045dd3817e
- Refactored HAProxy configuration files, templates, and paths to use `/etc/easyhaproxy` instead of `/etc/haproxy`. - Updated Dockerfile to generate DH params and placeholder certificates in the new configuration directory. - Added health check support with timeout to `DockerComposeFixture` in E2E test utilities. - Adjusted tests, templates, and plugins to use the new `Consts`-based configuration paths. - Introduced pytest fixtures for environment isolation and temporary directory management.
138 lines
4.6 KiB
YAML
138 lines
4.6 KiB
YAML
# ==============================================================================
|
|
# EXAMPLE: Multiple Plugins Combined
|
|
# ==============================================================================
|
|
#
|
|
# WHAT THIS DEMONSTRATES:
|
|
# - Using multiple security plugins together
|
|
# - Different plugin combinations for different services
|
|
# - Cloudflare + path blocking for public sites
|
|
# - JWT validation + path blocking for APIs
|
|
# - IP whitelist for admin panels
|
|
# - Layered security approach
|
|
#
|
|
# REQUIREMENTS (run these first):
|
|
# ```bash
|
|
# # Generate SSL certificates and JWT keys (from project root)
|
|
# cd ../.. && ./tests_e2e/generate-keys.sh && cd tests_e2e/docker
|
|
#
|
|
# # Download Cloudflare IPs (idempotent - overwrites if exists)
|
|
# curl -s https://www.cloudflare.com/ips-v4 > cloudflare_ips.lst
|
|
# echo "" >> cloudflare_ips.lst
|
|
# curl -s https://www.cloudflare.com/ips-v6 >> cloudflare_ips.lst
|
|
#
|
|
#
|
|
# HOW TO START:
|
|
# ```bash
|
|
# docker compose -f docker-compose-plugins-combined.yml up -d
|
|
# ```
|
|
#
|
|
# HOW TO VERIFY IT'S WORKING:
|
|
# ```bash
|
|
# # Test public website (Cloudflare + path blocking)
|
|
# curl -k -H "Host: website.local" http://127.0.0.1/
|
|
# # Expected: 200 OK
|
|
# curl -k -H "Host: website.local" http://127.0.0.1/admin
|
|
# # Expected: HTTP 404 - Path blocked
|
|
#
|
|
# # Test protected API (JWT required)
|
|
# curl -k -H "Host: api.local" http://127.0.0.1/
|
|
# # Expected: HTTP 403 - Missing Authorization header
|
|
# # Generate JWT at https://jwt.io (see jwt-validator example for details)
|
|
# TOKEN="eyJhbGc..." # Replace with your token
|
|
# curl -H "Host: api.local" -H "Authorization: Bearer $TOKEN" http://127.0.0.1/
|
|
# # Expected: 200 OK
|
|
#
|
|
# # Test admin panel (IP whitelist)
|
|
# curl -k -H "Host: admin.local" http://127.0.0.1/
|
|
# # Expected: 200 OK from localhost
|
|
#
|
|
# # View HAProxy stats
|
|
# # URL: http://localhost:1936
|
|
# # Username: admin
|
|
# # Password: password
|
|
# # You should see 3 backends with different security configurations
|
|
# ```
|
|
#
|
|
# CLEAN UP:
|
|
# ```bash
|
|
# docker compose -f docker-compose-plugins-combined.yml down
|
|
# ```
|
|
#
|
|
# ==============================================================================
|
|
|
|
services:
|
|
haproxy:
|
|
build:
|
|
context: ../../
|
|
dockerfile: build/Dockerfile
|
|
image: byjg/easy-haproxy:local
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
- ./cloudflare_ips.lst:/etc/easyhaproxy/cloudflare_ips.lst:ro
|
|
- ./jwt_pubkey.pem:/etc/easyhaproxy/jwt_keys/api_pubkey.pem:ro
|
|
environment:
|
|
EASYHAPROXY_DISCOVER: docker
|
|
HAPROXY_CUSTOMERRORS: "true"
|
|
HAPROXY_USERNAME: admin
|
|
HAPROXY_PASSWORD: password
|
|
HAPROXY_STATS_PORT: 1936
|
|
ports:
|
|
- "80:80/tcp"
|
|
- "1936:1936/tcp"
|
|
|
|
# Public website with Cloudflare + path blocking
|
|
website:
|
|
image: byjg/static-httpserver
|
|
environment:
|
|
TITLE: "Public Website"
|
|
labels:
|
|
easyhaproxy.http.host: website.local
|
|
easyhaproxy.http.port: 80
|
|
easyhaproxy.http.localport: 8080
|
|
|
|
# Combine Cloudflare IP restoration + deny pages
|
|
easyhaproxy.http.plugins: cloudflare,deny_pages
|
|
|
|
# Block admin paths, config files, etc.
|
|
easyhaproxy.http.plugin.deny_pages.paths: /admin,/wp-admin,/wp-login.php,/.env,/config
|
|
easyhaproxy.http.plugin.deny_pages.status_code: 404
|
|
|
|
# Protected API with JWT validation + path blocking
|
|
api:
|
|
image: byjg/static-httpserver
|
|
environment:
|
|
TITLE: "Protected API"
|
|
labels:
|
|
easyhaproxy.http.host: api.local
|
|
easyhaproxy.http.port: 80
|
|
easyhaproxy.http.localport: 8080
|
|
|
|
# JWT validation + block internal endpoints
|
|
easyhaproxy.http.plugins: jwt_validator,deny_pages
|
|
|
|
# JWT configuration
|
|
easyhaproxy.http.plugin.jwt_validator.algorithm: RS256
|
|
easyhaproxy.http.plugin.jwt_validator.issuer: https://auth.example.com/
|
|
easyhaproxy.http.plugin.jwt_validator.audience: https://api.example.com
|
|
easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/easyhaproxy/jwt_keys/api_pubkey.pem
|
|
|
|
# Block internal/debug endpoints
|
|
easyhaproxy.http.plugin.deny_pages.paths: /internal,/debug,/metrics
|
|
easyhaproxy.http.plugin.deny_pages.status_code: 403
|
|
|
|
# Admin panel with strict IP restrictions
|
|
admin:
|
|
image: byjg/static-httpserver
|
|
environment:
|
|
TITLE: "Admin Panel"
|
|
labels:
|
|
easyhaproxy.http.host: admin.local
|
|
easyhaproxy.http.port: 80
|
|
easyhaproxy.http.localport: 8080
|
|
|
|
# IP whitelist only (strictest security)
|
|
easyhaproxy.http.plugins: ip_whitelist
|
|
|
|
# Only allow local and private networks (including Docker bridge)
|
|
easyhaproxy.http.plugin.ip_whitelist.allowed_ips: 127.0.0.1,192.168.0.0/16,10.0.0.0/8,172.16.0.0/12
|
|
easyhaproxy.http.plugin.ip_whitelist.status_code: 403
|