash }}
|
|
{% endfor %}
|
|
{% endfor %}
|
|
|
|
listen stats
|
|
{% if docker_swarm_haproxy_ipv4_only %}
|
|
bind 0.0.0.0:{{ haproxy_admin_port }} ssl crt {{ haproxy_cert_dir }} alpn h2,http/1.1
|
|
{% elif docker_swarm_haproxy_ipv6_only %}
|
|
bind :::{{ haproxy_admin_port }} ssl crt {{ haproxy_cert_dir }} alpn h2,http/1.1
|
|
{% else %}
|
|
bind *:{{ haproxy_admin_port }} ssl crt {{ haproxy_cert_dir }} alpn h2,http/1.1
|
|
{% endif %}
|
|
mode http
|
|
http-request use-service prometheus-exporter if { path /metrics }
|
|
option httplog
|
|
stats enable
|
|
stats uri /
|
|
stats realm HAProxy\ Statistics
|
|
stats auth admin:{{ haproxy_admin_pwd }}
|
|
stats refresh 15s
|
|
stats show-legends
|
|
stats show-node
|
|
|
|
listen local_stats
|
|
bind 127.0.0.1:8881
|
|
mode http
|
|
option httplog
|
|
stats enable
|
|
stats uri /
|
|
stats realm HAProxy\ Statistics
|
|
|
|
{% if docker_swarm_haproxy_plain_http_listener %}
|
|
|
|
frontend http_{{ docker_swarm_haproxy_plain_http_port }}
|
|
{% if docker_swarm_haproxy_ipv4_only %}
|
|
bind 0.0.0.0:{{ docker_swarm_haproxy_plain_http_port }} {% if docker_swarm_haproxy_accept_proxy %}accept-proxy{% endif %}
|
|
|
|
{% elif docker_swarm_haproxy_ipv6_only %}
|
|
bind :::{{ docker_swarm_haproxy_plain_http_port }} {% if docker_swarm_haproxy_accept_proxy %}accept-proxy{% endif %}
|
|
|
|
{% else %}
|
|
bind *:{{ docker_swarm_haproxy_plain_http_port }} {% if docker_swarm_haproxy_accept_proxy %}accept-proxy{% endif %}
|
|
|
|
{% endif %}
|
|
|
|
mode http
|
|
option http-keep-alive
|
|
option httplog
|
|
option forwardfor
|
|
{# Rules that apply to the whole frontend: rendered ONCE, not once per service. #}
|
|
{% if docker_swarm_haproxy_plain_http_global_acl_rules is defined %}
|
|
{{ global_acl_rules(docker_swarm_haproxy_plain_http_global_acl_rules) }}
|
|
{% endif %}
|
|
{% for srv in docker_swarm_haproxy_plain_http_services %}
|
|
{{ service_acls(srv) }}
|
|
{% endfor %}
|
|
{% set plain_robots = docker_swarm_haproxy_plain_http_services | selectattr('robots_txt', 'defined') | list %}
|
|
{% if plain_robots %}
|
|
acl is_robots_txt path /robots.txt
|
|
{% for srv in plain_robots %}
|
|
http-request return status 200 content-type "text/plain" file "{{ docker_swarm_haproxy_static_dir }}/{{ srv.robots_txt }}" hdr "cache-control" "no-cache" if is_robots_txt {{ srv.acl_name }}
|
|
{% endfor %}
|
|
{% endif %}
|
|
{% for srv in docker_swarm_haproxy_plain_http_services %}
|
|
{{ service_use_backend(srv) }}
|
|
{% endfor %}
|
|
|
|
{% endif %}
|
|
|
|
frontend http
|
|
{% if docker_swarm_haproxy_ipv4_only %}
|
|
bind 0.0.0.0:{{ https_port }} ssl crt {{ haproxy_cert_dir }}{% if docker_swarm_haproxy_http2_enabled %} alpn http/1.1{% endif %}{% if docker_swarm_haproxy_accept_proxy %} accept-proxy{% endif %}
|
|
|
|
bind 0.0.0.0:{{ haproxy_default_port }} {% if docker_swarm_haproxy_accept_proxy %}accept-proxy{% endif %}
|
|
|
|
{% elif docker_swarm_haproxy_ipv6_only %}
|
|
bind :::{{ https_port }} ssl crt {{ haproxy_cert_dir }}{% if docker_swarm_haproxy_http2_enabled %} alpn h2,http/1.1{% endif %}{% if docker_swarm_haproxy_accept_proxy %} accept-proxy{% endif %}
|
|
|
|
bind :::{{ haproxy_default_port }} {% if docker_swarm_haproxy_accept_proxy %}accept-proxy{% endif %}
|
|
|
|
{% else %}
|
|
bind *:{{ https_port }} ssl crt {{ haproxy_cert_dir }}{% if docker_swarm_haproxy_http2_enabled %} alpn h2,http/1.1{% endif %}{% if docker_swarm_haproxy_accept_proxy %} accept-proxy{% endif %}
|
|
|
|
bind *:{{ haproxy_default_port }} {% if docker_swarm_haproxy_accept_proxy %}accept-proxy{% endif %}
|
|
|
|
{% endif %}
|
|
mode http
|
|
option http-keep-alive
|
|
option httplog
|
|
option forwardfor
|
|
# HSTS (63072000 seconds)
|
|
http-response set-header Strict-Transport-Security max-age=63072000
|
|
http-request set-header X-Forwarded-Proto https if { ssl_fc }
|
|
# Remove the port from the host endpoint.
|
|
http-request replace-value Host (.*):.* \1
|
|
{% if docker_swarm_haproxy_cors_enabled %}
|
|
# Needed by the CORS Lua code to echo the request origin back.
|
|
capture request header origin len 128
|
|
{% endif %}
|
|
{# Rules that apply to the whole frontend: rendered ONCE, not once per service.
|
|
Anything stateful (sc-inc-gpc, track-sc) MUST stay out of the per-service
|
|
loop, or it would be executed once per rendered copy. #}
|
|
{% if docker_swarm_haproxy_global_acl_rules is defined %}
|
|
{{ global_acl_rules(docker_swarm_haproxy_global_acl_rules) }}
|
|
{% endif %}
|
|
{% if docker_swarm_cluster_portainer_install %}
|
|
acl portainer_srv hdr(host) -i {{ docker_swarm_portainer_hostname }}
|
|
{% endif %}
|
|
{% set http_services = docker_swarm_haproxy_additional_services | rejectattr('mode', 'defined') | list
|
|
+ docker_swarm_haproxy_additional_services | selectattr('mode', 'defined') | rejectattr('mode', 'equalto', 'tcp') | list %}
|
|
{% for srv in http_services %}
|
|
{{ service_acls(srv) }}
|
|
{% endfor %}
|
|
{% set robots_services = http_services | selectattr('robots_txt', 'defined') | list %}
|
|
{% if robots_services %}
|
|
# robots.txt is served here and not in the backends, because a service that
|
|
# is selected by a path rule would never route /robots.txt to its backend.
|
|
acl is_robots_txt path /robots.txt
|
|
{% for srv in robots_services %}
|
|
http-request return status 200 content-type "text/plain" file "{{ docker_swarm_haproxy_static_dir }}/{{ srv.robots_txt }}" hdr "cache-control" "no-cache" if is_robots_txt {{ srv.acl_name }}
|
|
{% endfor %}
|
|
{% endif %}
|
|
{% if docker_swarm_haproxy_oidc_enabled %}
|
|
{% set oidc_services = http_services | selectattr('oidc', 'defined') | list %}
|
|
# OIDC callback endpoint, handled in-process by the Lua service.
|
|
acl oidc_callback_path path_beg {{ docker_swarm_haproxy_oidc_callback_path }}
|
|
{% if docker_swarm_haproxy_oidc_exempt_paths %}
|
|
acl oidc_exempt_paths path_beg{% for path in docker_swarm_haproxy_oidc_exempt_paths %} {{ path }}{% endfor %}
|
|
|
|
{% endif %}
|
|
# CORS preflight must never be challenged.
|
|
acl oidc_exempt_options method OPTIONS
|
|
{% for srv in oidc_services %}
|
|
{% if srv.oidc.protected_paths is defined and srv.oidc.protected_paths %}
|
|
acl {{ srv.acl_name }}_oidc_paths path_beg{% for path in srv.oidc.protected_paths %} {{ path }}{% endfor %}
|
|
|
|
{% endif %}
|
|
{% if srv.oidc.exempt_paths is defined and srv.oidc.exempt_paths %}
|
|
acl {{ srv.acl_name }}_oidc_exempt path_beg{% for path in srv.oidc.exempt_paths %} {{ path }}{% endfor %}
|
|
|
|
{% endif %}
|
|
{% endfor %}
|
|
{% for srv in oidc_services %}
|
|
{# mode "authorize": validate a token when one is presented.
|
|
mode "authenticate": no token, no entry — browsers get bounced to Keycloak.
|
|
Both are the same Lua call; the Lua itself 401s API clients and redirects
|
|
browsers. The difference is which requests we hand to it. #}
|
|
http-request lua.jwt_oidc_auth {{ srv.oidc.client_id }} {{ srv.oidc.service_key | default(srv.acl_name) }} if {{ srv.acl_name }}{% if srv.oidc.protected_paths is defined and srv.oidc.protected_paths %} {{ srv.acl_name }}_oidc_paths{% endif %}{% if srv.oidc.exempt_paths is defined and srv.oidc.exempt_paths %} !{{ srv.acl_name }}_oidc_exempt{% endif %}{% if docker_swarm_haproxy_oidc_exempt_paths %} !oidc_exempt_paths{% endif %} !oidc_exempt_options{% if srv.oidc.mode | default('authorize') == 'authorize' %} { req.hdr(Authorization) -m found }{% endif %}
|
|
|
|
{% endfor %}
|
|
{% if oidc_services %}
|
|
# Turn what the Lua decided into an actual response. "return" and not
|
|
# "deny deny_status", because deny ignores a content-type and would answer
|
|
# with the HTML error file instead of JSON.
|
|
http-request return status 401 content-type "application/json" string "{\"error\":\"unauthorized\"}" hdr WWW-Authenticate "Bearer realm=\"{{ docker_swarm_haproxy_oidc_realm }}\"" if { var(txn.auth_status) -m int 401 }
|
|
http-request redirect location %[var(txn.auth_redirect)] code 302 if { var(txn.auth_status) -m int 302 }
|
|
{% if docker_swarm_haproxy_oidc_accounting_enabled %}
|
|
http-response lua.accounting_response if { var(txn.acct_enabled) -m str 1 }
|
|
{% endif %}
|
|
{% endif %}
|
|
use_backend oidc_callback_bck if oidc_callback_path
|
|
{% endif %}
|
|
{% if docker_swarm_cluster_portainer_install %}
|
|
use_backend portainer_bck if portainer_srv
|
|
{% endif %}
|
|
{% for srv in http_services %}
|
|
{{ service_use_backend(srv) }}
|
|
{% endfor %}
|
|
|
|
{% if docker_swarm_expose_api_via_haproxy %}
|
|
frontend docker_ft
|
|
{% if docker_swarm_haproxy_ipv4_only %}
|
|
{% if docker_swarm_haproxy_plain_http_api %}
|
|
bind 0.0.0.0:{{ docker_swarm_haproxy_swarm_port }} {% if docker_swarm_haproxy_accept_proxy and docker_swarm_api_accept_proxy %}accept-proxy{% endif %}
|
|
{% else %}
|
|
bind 0.0.0.0:{{ docker_swarm_haproxy_swarm_port }} ssl crt {{ haproxy_cert_dir }} alpn h2,http/1.1 {% if docker_swarm_haproxy_accept_proxy and docker_swarm_api_accept_proxy %}accept-proxy{% endif %}
|
|
{% endif %}
|
|
|
|
{% elif docker_swarm_haproxy_ipv6_only %}
|
|
{% if docker_swarm_haproxy_plain_http_api %}
|
|
bind :::{{ docker_swarm_haproxy_swarm_port }} {% if docker_swarm_haproxy_accept_proxy and docker_swarm_api_accept_proxy %}accept-proxy{% endif %}
|
|
{% else %}
|
|
bind :::{{ docker_swarm_haproxy_swarm_port }} ssl crt {{ haproxy_cert_dir }} alpn h2,http/1.1 {% if docker_swarm_haproxy_accept_proxy and docker_swarm_api_accept_proxy %}accept-proxy{% endif %}
|
|
{% endif %}
|
|
{% else %}
|
|
{% if docker_swarm_haproxy_plain_http_api %}
|
|
bind *:{{ docker_swarm_haproxy_swarm_port }} {% if docker_swarm_haproxy_accept_proxy and docker_swarm_api_accept_proxy %}accept-proxy{% endif %}
|
|
{% else %}
|
|
bind *:{{ docker_swarm_haproxy_swarm_port }} ssl crt {{ haproxy_cert_dir }} alpn h2,http/1.1 {% if docker_swarm_haproxy_accept_proxy and docker_swarm_api_accept_proxy %}accept-proxy{% endif %}
|
|
{% endif %}
|
|
{% endif %}
|
|
mode {{ docker_swarm_api_haproxy_mode }}
|
|
acl swarm_api hdr_dom(host) -i {{ docker_swarm_expose_api_hostname }}
|
|
|
|
acl swarm_api_allowed_nets src {% for net in docker_swarm_api_networks_acl %} {{ net }}{% endfor %}
|
|
|
|
http-request deny if swarm_api !swarm_api_allowed_nets
|
|
|
|
# The following variables must be set in the haproxy docker file
|
|
# http-request deny unless METH_GET || { env(POST) -m bool }
|
|
# http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/[a-zA-Z0-9_.-]+/((stop)|(restart)|(kill)) } { env(ALLOW_RESTARTS) -m bool }
|
|
# http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/auth } { env(AUTH) -m bool }
|
|
# http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/build } { env(BUILD) -m bool }
|
|
# http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/commit } { env(COMMIT) -m bool }
|
|
# http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/configs } { env(CONFIGS) -m bool }
|
|
# http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers } { env(CONTAINERS) -m bool }
|
|
# http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/distribution } { env(DISTRIBUTION) -m bool }
|
|
# http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/events } { env(EVENTS) -m bool }
|
|
# http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/exec } { env(EXEC) -m bool }
|
|
# http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/images } { env(IMAGES) -m bool }
|
|
# http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/info } { env(INFO) -m bool }
|
|
# http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/networks } { env(NETWORKS) -m bool }
|
|
# http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/nodes } { env(NODES) -m bool }
|
|
# http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/_ping } { env(PING) -m bool }
|
|
# http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/plugins } { env(PLUGINS) -m bool }
|
|
# http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/post } { env(POST) -m bool }
|
|
# http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/secrets } { env(SECRETS) -m bool }
|
|
# http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/services } { env(SERVICES) -m bool }
|
|
# http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/session } { env(SESSION) -m bool }
|
|
# http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/swarm } { env(SWARM) -m bool }
|
|
# http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/system } { env(SYSTEM) -m bool }
|
|
# http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/tasks } { env(TASKS) -m bool }
|
|
# http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/version } { env(VERSION) -m bool }
|
|
# http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/volumes } { env(VOLUMES) -m bool }
|
|
# http-request deny
|
|
default_backend swarm_api_bck
|
|
{% endif %}
|
|
|
|
{% for srv in docker_swarm_haproxy_additional_services %}
|
|
{% if srv.mode is defined and srv.mode == 'tcp' %}
|
|
frontend {{ srv.acl_name }}
|
|
bind :{{ srv.service_port }}
|
|
mode {{ srv.mode }}
|
|
{% if srv.allowed_networks is defined %}
|
|
acl {{ srv.acl_name }}_nets src{% for net in srv.allowed_networks %} {{ net }}{% endfor %}
|
|
|
|
# This frontend serves one service only, so there is no host ACL to combine.
|
|
tcp-request connection reject if !{{ srv.acl_name }}_nets
|
|
{% endif %}
|
|
use_backend {{ srv.acl_name }}_bck
|
|
|
|
{% endif %}
|
|
{% endfor %}
|
|
|
|
#
|
|
# Backends
|
|
#
|
|
|
|
{% if docker_swarm_expose_api_via_haproxy %}
|
|
# swarm API
|
|
backend swarm_api_bck
|
|
mode http
|
|
{% if docker_swarm_api_check_availability %}
|
|
option httpchk
|
|
http-check send meth HEAD uri /version ver HTTP/1.1 hdr Host localhost
|
|
http-check expect rstatus (2|3)[0-9][0-9]
|
|
{% endif %}
|
|
server {{ docker_swarm_api_backend }}
|
|
{% endif %}
|
|
|
|
{% if docker_swarm_haproxy_oidc_enabled %}
|
|
# OIDC authorization code callback, served by the Lua script itself.
|
|
backend oidc_callback_bck
|
|
mode http
|
|
http-request use-service lua.oidc_callback
|
|
{% endif %}
|
|
|
|
{% if docker_swarm_haproxy_bot_mitigation_enabled %}
|
|
{% set mitigated = docker_swarm_haproxy_additional_services | selectattr('bot_mitigation', 'defined') | list %}
|
|
{% if mitigated %}
|
|
# Table holder for the flood counters. It has no server on purpose: it exists
|
|
# only to own the stick-table that the backends track into.
|
|
backend {{ docker_swarm_haproxy_bot_flood_table }}
|
|
stick-table type ip size {{ docker_swarm_haproxy_bot_flood_table_size }} expire {{ docker_swarm_haproxy_bot_flood_table_expire }} store gpc0_rate({{ docker_swarm_haproxy_bot_flood_rate_period }}),gpc1 peers mypeers
|
|
{% endif %}
|
|
{% endif %}
|
|
|
|
{% if docker_swarm_cluster_portainer_install %}
|
|
backend portainer_bck
|
|
mode http
|
|
# No need to check until portainer can be replicated
|
|
# option httpchk
|
|
# http-check send meth HEAD uri / ver HTTP/1.1 hdr Host localhost
|
|
# http-check expect rstatus (2|3)[0-9][0-9]
|
|
# balance roundrobin
|
|
http-request set-header X-Forwarded-Proto https if { ssl_fc }
|
|
http-request redirect scheme https code 301 unless { ssl_fc }
|
|
server-template portainer- 1 portainer_portainer:{{ docker_swarm_portainer_http_port }} check resolvers docker init-addr libc,none
|
|
{% endif %}
|
|
|
|
{% for srv in docker_swarm_haproxy_additional_services %}
|
|
backend {{ srv.acl_name }}_bck
|
|
{% if srv.mode is defined and srv.mode == 'tcp' %}
|
|
mode tcp
|
|
balance {{ srv.balance_type | default('roundrobin') }}
|
|
server-template {{ srv.service_name }}- {{ srv.service_replica_num }} {{ srv.stack_name }}_{{ srv.service_name }}:{{ srv.service_port }} resolvers docker init-addr libc,none
|
|
|
|
{% else %}
|
|
mode http
|
|
option httpchk
|
|
{% if srv.enable_websocket is defined and srv.enable_websocket %}
|
|
option http-server-close
|
|
timeout tunnel {{ haproxy_tunnel_timeout | default('1h') }}
|
|
{% endif %}
|
|
balance {{ srv.balance_type | default('roundrobin') }}
|
|
{% if srv.backend_additional_options is defined %}
|
|
{% for bck_opt in srv.backend_additional_options %}
|
|
{{ bck_opt }}
|
|
{% endfor %}
|
|
|
|
{% endif %}
|
|
{% if docker_swarm_haproxy_bot_mitigation_enabled and srv.bot_mitigation is defined %}
|
|
{{ user_agent_blacklist(srv) }}
|
|
{% endif %}
|
|
{% if docker_swarm_haproxy_cors_enabled and srv.cors is defined %}
|
|
{{ cors_request(srv) }}
|
|
http-response lua.cors
|
|
{% endif %}
|
|
{% if docker_swarm_haproxy_bot_mitigation_enabled and srv.bot_mitigation is defined %}
|
|
{{ bot_mitigation(srv) }}
|
|
{% endif %}
|
|
{% if srv.http_check_enabled is defined and srv.http_check_enabled %}
|
|
http-check send {{ srv.http_check }}
|
|
http-check expect {{ srv.http_check_expect }}
|
|
{% endif %}
|
|
{% if srv.stick_sessions %}
|
|
{% if srv.stick_on_cookie %}
|
|
dynamic-cookie-key {{ srv.acl_name }}
|
|
cookie {{ srv.stick_cookie }} dynamic
|
|
{% else %}
|
|
stick on src
|
|
stick-table {{ srv.stick_table }} peers mypeers
|
|
{% endif %}
|
|
{% endif %}
|
|
{% if srv.http_redirect_to_https %}
|
|
http-request set-header X-Forwarded-Proto https if { ssl_fc }
|
|
http-request redirect scheme https code 301 unless { ssl_fc }
|
|
{% endif %}
|
|
server-template {{ srv.service_name }}- {{ srv.service_replica_num }} {{ srv.stack_name }}_{{ srv.service_name }}:{{ srv.service_port }} {{ srv.backend_options | default('') }} {% if srv.http_check_enabled is defined and srv.http_check_enabled %}check {{ srv.check_options | default('') }}{% endif %} resolvers docker init-addr libc,none
|
|
|
|
{% endif %}
|
|
{% endfor %}
|
|
|
|
{% if docker_swarm_haproxy_plain_http_listener %}
|
|
|
|
{% for srv in docker_swarm_haproxy_plain_http_services %}
|
|
backend {{ srv.acl_name }}_bck
|
|
mode http
|
|
option httpchk
|
|
balance {{ srv.balance_type | default('roundrobin') }}
|
|
{% if srv.backend_additional_options is defined %}
|
|
{% for bck_opt in srv.backend_additional_options %}
|
|
{{ bck_opt }}
|
|
{% endfor %}
|
|
|
|
{% endif %}
|
|
{% if docker_swarm_haproxy_bot_mitigation_enabled and srv.bot_mitigation is defined %}
|
|
{{ user_agent_blacklist(srv) }}
|
|
{% endif %}
|
|
{% if docker_swarm_haproxy_cors_enabled and srv.cors is defined %}
|
|
{{ cors_request(srv) }}
|
|
http-response lua.cors
|
|
{% endif %}
|
|
{% if docker_swarm_haproxy_bot_mitigation_enabled and srv.bot_mitigation is defined %}
|
|
{{ bot_mitigation(srv) }}
|
|
{% endif %}
|
|
{% if srv.http_check_enabled is defined and srv.http_check_enabled %}
|
|
http-check send {{ srv.http_check }}
|
|
http-check expect {{ srv.http_check_expect }}
|
|
{% endif %}
|
|
{% if srv.stick_sessions %}
|
|
{% if srv.stick_on_cookie %}
|
|
dynamic-cookie-key {{ srv.acl_name }}
|
|
cookie {{ srv.stick_cookie }} dynamic
|
|
{% else %}
|
|
stick on src
|
|
stick-table {{ srv.stick_table }} peers mypeers
|
|
{% endif %}
|
|
{% endif %}
|
|
server-template {{ srv.service_name }}- {{ srv.service_replica_num }} {{ srv.stack_name }}_{{ srv.service_name }}:{{ srv.service_port }} {{ srv.backend_options | default('') }} {% if srv.http_check_enabled is defined and srv.http_check_enabled %}check {{ srv.check_options | default('') }}{% endif %} resolvers docker init-addr libc,none
|
|
|
|
{% endfor %}
|
|
|
|
{% endif %}
|