badblocks/docker-easy-haproxy
1
0
Fork 0
Code Activity

Add comprehensive plugin usage examples for Docker, Kubernetes, and Swarm

Browse source 
- Introduced multiple detailed plugin examples for Cloudflare IP restoration, IP whitelisting, JWT validation, and combined usage.
- Added configurations for `docker-compose`, `Kubernetes`, and `Swarm` showcasing individual and multi-plugin use cases.
- Included clear prerequisites, setup steps, and testing procedures for each example.
- Documented advanced scenarios like path blocking, custom IP lists, and JWT validation for production environments.
This commit is contained in:
Joao Gilberto Magalhaes 2025-11-27 19:08:48 -05:00
parent 06d1d447f8
commit f75cb8aab2
15 changed files with 1977 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

211
examples/docker/README.md
View file

@ -149,6 +149,217 @@ labels:
--- ---
## Plugin Examples
### JWT Validator Plugin
Protect your API with JWT token validation:
```yaml
version: "3"
services:
haproxy:
image: byjg/easy-haproxy:4.6.0
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- ./jwt_pubkey.pem:/etc/haproxy/jwt_keys/api_pubkey.pem:ro
environment:
EASYHAPROXY_DISCOVER: docker
HAPROXY_USERNAME: admin
HAPROXY_PASSWORD: password
HAPROXY_STATS_PORT: 1936
ports:
- "80:80/tcp"
- "443:443/tcp"
- "1936:1936/tcp"
api:
image: my-api:latest
labels:
easyhaproxy.http.host: api.example.com
easyhaproxy.http.port: 80
easyhaproxy.http.localport: 8080
# Enable JWT validation
easyhaproxy.http.plugins: jwt_validator
easyhaproxy.http.plugin.jwt_validator.algorithm: RS256
easyhaproxy.http.plugin.jwt_validator.issuer: https://auth.example.com/
easyhaproxy.http.plugin.jwt_validator.audience: https://api.example.com
easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
```
**What it validates:**
- Authorization header presence
- JWT signing algorithm
- JWT issuer and audience
- JWT signature using public key
- JWT expiration time
**Test:**
```bash
# Without token - should fail
curl http://api.example.com/endpoint
# Response: Missing Authorization HTTP header
# With valid JWT token
curl -H "Authorization: Bearer eyJhbGc..." http://api.example.com/endpoint
# Response: Success
```
**Generate test public key:**
```bash
# Generate private key
openssl genrsa -out jwt_private.pem 2048
# Extract public key
openssl rsa -in jwt_private.pem -pubout -out jwt_pubkey.pem
```
---
### Cloudflare IP Restoration Plugin
Restore original visitor IPs when using Cloudflare CDN:
```yaml
version: "3"
services:
haproxy:
image: byjg/easy-haproxy:4.6.0
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- ./cloudflare_ips.lst:/etc/haproxy/cloudflare_ips.lst:ro
environment:
EASYHAPROXY_DISCOVER: docker
ports:
- "80:80/tcp"
- "443:443/tcp"
webapp:
image: my-webapp:latest
labels:
easyhaproxy.http.host: myapp.com
easyhaproxy.http.port: 80
easyhaproxy.http.localport: 3000
# Enable Cloudflare plugin
easyhaproxy.http.plugins: cloudflare
```
**Setup Cloudflare IP list:**
```bash
# Download Cloudflare IP ranges
curl https://www.cloudflare.com/ips-v4 > cloudflare_ips.lst
curl https://www.cloudflare.com/ips-v6 >> cloudflare_ips.lst
```
**What it does:**
- Detects requests from Cloudflare IPs
- Restores original visitor IP from `CF-Connecting-IP` header
- Your application logs show real visitor IPs, not Cloudflare IPs
---
### IP Whitelist Plugin
Restrict access to specific IP addresses:
```yaml
version: "3"
services:
haproxy:
image: byjg/easy-haproxy:4.6.0
volumes:
- /var/run/docker.sock:/var/run/docker.sock
environment:
EASYHAPROXY_DISCOVER: docker
ports:
- "80:80/tcp"
admin_panel:
image: admin-panel:latest
labels:
easyhaproxy.http.host: admin.example.com
easyhaproxy.http.port: 80
easyhaproxy.http.localport: 8080
# Enable IP whitelist
easyhaproxy.http.plugins: ip_whitelist
easyhaproxy.http.plugin.ip_whitelist.allowed_ips: 192.168.1.0/24,10.0.0.5
easyhaproxy.http.plugin.ip_whitelist.status_code: 403
```
**Allowed IP formats:**
- Single IP: `10.0.0.5`
- CIDR range: `192.168.1.0/24`
- Multiple (comma-separated): `192.168.1.0/24,10.0.0.5,172.16.0.100`
**Test:**
```bash
# From allowed IP
curl http://admin.example.com
# Response: Success
# From blocked IP
curl http://admin.example.com
# Response: HTTP 403 Forbidden
```
---
### Multiple Plugins Combined
Combine multiple plugins for enhanced security:
```yaml
version: "3"
services:
haproxy:
image: byjg/easy-haproxy:4.6.0
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- ./cloudflare_ips.lst:/etc/haproxy/cloudflare_ips.lst:ro
environment:
EASYHAPROXY_DISCOVER: docker
ports:
- "80:80/tcp"
- "443:443/tcp"
webapp:
image: webapp:latest
labels:
easyhaproxy.http.host: myapp.example.com
easyhaproxy.http.port: 80
easyhaproxy.http.localport: 8080
# Enable multiple plugins
easyhaproxy.http.plugins: cloudflare,deny_pages
# Block specific paths
easyhaproxy.http.plugin.deny_pages.paths: /admin,/wp-admin,/wp-login.php,/.env
easyhaproxy.http.plugin.deny_pages.status_code: 404
api:
image: api:latest
labels:
easyhaproxy.http.host: api.example.com
easyhaproxy.http.port: 80
easyhaproxy.http.localport: 3000
# Combine JWT + IP whitelist + path blocking
easyhaproxy.http.plugins: jwt_validator,ip_whitelist,deny_pages
easyhaproxy.http.plugin.jwt_validator.algorithm: RS256
easyhaproxy.http.plugin.jwt_validator.issuer: https://auth.example.com/
easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/haproxy/jwt_keys/api.pem
easyhaproxy.http.plugin.ip_whitelist.allowed_ips: 192.168.0.0/16,10.0.0.0/8
easyhaproxy.http.plugin.deny_pages.paths: /internal,/debug
```
**Plugin execution order:**
1. IP Whitelist (blocks non-whitelisted IPs)
2. Deny Pages (blocks specific paths)
3. JWT Validator (validates authentication)
---
## Common Configuration Options ## Common Configuration Options
### Environment Variables (HAProxy Container) ### Environment Variables (HAProxy Container)

60
examples/docker/docker-compose-cloudflare.yml Normal file
View file

@ -0,0 +1,60 @@
# Cloudflare IP Restoration Plugin Example
#
# This example demonstrates restoring original visitor IPs when using Cloudflare CDN
#
# Prerequisites:
# 1. Download Cloudflare IP ranges:
# curl https://www.cloudflare.com/ips-v4 > cloudflare_ips.lst
# curl https://www.cloudflare.com/ips-v6 >> cloudflare_ips.lst
#
# 2. Add to /etc/hosts:
# 127.0.0.1 myapp.local
#
# 3. Start the stack:
# docker compose -f docker-compose-cloudflare.yml up -d
#
# 4. Test (simulating Cloudflare request):
# # Without CF-Connecting-IP header:
# curl -H "Host: myapp.local" http://127.0.0.1/
#
# # With CF-Connecting-IP header (simulating Cloudflare):
# curl -H "Host: myapp.local" -H "CF-Connecting-IP: 203.0.113.50" http://127.0.0.1/
#
# Note: This plugin is most useful when your site is actually behind Cloudflare.
# Without Cloudflare, the request won't come from Cloudflare IPs, so the plugin
# won't activate. This example is for demonstration and testing purposes.
version: "3"
services:
haproxy:
image: byjg/easy-haproxy:4.6.0
volumes:
- /var/run/docker.sock:/var/run/docker.sock
# Mount Cloudflare IP list
- ./cloudflare_ips.lst:/etc/haproxy/cloudflare_ips.lst:ro
environment:
EASYHAPROXY_DISCOVER: docker
HAPROXY_CUSTOMERRORS: "true"
HAPROXY_USERNAME: admin
HAPROXY_PASSWORD: password
HAPROXY_STATS_PORT: 1936
ports:
- "80:80/tcp"
- "1936:1936/tcp"
# Web application behind Cloudflare
webapp:
image: byjg/static-httpserver
environment:
TITLE: "App Behind Cloudflare"
labels:
easyhaproxy.http.host: myapp.local
easyhaproxy.http.port: 80
easyhaproxy.http.localport: 8080
# Enable Cloudflare plugin
easyhaproxy.http.plugins: cloudflare
# Optional: Specify custom IP list path
# easyhaproxy.http.plugin.cloudflare.ip_list_path: /etc/haproxy/cloudflare_ips.lst

57
examples/docker/docker-compose-ip-whitelist.yml Normal file
View file

@ -0,0 +1,57 @@
# IP Whitelist Plugin Example
#
# This example demonstrates restricting access to specific IP addresses
#
# Prerequisites:
# 1. Add to /etc/hosts:
# 127.0.0.1 admin.local
#
# 2. Start the stack:
# docker compose -f docker-compose-ip-whitelist.yml up -d
#
# 3. Test from localhost (127.0.0.1 is whitelisted):
# curl http://admin.local/
# # Response: Success (200 OK)
#
# 4. Test from non-whitelisted IP:
# # You'll need to test from another machine or configure the example
# # with your actual IP address in the allowed_ips label
#
# Note: Update the allowed_ips label with your actual IP addresses/networks
version: "3"
services:
haproxy:
image: byjg/easy-haproxy:4.6.0
volumes:
- /var/run/docker.sock:/var/run/docker.sock
environment:
EASYHAPROXY_DISCOVER: docker
HAPROXY_CUSTOMERRORS: "true"
HAPROXY_USERNAME: admin
HAPROXY_PASSWORD: password
HAPROXY_STATS_PORT: 1936
ports:
- "80:80/tcp"
- "1936:1936/tcp"
# Admin panel with IP whitelist
admin:
image: byjg/static-httpserver
environment:
TITLE: "Admin Panel - IP Restricted"
labels:
easyhaproxy.http.host: admin.local
easyhaproxy.http.port: 80
easyhaproxy.http.localport: 8080
# Enable IP whitelist plugin
easyhaproxy.http.plugins: ip_whitelist
# Allow localhost and private networks
# UPDATE THIS with your actual IPs/networks!
easyhaproxy.http.plugin.ip_whitelist.allowed_ips: 127.0.0.1,192.168.0.0/16,10.0.0.0/8,172.16.0.0/12
# Status code to return for blocked IPs
easyhaproxy.http.plugin.ip_whitelist.status_code: 403

66
examples/docker/docker-compose-jwt-validator.yml Normal file
View file

@ -0,0 +1,66 @@
# JWT Validator Plugin Example
#
# This example demonstrates JWT token validation for API protection
#
# Prerequisites:
# 1. Generate RSA key pair:
# openssl genrsa -out jwt_private.pem 2048
# openssl rsa -in jwt_private.pem -pubout -out jwt_pubkey.pem
#
# 2. Add to /etc/hosts:
# 127.0.0.1 api.local
#
# 3. Start the stack:
# docker compose -f docker-compose-jwt-validator.yml up -d
#
# 4. Test without token (should fail):
# curl http://api.local/
# # Response: Missing Authorization HTTP header
#
# 5. Generate test JWT at https://jwt.io with:
# - Algorithm: RS256
# - Payload: {"iss":"https://auth.example.com/","aud":"https://api.example.com","exp":9999999999}
# - Use your jwt_private.pem for signing
#
# 6. Test with token:
# TOKEN="eyJhbGc..."
# curl -H "Authorization: Bearer $TOKEN" http://api.local/
# # Response: Success
version: "3"
services:
haproxy:
image: byjg/easy-haproxy:4.6.0
volumes:
- /var/run/docker.sock:/var/run/docker.sock
# Mount the public key for JWT verification
- ./jwt_pubkey.pem:/etc/haproxy/jwt_keys/api_pubkey.pem:ro
environment:
EASYHAPROXY_DISCOVER: docker
HAPROXY_CUSTOMERRORS: "true"
HAPROXY_USERNAME: admin
HAPROXY_PASSWORD: password
HAPROXY_STATS_PORT: 1936
ports:
- "80:80/tcp"
- "1936:1936/tcp"
# API service protected by JWT
api:
image: byjg/static-httpserver
environment:
TITLE: "Protected API - JWT Required"
labels:
easyhaproxy.http.host: api.local
easyhaproxy.http.port: 80
easyhaproxy.http.localport: 8080
# Enable JWT validator plugin
easyhaproxy.http.plugins: jwt_validator
# JWT validator configuration
easyhaproxy.http.plugin.jwt_validator.algorithm: RS256
easyhaproxy.http.plugin.jwt_validator.issuer: https://auth.example.com/
easyhaproxy.http.plugin.jwt_validator.audience: https://api.example.com/
easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem

106
examples/docker/docker-compose-plugins-combined.yml Normal file
View file

@ -0,0 +1,106 @@
# Multiple Plugins Combined Example
#
# This example demonstrates using multiple plugins together for enhanced security
#
# Prerequisites:
# 1. Generate JWT keys:
# openssl genrsa -out jwt_private.pem 2048
# openssl rsa -in jwt_private.pem -pubout -out jwt_pubkey.pem
#
# 2. Download Cloudflare IPs:
# curl https://www.cloudflare.com/ips-v4 > cloudflare_ips.lst
# curl https://www.cloudflare.com/ips-v6 >> cloudflare_ips.lst
#
# 3. Add to /etc/hosts:
# 127.0.0.1 website.local api.local admin.local
#
# 4. Start the stack:
# docker compose -f docker-compose-plugins-combined.yml up -d
#
# 5. Test each service:
# # Public website (Cloudflare + path blocking)
# curl http://website.local/
# curl http://website.local/admin # Should be blocked (404)
#
# # Protected API (JWT required)
# curl http://api.local/ # Should fail - no JWT
# curl -H "Authorization: Bearer <token>" http://api.local/ # Success
#
# # Admin panel (IP whitelist only)
# curl http://admin.local/ # Success from localhost
version: "3"
services:
haproxy:
image: byjg/easy-haproxy:4.6.0
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- ./cloudflare_ips.lst:/etc/haproxy/cloudflare_ips.lst:ro
- ./jwt_pubkey.pem:/etc/haproxy/jwt_keys/api_pubkey.pem:ro
environment:
EASYHAPROXY_DISCOVER: docker
HAPROXY_CUSTOMERRORS: "true"
HAPROXY_USERNAME: admin
HAPROXY_PASSWORD: password
HAPROXY_STATS_PORT: 1936
ports:
- "80:80/tcp"
- "1936:1936/tcp"
# Public website with Cloudflare + path blocking
website:
image: byjg/static-httpserver
environment:
TITLE: "Public Website"
labels:
easyhaproxy.http.host: website.local
easyhaproxy.http.port: 80
easyhaproxy.http.localport: 8080
# Combine Cloudflare IP restoration + deny pages
easyhaproxy.http.plugins: cloudflare,deny_pages
# Block admin paths, config files, etc.
easyhaproxy.http.plugin.deny_pages.paths: /admin,/wp-admin,/wp-login.php,/.env,/config
easyhaproxy.http.plugin.deny_pages.status_code: 404
# Protected API with JWT validation + path blocking
api:
image: byjg/static-httpserver
environment:
TITLE: "Protected API"
labels:
easyhaproxy.http.host: api.local
easyhaproxy.http.port: 80
easyhaproxy.http.localport: 8080
# JWT validation + block internal endpoints
easyhaproxy.http.plugins: jwt_validator,deny_pages
# JWT configuration
easyhaproxy.http.plugin.jwt_validator.algorithm: RS256
easyhaproxy.http.plugin.jwt_validator.issuer: https://auth.example.com/
easyhaproxy.http.plugin.jwt_validator.audience: https://api.example.com
easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
# Block internal/debug endpoints
easyhaproxy.http.plugin.deny_pages.paths: /internal,/debug,/metrics
easyhaproxy.http.plugin.deny_pages.status_code: 403
# Admin panel with strict IP restrictions
admin:
image: byjg/static-httpserver
environment:
TITLE: "Admin Panel"
labels:
easyhaproxy.http.host: admin.local
easyhaproxy.http.port: 80
easyhaproxy.http.localport: 8080
# IP whitelist only (strictest security)
easyhaproxy.http.plugins: ip_whitelist
# Only allow local and private networks
easyhaproxy.http.plugin.ip_whitelist.allowed_ips: 127.0.0.1,192.168.0.0/16,10.0.0.0/8
easyhaproxy.http.plugin.ip_whitelist.status_code: 403

269
examples/kubernetes/README.md
View file

@ -288,6 +288,275 @@ See [Using Plugins with Kubernetes](../../docs/kubernetes.md#using-plugins-with-
--- ---
## Plugin Examples
### JWT Validator Plugin
Complete example with JWT validation for API protection:
```yaml
---
# Create ConfigMap with public key
apiVersion: v1
kind: ConfigMap
metadata:
name: jwt-keys
namespace: default
data:
api_pubkey.pem: |
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...
-----END PUBLIC KEY-----
---
# Mount public key into EasyHAProxy pod
# Add this to your EasyHAProxy deployment:
# volumeMounts:
# - name: jwt-keys
# mountPath: /etc/haproxy/jwt_keys
# volumes:
# - name: jwt-keys
# configMap:
# name: jwt-keys
---
apiVersion: v1
kind: Service
metadata:
name: api-service
namespace: default
spec:
ports:
- port: 8080
selector:
app: api
type: ClusterIP
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: api
namespace: default
spec:
replicas: 3
selector:
matchLabels:
app: api
template:
metadata:
labels:
app: api
spec:
containers:
- name: api
image: my-api:latest
ports:
- containerPort: 8080
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
kubernetes.io/ingress.class: easyhaproxy-ingress
# Enable JWT validator
easyhaproxy.plugins: "jwt_validator"
easyhaproxy.plugin.jwt_validator.algorithm: "RS256"
easyhaproxy.plugin.jwt_validator.issuer: "https://auth.example.com/"
easyhaproxy.plugin.jwt_validator.audience: "https://api.example.com"
easyhaproxy.plugin.jwt_validator.pubkey_path: "/etc/haproxy/jwt_keys/api_pubkey.pem"
name: api-ingress
namespace: default
spec:
rules:
- host: api.example.com
http:
paths:
- backend:
service:
name: api-service
port:
number: 8080
pathType: ImplementationSpecific
```
**Test:**
```bash
# Without JWT token - should fail
curl http://api.example.com/users
# Response: Missing Authorization HTTP header
# With valid JWT token
TOKEN="eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."
curl -H "Authorization: Bearer $TOKEN" http://api.example.com/users
# Response: Success
```
---
### Cloudflare IP Restoration Plugin
Restore original visitor IPs when behind Cloudflare:
```yaml
---
# Create ConfigMap with Cloudflare IP ranges
apiVersion: v1
kind: ConfigMap
metadata:
name: cloudflare-ips
namespace: easyhaproxy
data:
cloudflare_ips.lst: |
173.245.48.0/20
103.21.244.0/22
103.22.200.0/22
103.31.4.0/22
141.101.64.0/18
108.162.192.0/18
190.93.240.0/20
188.114.96.0/20
197.234.240.0/22
198.41.128.0/17
162.158.0.0/15
104.16.0.0/13
104.24.0.0/14
172.64.0.0/13
131.0.72.0/22
---
# Mount ConfigMap into EasyHAProxy pod
# Add this to your EasyHAProxy deployment:
# volumeMounts:
# - name: cloudflare-ips
# mountPath: /etc/haproxy/cloudflare_ips.lst
# subPath: cloudflare_ips.lst
# volumes:
# - name: cloudflare-ips
# configMap:
# name: cloudflare-ips
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
kubernetes.io/ingress.class: easyhaproxy-ingress
# Enable Cloudflare plugin
easyhaproxy.plugins: "cloudflare"
name: webapp-ingress
namespace: default
spec:
rules:
- host: myapp.example.com
http:
paths:
- backend:
service:
name: webapp-service
port:
number: 8080
pathType: ImplementationSpecific
```
**Download latest Cloudflare IPs:**
```bash
curl https://www.cloudflare.com/ips-v4
curl https://www.cloudflare.com/ips-v6
```
---
### IP Whitelist Plugin
Restrict admin panel to office IPs only:
```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
kubernetes.io/ingress.class: easyhaproxy-ingress
# Enable IP whitelist
easyhaproxy.plugins: "ip_whitelist"
easyhaproxy.plugin.ip_whitelist.allowed_ips: "203.0.113.0/24,198.51.100.42"
easyhaproxy.plugin.ip_whitelist.status_code: "403"
name: admin-ingress
namespace: default
spec:
rules:
- host: admin.example.com
http:
paths:
- backend:
service:
name: admin-service
port:
number: 8080
pathType: ImplementationSpecific
```
**Test:**
```bash
# From allowed IP (203.0.113.50)
curl http://admin.example.com
# Response: Success
# From blocked IP
curl http://admin.example.com
# Response: HTTP 403 Forbidden
```
---
### Multiple Plugins Combined
Combine Cloudflare + JWT + Path Blocking for maximum security:
```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
kubernetes.io/ingress.class: easyhaproxy-ingress
# Enable multiple plugins
easyhaproxy.plugins: "cloudflare,jwt_validator,deny_pages"
# Cloudflare - restore real IPs
# (no config needed if using default path)
# JWT Validator - validate tokens
easyhaproxy.plugin.jwt_validator.algorithm: "RS256"
easyhaproxy.plugin.jwt_validator.issuer: "https://auth.example.com/"
easyhaproxy.plugin.jwt_validator.audience: "https://api.example.com"
easyhaproxy.plugin.jwt_validator.pubkey_path: "/etc/haproxy/jwt_keys/api_pubkey.pem"
# Deny Pages - block sensitive paths
easyhaproxy.plugin.deny_pages.paths: "/internal,/debug,/admin"
easyhaproxy.plugin.deny_pages.status_code: "404"
name: secure-api-ingress
namespace: production
spec:
rules:
- host: api.example.com
http:
paths:
- backend:
service:
name: api-service
port:
number: 8080
pathType: ImplementationSpecific
```
**Plugin execution order:**
1. Cloudflare IP restoration (sets correct visitor IP)
2. Deny Pages (blocks blacklisted paths)
3. JWT Validator (validates authentication)
---
## Creating SSL Secrets ## Creating SSL Secrets
### From Certificate Files ### From Certificate Files

103
examples/kubernetes/cloudflare.yml Normal file
View file

@ -0,0 +1,103 @@
# Cloudflare IP Restoration Plugin Example for Kubernetes
#
# This example demonstrates restoring original visitor IPs when using Cloudflare CDN
#
# Prerequisites:
# 1. EasyHAProxy installed in your cluster
#
# 2. Download Cloudflare IP ranges and create ConfigMap:
# curl https://www.cloudflare.com/ips-v4 > cloudflare_ips.lst
# curl https://www.cloudflare.com/ips-v6 >> cloudflare_ips.lst
# kubectl create configmap cloudflare-ips \
# --from-file=cloudflare_ips.lst=cloudflare_ips.lst \
# -n easyhaproxy
#
# 3. Mount the ConfigMap in EasyHAProxy deployment (add to volumeMounts and volumes):
# volumeMounts:
# - name: cloudflare-ips
# mountPath: /etc/haproxy/cloudflare_ips.lst
# subPath: cloudflare_ips.lst
# volumes:
# - name: cloudflare-ips
# configMap:
# name: cloudflare-ips
#
# 4. Apply this manifest:
# kubectl apply -f cloudflare.yml
#
# 5. Test:
# curl http://myapp.example.local/
#
# Note: This plugin is most useful when your site is actually behind Cloudflare.
---
apiVersion: v1
kind: Service
metadata:
name: webapp-service
namespace: default
spec:
ports:
- port: 8080
targetPort: 8080
selector:
app: webapp
type: ClusterIP
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: webapp
namespace: default
spec:
replicas: 3
selector:
matchLabels:
app: webapp
template:
metadata:
labels:
app: webapp
spec:
containers:
- name: webapp
image: byjg/static-httpserver
ports:
- containerPort: 8080
env:
- name: TITLE
value: "App Behind Cloudflare"
resources:
limits:
cpu: '0.1'
memory: '64Mi'
requests:
cpu: '0.05'
memory: '32Mi'
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
kubernetes.io/ingress.class: easyhaproxy-ingress
# Enable Cloudflare plugin
easyhaproxy.plugins: "cloudflare"
# Optional: Specify custom IP list path
# easyhaproxy.plugin.cloudflare.ip_list_path: "/etc/haproxy/cloudflare_ips.lst"
name: webapp-ingress-cloudflare
namespace: default
spec:
rules:
- host: myapp.example.local
http:
paths:
- backend:
service:
name: webapp-service
port:
number: 8080
pathType: ImplementationSpecific

96
examples/kubernetes/ip-whitelist.yml Normal file
View file

@ -0,0 +1,96 @@
# IP Whitelist Plugin Example for Kubernetes
#
# This example demonstrates restricting access to specific IP addresses
#
# Prerequisites:
# 1. EasyHAProxy installed in your cluster
#
# 2. Update the allowed_ips annotation with your actual IP addresses/networks
#
# 3. Apply this manifest:
# kubectl apply -f ip-whitelist.yml
#
# 4. Test from allowed IP:
# curl http://admin.example.local/
# # Response: Success (200 OK)
#
# 5. Test from non-allowed IP:
# # Response: HTTP 403 Forbidden
#
# Note: Update the allowed_ips annotation with your actual office/VPN IPs
---
apiVersion: v1
kind: Service
metadata:
name: admin-service
namespace: default
spec:
ports:
- port: 8080
targetPort: 8080
selector:
app: admin
type: ClusterIP
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: admin
namespace: default
spec:
replicas: 2
selector:
matchLabels:
app: admin
template:
metadata:
labels:
app: admin
spec:
containers:
- name: admin
image: byjg/static-httpserver
ports:
- containerPort: 8080
env:
- name: TITLE
value: "Admin Panel - IP Restricted"
resources:
limits:
cpu: '0.1'
memory: '64Mi'
requests:
cpu: '0.05'
memory: '32Mi'
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
kubernetes.io/ingress.class: easyhaproxy-ingress
# Enable IP whitelist plugin
easyhaproxy.plugins: "ip_whitelist"
# Allow specific IPs and networks
# UPDATE THIS with your actual office/VPN IPs!
easyhaproxy.plugin.ip_whitelist.allowed_ips: "203.0.113.0/24,198.51.100.42,10.0.0.0/8"
# Status code to return for blocked IPs
easyhaproxy.plugin.ip_whitelist.status_code: "403"
name: admin-ingress-whitelist
namespace: default
spec:
rules:
- host: admin.example.local
http:
paths:
- backend:
service:
name: admin-service
port:
number: 8080
pathType: ImplementationSpecific

113
examples/kubernetes/jwt-validator.yml Normal file
View file

@ -0,0 +1,113 @@
# JWT Validator Plugin Example for Kubernetes
#
# This example demonstrates JWT token validation for API protection in Kubernetes
#
# Prerequisites:
# 1. EasyHAProxy installed in your cluster
# 2. Generate RSA key pair:
# openssl genrsa -out jwt_private.pem 2048
# openssl rsa -in jwt_private.pem -pubout -out jwt_pubkey.pem
#
# 3. Create ConfigMap with public key:
# kubectl create configmap jwt-keys --from-file=api_pubkey.pem=jwt_pubkey.pem
#
# 4. Mount the ConfigMap in EasyHAProxy deployment (add to volumeMounts and volumes):
# volumeMounts:
# - name: jwt-keys
# mountPath: /etc/haproxy/jwt_keys
# volumes:
# - name: jwt-keys
# configMap:
# name: jwt-keys
#
# 5. Apply this manifest:
# kubectl apply -f jwt-validator.yml
#
# 6. Test without token (should fail):
# curl http://api.example.local/
# # Response: Missing Authorization HTTP header
#
# 7. Generate test JWT at https://jwt.io with:
# - Algorithm: RS256
# - Payload: {"iss":"https://auth.example.com/","aud":"https://api.example.com","exp":9999999999}
# - Use your jwt_private.pem for signing
#
# 8. Test with token:
# TOKEN="eyJhbGc..."
# curl -H "Authorization: Bearer $TOKEN" http://api.example.local/
# # Response: Success
---
apiVersion: v1
kind: Service
metadata:
name: api-service
namespace: default
spec:
ports:
- port: 8080
targetPort: 8080
selector:
app: api
type: ClusterIP
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: api
namespace: default
spec:
replicas: 3
selector:
matchLabels:
app: api
template:
metadata:
labels:
app: api
spec:
containers:
- name: api
image: byjg/static-httpserver
ports:
- containerPort: 8080
env:
- name: TITLE
value: "Protected API - JWT Required"
resources:
limits:
cpu: '0.1'
memory: '64Mi'
requests:
cpu: '0.05'
memory: '32Mi'
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
kubernetes.io/ingress.class: easyhaproxy-ingress
# Enable JWT validator plugin
easyhaproxy.plugins: "jwt_validator"
# JWT validator configuration
easyhaproxy.plugin.jwt_validator.algorithm: "RS256"
easyhaproxy.plugin.jwt_validator.issuer: "https://auth.example.com/"
easyhaproxy.plugin.jwt_validator.audience: "https://api.example.com"
easyhaproxy.plugin.jwt_validator.pubkey_path: "/etc/haproxy/jwt_keys/api_pubkey.pem"
name: api-ingress-jwt
namespace: default
spec:
rules:
- host: api.example.local
http:
paths:
- backend:
service:
name: api-service
port:
number: 8080
pathType: ImplementationSpecific

233
examples/kubernetes/plugins-combined.yml Normal file
View file

@ -0,0 +1,233 @@
# Multiple Plugins Combined Example for Kubernetes
#
# This example demonstrates using multiple plugins together for enhanced security
#
# Prerequisites:
# 1. EasyHAProxy installed in your cluster
#
# 2. Generate JWT keys and create ConfigMap:
# openssl genrsa -out jwt_private.pem 2048
# openssl rsa -in jwt_private.pem -pubout -out jwt_pubkey.pem
# kubectl create configmap jwt-keys --from-file=api_pubkey.pem=jwt_pubkey.pem
#
# 3. Download Cloudflare IPs and create ConfigMap:
# curl https://www.cloudflare.com/ips-v4 > cloudflare_ips.lst
# curl https://www.cloudflare.com/ips-v6 >> cloudflare_ips.lst
# kubectl create configmap cloudflare-ips \
# --from-file=cloudflare_ips.lst=cloudflare_ips.lst \
# -n easyhaproxy
#
# 4. Mount ConfigMaps in EasyHAProxy deployment
#
# 5. Apply this manifest:
# kubectl apply -f plugins-combined.yml
#
# This creates three services with different security profiles:
# - Public website: Cloudflare + path blocking
# - Protected API: JWT validation + path blocking
# - Admin panel: Strict IP whitelist
---
# Public website service
apiVersion: v1
kind: Service
metadata:
name: website-service
namespace: default
spec:
ports:
- port: 8080
selector:
app: website
type: ClusterIP
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: website
namespace: default
spec:
replicas: 3
selector:
matchLabels:
app: website
template:
metadata:
labels:
app: website
spec:
containers:
- name: website
image: byjg/static-httpserver
env:
- name: TITLE
value: "Public Website"
resources:
requests:
cpu: '0.05'
memory: '32Mi'
---
# Public website ingress with Cloudflare + path blocking
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
kubernetes.io/ingress.class: easyhaproxy-ingress
# Cloudflare IP restoration + deny pages
easyhaproxy.plugins: "cloudflare,deny_pages"
easyhaproxy.plugin.deny_pages.paths: "/admin,/wp-admin,/wp-login.php,/.env,/config"
easyhaproxy.plugin.deny_pages.status_code: "404"
name: website-ingress
namespace: default
spec:
rules:
- host: website.example.local
http:
paths:
- backend:
service:
name: website-service
port:
number: 8080
pathType: ImplementationSpecific
---
# API service
apiVersion: v1
kind: Service
metadata:
name: api-service
namespace: default
spec:
ports:
- port: 8080
selector:
app: api
type: ClusterIP
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: api
namespace: default
spec:
replicas: 5
selector:
matchLabels:
app: api
template:
metadata:
labels:
app: api
spec:
containers:
- name: api
image: byjg/static-httpserver
env:
- name: TITLE
value: "Protected API"
resources:
requests:
cpu: '0.05'
memory: '32Mi'
---
# API ingress with JWT + path blocking
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
kubernetes.io/ingress.class: easyhaproxy-ingress
# JWT validation + block internal endpoints
easyhaproxy.plugins: "jwt_validator,deny_pages"
# JWT config
easyhaproxy.plugin.jwt_validator.algorithm: "RS256"
easyhaproxy.plugin.jwt_validator.issuer: "https://auth.example.com/"
easyhaproxy.plugin.jwt_validator.audience: "https://api.example.com"
easyhaproxy.plugin.jwt_validator.pubkey_path: "/etc/haproxy/jwt_keys/api_pubkey.pem"
# Block internal paths
easyhaproxy.plugin.deny_pages.paths: "/internal,/debug,/metrics"
easyhaproxy.plugin.deny_pages.status_code: "403"
name: api-ingress
namespace: default
spec:
rules:
- host: api.example.local
http:
paths:
- backend:
service:
name: api-service
port:
number: 8080
pathType: ImplementationSpecific
---
# Admin service
apiVersion: v1
kind: Service
metadata:
name: admin-service
namespace: default
spec:
ports:
- port: 8080
selector:
app: admin
type: ClusterIP
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: admin
namespace: default
spec:
replicas: 2
selector:
matchLabels:
app: admin
template:
metadata:
labels:
app: admin
spec:
containers:
- name: admin
image: byjg/static-httpserver
env:
- name: TITLE
value: "Admin Panel"
resources:
requests:
cpu: '0.05'
memory: '32Mi'
---
# Admin ingress with strict IP whitelist
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
kubernetes.io/ingress.class: easyhaproxy-ingress
# IP whitelist only (strictest security)
easyhaproxy.plugins: "ip_whitelist"
# UPDATE with your office/VPN IPs!
easyhaproxy.plugin.ip_whitelist.allowed_ips: "203.0.113.0/24,10.0.0.0/8"
easyhaproxy.plugin.ip_whitelist.status_code: "403"
name: admin-ingress
namespace: default
spec:
rules:
- host: admin.example.local
http:
paths:
- backend:
service:
name: admin-service
port:
number: 8080
pathType: ImplementationSpecific

286
examples/swarm/README.md
View file

@ -324,6 +324,292 @@ networks:
--- ---
## Plugin Examples
### JWT Validator Plugin
Secure your API with JWT token validation in Swarm:
```yaml
version: "3"
services:
haproxy:
image: byjg/easy-haproxy:4.6.0
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- jwt_keys:/etc/haproxy/jwt_keys
deploy:
replicas: 1
environment:
EASYHAPROXY_DISCOVER: swarm
ports:
- "80:80/tcp"
- "443:443/tcp"
networks:
- easyhaproxy
api:
image: my-api:latest
deploy:
replicas: 5
labels:
easyhaproxy.http.host: "api.example.com"
easyhaproxy.http.port: "80"
easyhaproxy.http.localport: "8080"
# Enable JWT validation
easyhaproxy.http.plugins: "jwt_validator"
easyhaproxy.http.plugin.jwt_validator.algorithm: "RS256"
easyhaproxy.http.plugin.jwt_validator.issuer: "https://auth.example.com/"
easyhaproxy.http.plugin.jwt_validator.audience: "https://api.example.com"
easyhaproxy.http.plugin.jwt_validator.pubkey_path: "/etc/haproxy/jwt_keys/api_pubkey.pem"
networks:
- easyhaproxy
networks:
easyhaproxy:
external: true
volumes:
jwt_keys:
```
**Deploy public key using Docker config:**
```bash
# Create Docker config with public key
docker config create jwt_api_pubkey ./api_pubkey.pem
# Update EasyHAProxy service to use config
docker service update \
--config-add source=jwt_api_pubkey,target=/etc/haproxy/jwt_keys/api_pubkey.pem \
easyhaproxy_haproxy
```
**Test:**
```bash
# Without token
curl http://api.example.com/users
# Response: Missing Authorization HTTP header
# With valid token
curl -H "Authorization: Bearer eyJhbGc..." http://api.example.com/users
# Response: Success
```
---
### Cloudflare IP Restoration Plugin
Restore original visitor IPs in Swarm environment:
```yaml
version: "3"
services:
haproxy:
image: byjg/easy-haproxy:4.6.0
volumes:
- /var/run/docker.sock:/var/run/docker.sock
configs:
- source: cloudflare_ips
target: /etc/haproxy/cloudflare_ips.lst
deploy:
replicas: 1
environment:
EASYHAPROXY_DISCOVER: swarm
ports:
- "80:80/tcp"
- "443:443/tcp"
networks:
- easyhaproxy
webapp:
image: webapp:latest
deploy:
replicas: 3
labels:
easyhaproxy.http.host: "myapp.example.com"
easyhaproxy.http.port: "80"
easyhaproxy.http.localport: "8080"
# Enable Cloudflare plugin
easyhaproxy.http.plugins: "cloudflare"
networks:
- easyhaproxy
networks:
easyhaproxy:
external: true
configs:
cloudflare_ips:
file: ./cloudflare_ips.lst
```
**Create Cloudflare IP list:**
```bash
# Download Cloudflare IPs
curl https://www.cloudflare.com/ips-v4 > cloudflare_ips.lst
curl https://www.cloudflare.com/ips-v6 >> cloudflare_ips.lst
# Deploy stack
docker stack deploy -c cloudflare-stack.yml myapp
```
---
### IP Whitelist Plugin
Restrict admin panel to specific IPs in Swarm:
```yaml
version: "3"
services:
admin:
image: admin-panel:latest
deploy:
replicas: 2
labels:
easyhaproxy.http.host: "admin.example.com"
easyhaproxy.http.port: "80"
easyhaproxy.http.localport: "4000"
# Enable IP whitelist
easyhaproxy.http.plugins: "ip_whitelist"
# Allow office network and VPN
easyhaproxy.http.plugin.ip_whitelist.allowed_ips: "203.0.113.0/24,198.51.100.0/24,10.8.0.0/16"
easyhaproxy.http.plugin.ip_whitelist.status_code: "403"
networks:
- easyhaproxy
networks:
easyhaproxy:
external: true
```
**Test:**
```bash
# From office IP (203.0.113.50)
curl http://admin.example.com
# Response: Success
# From home/blocked IP
curl http://admin.example.com
# Response: HTTP 403 Forbidden
```
---
### Multiple Plugins Combined
Production-ready setup with multiple security layers:
```yaml
version: "3"
services:
haproxy:
image: byjg/easy-haproxy:4.6.0
volumes:
- /var/run/docker.sock:/var/run/docker.sock
configs:
- source: cloudflare_ips
target: /etc/haproxy/cloudflare_ips.lst
- source: jwt_pubkey
target: /etc/haproxy/jwt_keys/api_pubkey.pem
deploy:
replicas: 1
placement:
constraints:
- node.role == manager
environment:
EASYHAPROXY_DISCOVER: swarm
EASYHAPROXY_SSL_MODE: "loose"
EASYHAPROXY_CERTBOT_EMAIL: admin@example.com
ports:
- "80:80/tcp"
- "443:443/tcp"
- "1936:1936/tcp"
networks:
- easyhaproxy
# Public website with Cloudflare
website:
image: website:latest
deploy:
replicas: 4
labels:
easyhaproxy.http.host: "example.com"
easyhaproxy.http.port: "80"
easyhaproxy.http.localport: "3000"
easyhaproxy.http.certbot: "true"
easyhaproxy.http.redirect_ssl: "true"
# Cloudflare + block sensitive paths
easyhaproxy.http.plugins: "cloudflare,deny_pages"
easyhaproxy.http.plugin.deny_pages.paths: "/admin,/.env,/config"
easyhaproxy.http.plugin.deny_pages.status_code: "404"
networks:
- easyhaproxy
# Authenticated API with JWT
api:
image: api:latest
deploy:
replicas: 6
labels:
easyhaproxy.http.host: "api.example.com"
easyhaproxy.http.port: "80"
easyhaproxy.http.localport: "8080"
easyhaproxy.http.certbot: "true"
# Cloudflare + JWT + block internal endpoints
easyhaproxy.http.plugins: "cloudflare,jwt_validator,deny_pages"
easyhaproxy.http.plugin.jwt_validator.algorithm: "RS256"
easyhaproxy.http.plugin.jwt_validator.issuer: "https://auth.example.com/"
easyhaproxy.http.plugin.jwt_validator.audience: "https://api.example.com"
easyhaproxy.http.plugin.jwt_validator.pubkey_path: "/etc/haproxy/jwt_keys/api_pubkey.pem"
easyhaproxy.http.plugin.deny_pages.paths: "/internal,/metrics"
networks:
- easyhaproxy
# Admin panel with strict IP restrictions
admin:
image: admin:latest
deploy:
replicas: 2
labels:
easyhaproxy.http.host: "admin.example.com"
easyhaproxy.http.port: "80"
easyhaproxy.http.localport: "4000"
easyhaproxy.http.certbot: "true"
# IP whitelist only (no public access)
easyhaproxy.http.plugins: "ip_whitelist"
easyhaproxy.http.plugin.ip_whitelist.allowed_ips: "203.0.113.0/24"
easyhaproxy.http.plugin.ip_whitelist.status_code: "403"
networks:
- easyhaproxy
networks:
easyhaproxy:
external: true
configs:
cloudflare_ips:
file: ./cloudflare_ips.lst
jwt_pubkey:
file: ./api_pubkey.pem
```
**Deploy:**
```bash
docker stack deploy -c production-stack.yml production
```
**Security layers:**
- **Website**: Cloudflare IP restoration + path blocking
- **API**: Cloudflare + JWT validation + internal path blocking
- **Admin**: Strict IP whitelist (office network only)
---
## Scaling Services ## Scaling Services
Scale services dynamically: Scale services dynamically:

78
examples/swarm/cloudflare.yml Normal file
View file

@ -0,0 +1,78 @@
# Cloudflare IP Restoration Plugin Example for Docker Swarm
#
# This example demonstrates restoring original visitor IPs when using Cloudflare CDN
#
# Prerequisites:
# 1. Docker Swarm initialized:
# docker swarm init
#
# 2. Create overlay network:
# docker network create --driver overlay --attachable easyhaproxy
#
# 3. Download Cloudflare IPs and create Docker config:
# curl https://www.cloudflare.com/ips-v4 > cloudflare_ips.lst
# curl https://www.cloudflare.com/ips-v6 >> cloudflare_ips.lst
# docker config create cloudflare_ips cloudflare_ips.lst
#
# 4. Deploy the stack:
# docker stack deploy -c cloudflare.yml webapp
#
# 5. Test:
# curl http://<swarm-ip>/
#
# Note: This plugin is most useful when your site is actually behind Cloudflare.
version: "3.7"
services:
haproxy:
image: byjg/easy-haproxy:4.6.0
volumes:
- /var/run/docker.sock:/var/run/docker.sock
configs:
- source: cloudflare_ips
target: /etc/haproxy/cloudflare_ips.lst
deploy:
replicas: 1
placement:
constraints:
- node.role == manager
environment:
EASYHAPROXY_DISCOVER: swarm
HAPROXY_USERNAME: admin
HAPROXY_PASSWORD: password
HAPROXY_STATS_PORT: 1936
ports:
- "80:80/tcp"
- "443:443/tcp"
- "1936:1936/tcp"
networks:
- easyhaproxy
# Web application behind Cloudflare
webapp:
image: byjg/static-httpserver
environment:
TITLE: "App Behind Cloudflare"
deploy:
replicas: 4
labels:
easyhaproxy.http.host: "myapp.example.com"
easyhaproxy.http.port: "80"
easyhaproxy.http.localport: "8080"
# Enable Cloudflare plugin
easyhaproxy.http.plugins: "cloudflare"
# Optional: Specify custom IP list path
# easyhaproxy.http.plugin.cloudflare.ip_list_path: "/etc/haproxy/cloudflare_ips.lst"
networks:
- easyhaproxy
networks:
easyhaproxy:
external: true
configs:
cloudflare_ips:
external: true

73
examples/swarm/ip-whitelist.yml Normal file
View file

@ -0,0 +1,73 @@
# IP Whitelist Plugin Example for Docker Swarm
#
# This example demonstrates restricting access to specific IP addresses in Swarm
#
# Prerequisites:
# 1. Docker Swarm initialized:
# docker swarm init
#
# 2. Create overlay network:
# docker network create --driver overlay --attachable easyhaproxy
#
# 3. Update allowed_ips label with your actual IP addresses/networks
#
# 4. Deploy the stack:
# docker stack deploy -c ip-whitelist.yml admin
#
# 5. Test from allowed IP:
# curl http://<swarm-ip>/
# # Response: Success (200 OK)
#
# 6. Test from non-allowed IP:
# # Response: HTTP 403 Forbidden
version: "3.7"
services:
haproxy:
image: byjg/easy-haproxy:4.6.0
volumes:
- /var/run/docker.sock:/var/run/docker.sock
deploy:
replicas: 1
placement:
constraints:
- node.role == manager
environment:
EASYHAPROXY_DISCOVER: swarm
HAPROXY_USERNAME: admin
HAPROXY_PASSWORD: password
HAPROXY_STATS_PORT: 1936
ports:
- "80:80/tcp"
- "1936:1936/tcp"
networks:
- easyhaproxy
# Admin panel with IP restrictions
admin:
image: byjg/static-httpserver
environment:
TITLE: "Admin Panel - IP Restricted"
deploy:
replicas: 3
labels:
easyhaproxy.http.host: "admin.example.com"
easyhaproxy.http.port: "80"
easyhaproxy.http.localport: "8080"
# Enable IP whitelist plugin
easyhaproxy.http.plugins: "ip_whitelist"
# Allow specific IPs and networks
# UPDATE THIS with your actual office/VPN IPs!
easyhaproxy.http.plugin.ip_whitelist.allowed_ips: "203.0.113.0/24,198.51.100.0/24,10.0.0.0/8"
# Status code to return for blocked IPs
easyhaproxy.http.plugin.ip_whitelist.status_code: "403"
networks:
- easyhaproxy
networks:
easyhaproxy:
external: true

89
examples/swarm/jwt-validator.yml Normal file
View file

@ -0,0 +1,89 @@
# JWT Validator Plugin Example for Docker Swarm
#
# This example demonstrates JWT token validation for API protection in Swarm
#
# Prerequisites:
# 1. Docker Swarm initialized:
# docker swarm init
#
# 2. Create overlay network:
# docker network create --driver overlay --attachable easyhaproxy
#
# 3. Generate JWT keys and create Docker config:
# openssl genrsa -out jwt_private.pem 2048
# openssl rsa -in jwt_private.pem -pubout -out jwt_pubkey.pem
# docker config create jwt_api_pubkey jwt_pubkey.pem
#
# 4. Deploy the stack:
# docker stack deploy -c jwt-validator.yml api
#
# 5. Test without token (should fail):
# curl http://<swarm-ip>/
# # Response: Missing Authorization HTTP header
#
# 6. Generate test JWT at https://jwt.io with:
# - Algorithm: RS256
# - Payload: {"iss":"https://auth.example.com/","aud":"https://api.example.com","exp":9999999999}
# - Use your jwt_private.pem for signing
#
# 7. Test with token:
# TOKEN="eyJhbGc..."
# curl -H "Authorization: Bearer $TOKEN" http://<swarm-ip>/
# # Response: Success
version: "3.7"
services:
haproxy:
image: byjg/easy-haproxy:4.6.0
volumes:
- /var/run/docker.sock:/var/run/docker.sock
configs:
- source: jwt_api_pubkey
target: /etc/haproxy/jwt_keys/api_pubkey.pem
deploy:
replicas: 1
placement:
constraints:
- node.role == manager
environment:
EASYHAPROXY_DISCOVER: swarm
HAPROXY_USERNAME: admin
HAPROXY_PASSWORD: password
HAPROXY_STATS_PORT: 1936
ports:
- "80:80/tcp"
- "1936:1936/tcp"
networks:
- easyhaproxy
# Protected API service
api:
image: byjg/static-httpserver
environment:
TITLE: "Protected API - JWT Required"
deploy:
replicas: 5
labels:
easyhaproxy.http.host: "api.example.com"
easyhaproxy.http.port: "80"
easyhaproxy.http.localport: "8080"
# Enable JWT validator plugin
easyhaproxy.http.plugins: "jwt_validator"
# JWT validator configuration
easyhaproxy.http.plugin.jwt_validator.algorithm: "RS256"
easyhaproxy.http.plugin.jwt_validator.issuer: "https://auth.example.com/"
easyhaproxy.http.plugin.jwt_validator.audience: "https://api.example.com"
easyhaproxy.http.plugin.jwt_validator.pubkey_path: "/etc/haproxy/jwt_keys/api_pubkey.pem"
networks:
- easyhaproxy
networks:
easyhaproxy:
external: true
configs:
jwt_api_pubkey:
external: true

137
examples/swarm/plugins-combined.yml Normal file
View file

@ -0,0 +1,137 @@
# Multiple Plugins Combined Example for Docker Swarm
#
# This example demonstrates using multiple plugins together for enhanced security
#
# Prerequisites:
# 1. Docker Swarm initialized:
# docker swarm init
#
# 2. Create overlay network:
# docker network create --driver overlay --attachable easyhaproxy
#
# 3. Generate JWT keys and create Docker config:
# openssl genrsa -out jwt_private.pem 2048
# openssl rsa -in jwt_private.pem -pubout -out jwt_pubkey.pem
# docker config create jwt_api_pubkey jwt_pubkey.pem
#
# 4. Download Cloudflare IPs and create Docker config:
# curl https://www.cloudflare.com/ips-v4 > cloudflare_ips.lst
# curl https://www.cloudflare.com/ips-v6 >> cloudflare_ips.lst
# docker config create cloudflare_ips cloudflare_ips.lst
#
# 5. Deploy the stack:
# docker stack deploy -c plugins-combined.yml production
#
# This creates three services with different security profiles:
# - Public website: Cloudflare + path blocking
# - Protected API: JWT validation + path blocking
# - Admin panel: Strict IP whitelist
version: "3.7"
services:
haproxy:
image: byjg/easy-haproxy:4.6.0
volumes:
- /var/run/docker.sock:/var/run/docker.sock
configs:
- source: cloudflare_ips
target: /etc/haproxy/cloudflare_ips.lst
- source: jwt_api_pubkey
target: /etc/haproxy/jwt_keys/api_pubkey.pem
deploy:
replicas: 1
placement:
constraints:
- node.role == manager
environment:
EASYHAPROXY_DISCOVER: swarm
EASYHAPROXY_SSL_MODE: "loose"
HAPROXY_CUSTOMERRORS: "true"
HAPROXY_USERNAME: admin
HAPROXY_PASSWORD: password
HAPROXY_STATS_PORT: 1936
ports:
- "80:80/tcp"
- "443:443/tcp"
- "1936:1936/tcp"
networks:
- easyhaproxy
# Public website with Cloudflare + path blocking
website:
image: byjg/static-httpserver
environment:
TITLE: "Public Website"
deploy:
replicas: 4
labels:
easyhaproxy.http.host: "website.example.com"
easyhaproxy.http.port: "80"
easyhaproxy.http.localport: "8080"
# Cloudflare IP restoration + block sensitive paths
easyhaproxy.http.plugins: "cloudflare,deny_pages"
easyhaproxy.http.plugin.deny_pages.paths: "/admin,/wp-admin,/wp-login.php,/.env,/config"
easyhaproxy.http.plugin.deny_pages.status_code: "404"
networks:
- easyhaproxy
# Protected API with JWT + path blocking
api:
image: byjg/static-httpserver
environment:
TITLE: "Protected API"
deploy:
replicas: 6
labels:
easyhaproxy.http.host: "api.example.com"
easyhaproxy.http.port: "80"
easyhaproxy.http.localport: "8080"
# JWT validation + block internal endpoints
easyhaproxy.http.plugins: "jwt_validator,deny_pages"
# JWT configuration
easyhaproxy.http.plugin.jwt_validator.algorithm: "RS256"
easyhaproxy.http.plugin.jwt_validator.issuer: "https://auth.example.com/"
easyhaproxy.http.plugin.jwt_validator.audience: "https://api.example.com"
easyhaproxy.http.plugin.jwt_validator.pubkey_path: "/etc/haproxy/jwt_keys/api_pubkey.pem"
# Block internal/debug paths
easyhaproxy.http.plugin.deny_pages.paths: "/internal,/debug,/metrics"
easyhaproxy.http.plugin.deny_pages.status_code: "403"
networks:
- easyhaproxy
# Admin panel with strict IP whitelist
admin:
image: byjg/static-httpserver
environment:
TITLE: "Admin Panel"
deploy:
replicas: 2
labels:
easyhaproxy.http.host: "admin.example.com"
easyhaproxy.http.port: "80"
easyhaproxy.http.localport: "8080"
# IP whitelist only (strictest security)
easyhaproxy.http.plugins: "ip_whitelist"
# Only allow office network
# UPDATE with your actual office/VPN IPs!
easyhaproxy.http.plugin.ip_whitelist.allowed_ips: "203.0.113.0/24,10.0.0.0/8"
easyhaproxy.http.plugin.ip_whitelist.status_code: "403"
networks:
- easyhaproxy
networks:
easyhaproxy:
external: true
configs:
cloudflare_ips:
external: true
jwt_api_pubkey:
external: true