Refactoring to Python
This commit is contained in:
Joao M
parent
cd5035602a
commit
7d959f892a
43 changed files with 454 additions and 34 deletions
8
src/templates/bind.j2
Normal file
8
src/templates/bind.j2
Normal file
|
|
@ -0,0 +1,8 @@
|
|||
{% if "ssl" in o %}
|
||||
bind *:{{ o["port"] }} ssl crt /certs/letsencrypt/ alpn http/1.1 crt /certs/haproxy/ alpn http/1.1
|
||||
{% elif "h2" in o and o["h2"] %}
|
||||
bind *:{{ o["port"] }} proto h2
|
||||
option http-use-htx
|
||||
{% else %}
|
||||
bind *:{{ o["port"] }}
|
||||
{% endif %}
|
||||
21
src/templates/frontend-mode-http.j2
Normal file
21
src/templates/frontend-mode-http.j2
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
mode http
|
||||
{% for k in o["redirect"] %}
|
||||
redirect prefix {{ o["redirect"][k] }} code 301 if { hdr(host) -i {{ k }} }
|
||||
{% endfor %}
|
||||
|
||||
{%- for k in o["hosts"] %}
|
||||
{% set host = k.replace(".", "_") + "_{0}".format(o["port"]) %}
|
||||
{% set letsencrypt = o["hosts"][k]["letsencrypt"] %}
|
||||
|
||||
acl is_rule_{{ host }}_1 hdr(host) -i {{ k }}
|
||||
acl is_rule_{{ host }}_2 hdr(host) -i {{ k }}:{{ o["port"] }}
|
||||
{% if letsencrypt %}
|
||||
acl is_letsencrypt_{{ host }} path_beg /.well-known/acme-challenge/
|
||||
use_backend letsencrypt_backend if is_letsencrypt_{{ host }} is_rule_{{ host }}_1 OR is_letsencrypt_{{ host }} is_rule_{{ host }}_2
|
||||
{% endif %}
|
||||
{% if o["hosts"][k]["redirect_ssl"] %}
|
||||
http-request redirect scheme https code 301 if {% if letsencrypt %}!is_letsencrypt_{{ host }} {% endif %}is_rule_{{ host }}_1 OR {% if letsencrypt %}!is_letsencrypt_{{ host }} {% endif %}is_rule_{{ host }}_2
|
||||
{% else %}
|
||||
use_backend srv_{{ host }} if is_rule_{{ host }}_1 OR is_rule_{{ host }}_2
|
||||
{% endif %}
|
||||
{% endfor %}
|
||||
6
src/templates/frontend-mode-tcp.j2
Normal file
6
src/templates/frontend-mode-tcp.j2
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
mode tcp
|
||||
option tcplog
|
||||
log global
|
||||
{% set backend = (o["hosts"]|first) %}
|
||||
default_backend srv_{{ backend.replace(".", "_") + "_{0}".format(o["port"]) }}
|
||||
|
||||
80
src/templates/haproxy.cfg.j2
Normal file
80
src/templates/haproxy.cfg.j2
Normal file
|
|
@ -0,0 +1,80 @@
|
|||
global
|
||||
log stdout format raw local0 info
|
||||
maxconn 2000
|
||||
{% if data["ssl_mode"] == "strict" %}
|
||||
{% include "ssl_strict.j2" %}
|
||||
{% elif data["ssl_mode"] == "loose" %}
|
||||
{% include "ssl_loose.j2" %}
|
||||
{% else %}
|
||||
{% include "ssl_default.j2" %}
|
||||
{% endif %}
|
||||
|
||||
|
||||
defaults
|
||||
log global
|
||||
option httplog
|
||||
|
||||
timeout connect 3s
|
||||
timeout client 10s
|
||||
timeout server 10m
|
||||
{% if data["customerrors"] %}
|
||||
errorfile 400 /etc/haproxy/errors-custom/400.http
|
||||
errorfile 403 /etc/haproxy/errors-custom/403.http
|
||||
errorfile 408 /etc/haproxy/errors-custom/408.http
|
||||
errorfile 500 /etc/haproxy/errors-custom/500.http
|
||||
errorfile 502 /etc/haproxy/errors-custom/502.http
|
||||
errorfile 503 /etc/haproxy/errors-custom/503.http
|
||||
errorfile 504 /etc/haproxy/errors-custom/504.http
|
||||
{% endif %}
|
||||
|
||||
{% set data_stats = data["stats"] | default({}) %}
|
||||
{% if data_stats["port"] | default(1936) | int > 0 %}
|
||||
frontend stats
|
||||
bind *:{{ data_stats["port"] | default(1936) }}
|
||||
mode http
|
||||
stats enable
|
||||
stats hide-version
|
||||
stats realm Haproxy\ Statistics
|
||||
stats uri /
|
||||
{% if data_stats["password"] | default("") != "" %}
|
||||
stats auth {{ data_stats["username"] | default("admin") }}:{{ data_stats["password"] }}
|
||||
{% endif %}
|
||||
default_backend srv_stats
|
||||
|
||||
backend srv_stats
|
||||
mode http
|
||||
server Local 127.0.0.1:{{ data_stats["port"] | default(1936) }}
|
||||
{% endif %}
|
||||
{% for o in data["easymapping"] -%}
|
||||
{% set mode = o["mode"] or "http" %}
|
||||
|
||||
frontend {{ mode }}_in_{{ o["port"] }}
|
||||
{% include "bind.j2" %}
|
||||
{% if mode == "http" %}
|
||||
{% include "frontend-mode-http.j2" %}
|
||||
{% else %}
|
||||
{% include "frontend-mode-tcp.j2" %}
|
||||
{% endif %}
|
||||
|
||||
{% for k in o["hosts"] -%}
|
||||
{% set host = k.replace(".", "_") + "_{0}".format(o["port"]) %}
|
||||
backend srv_{{ host }}
|
||||
balance roundrobin
|
||||
mode {{ mode }}
|
||||
{% if mode == "http" %}
|
||||
option forwardfor
|
||||
http-request set-header X-Forwarded-Port %[dst_port]
|
||||
http-request add-header X-Forwarded-Proto https if { ssl_fc }
|
||||
{% elif mode == "tcp" %}
|
||||
option tcp-check
|
||||
tcp-check connect{{ " ssl" if o["health-check"] == "ssl" }}
|
||||
{% endif %}
|
||||
{% for c in o["hosts"][k]["containers"] %}
|
||||
server srv-{{ loop.index0 }} {{ c }} check weight 1{{ " verify none" if o["health-check"] == "ssl" }}
|
||||
{% endfor %}
|
||||
{% endfor %}
|
||||
{% endfor %}
|
||||
|
||||
backend letsencrypt_backend
|
||||
mode http
|
||||
server certbot 127.0.0.1:2080
|
||||
12
src/templates/ssl_default.j2
Normal file
12
src/templates/ssl_default.j2
Normal file
|
|
@ -0,0 +1,12 @@
|
|||
tune.ssl.default-dh-param 2048
|
||||
|
||||
# intermediate configuration
|
||||
ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
|
||||
ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
|
||||
ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
|
||||
|
||||
ssl-default-server-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
|
||||
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
|
||||
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
|
||||
|
||||
ssl-dh-param-file /etc/haproxy/dhparam
|
||||
10
src/templates/ssl_loose.j2
Normal file
10
src/templates/ssl_loose.j2
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA
|
||||
ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
|
||||
ssl-default-bind-options no-sslv3 no-tls-tickets
|
||||
|
||||
ssl-default-server-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA
|
||||
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
|
||||
ssl-default-server-options no-sslv3 no-tls-tickets
|
||||
|
||||
ssl-dh-param-file /etc/haproxy/dhparam-1024
|
||||
|
||||
7
src/templates/ssl_strict.j2
Normal file
7
src/templates/ssl_strict.j2
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
# modern configuration
|
||||
ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
|
||||
ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets
|
||||
|
||||
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
|
||||
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets
|
||||
|
||||
Loading…
Add table
Add a link
Reference in a new issue