d3637e737a
- Replaced `config.yml` with modular configuration examples: `config-basic.yml`, `config-certbot.yml`, `config-deny-pages.yml`, and `config-jwt-validator.yml`. - Improved examples with detailed usage instructions, prerequisites, and testing steps for each configuration. - Fixed indentation and formatting inconsistencies across plugin files and HAProxy configuration generation. - Streamlined README comparison table for static vs. dynamic discovery. - Updated `docker-compose-jwt-validator.yml` to correct audience key formatting.
86 lines
2.4 KiB
YAML
86 lines
2.4 KiB
YAML
# JWT Validator Plugin Configuration Example
|
|
#
|
|
# Demonstrates:
|
|
# - JWT token validation for API protection
|
|
# - Different JWT configurations per domain
|
|
# - Optional issuer/audience validation
|
|
#
|
|
# Prerequisites:
|
|
# 1. Generate RSA key pair:
|
|
# openssl genrsa -out jwt_private.pem 2048
|
|
# openssl rsa -in jwt_private.pem -pubout -out jwt_pubkey.pem
|
|
#
|
|
# 2. Mount public keys:
|
|
# -v ./jwt_pubkey.pem:/etc/haproxy/jwt_keys/api_pubkey.pem:ro
|
|
# -v ./jwt_pubkey2.pem:/etc/haproxy/jwt_keys/admin_pubkey.pem:ro
|
|
#
|
|
# 3. Mount this config:
|
|
# -v ./conf/config-jwt-validator.yml:/etc/haproxy/static/config.yml
|
|
#
|
|
# 4. Test:
|
|
# # Without token - should fail
|
|
# curl http://api.local/users
|
|
# # Response: Missing Authorization HTTP header
|
|
#
|
|
# # With valid token - should succeed
|
|
# curl -H "Authorization: Bearer eyJhbGc..." http://api.local/users
|
|
|
|
stats:
|
|
username: admin
|
|
password: password
|
|
port: 1936
|
|
|
|
customerrors: true
|
|
|
|
easymapping:
|
|
- port: 80
|
|
hosts:
|
|
# Public API with full JWT validation
|
|
api.local:
|
|
containers:
|
|
- api-server:8080
|
|
plugins:
|
|
- jwt_validator
|
|
plugin_config:
|
|
jwt_validator:
|
|
algorithm: RS256
|
|
issuer: https://auth.example.com/
|
|
audience: https://api.example.com
|
|
pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
|
|
|
|
# Internal API - validate signature only (no issuer/audience check)
|
|
internal-api.local:
|
|
containers:
|
|
- internal-api:3000
|
|
plugins:
|
|
- jwt_validator
|
|
plugin_config:
|
|
jwt_validator:
|
|
algorithm: RS256
|
|
# No issuer/audience = skip those validations
|
|
pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
|
|
|
|
# Admin API - different issuer and key
|
|
admin-api.local:
|
|
containers:
|
|
- admin-api:4000
|
|
plugins:
|
|
- jwt_validator
|
|
- deny_pages # Also block internal paths
|
|
plugin_config:
|
|
jwt_validator:
|
|
algorithm: RS256
|
|
issuer: https://admin-auth.example.com/
|
|
audience: https://admin.example.com
|
|
pubkey_path: /etc/haproxy/jwt_keys/admin_pubkey.pem
|
|
deny_pages:
|
|
paths:
|
|
- /internal
|
|
- /debug
|
|
status_code: 403
|
|
|
|
# Public website - no JWT required
|
|
website.local:
|
|
containers:
|
|
- website:8080
|
|
# No plugins = public access
|