f75cb8aab2
- Introduced multiple detailed plugin examples for Cloudflare IP restoration, IP whitelisting, JWT validation, and combined usage. - Added configurations for `docker-compose`, `Kubernetes`, and `Swarm` showcasing individual and multi-plugin use cases. - Included clear prerequisites, setup steps, and testing procedures for each example. - Documented advanced scenarios like path blocking, custom IP lists, and JWT validation for production environments.
137 lines
4.1 KiB
YAML
137 lines
4.1 KiB
YAML
# Multiple Plugins Combined Example for Docker Swarm
|
|
#
|
|
# This example demonstrates using multiple plugins together for enhanced security
|
|
#
|
|
# Prerequisites:
|
|
# 1. Docker Swarm initialized:
|
|
# docker swarm init
|
|
#
|
|
# 2. Create overlay network:
|
|
# docker network create --driver overlay --attachable easyhaproxy
|
|
#
|
|
# 3. Generate JWT keys and create Docker config:
|
|
# openssl genrsa -out jwt_private.pem 2048
|
|
# openssl rsa -in jwt_private.pem -pubout -out jwt_pubkey.pem
|
|
# docker config create jwt_api_pubkey jwt_pubkey.pem
|
|
#
|
|
# 4. Download Cloudflare IPs and create Docker config:
|
|
# curl https://www.cloudflare.com/ips-v4 > cloudflare_ips.lst
|
|
# curl https://www.cloudflare.com/ips-v6 >> cloudflare_ips.lst
|
|
# docker config create cloudflare_ips cloudflare_ips.lst
|
|
#
|
|
# 5. Deploy the stack:
|
|
# docker stack deploy -c plugins-combined.yml production
|
|
#
|
|
# This creates three services with different security profiles:
|
|
# - Public website: Cloudflare + path blocking
|
|
# - Protected API: JWT validation + path blocking
|
|
# - Admin panel: Strict IP whitelist
|
|
|
|
version: "3.7"
|
|
|
|
services:
|
|
haproxy:
|
|
image: byjg/easy-haproxy:4.6.0
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
configs:
|
|
- source: cloudflare_ips
|
|
target: /etc/haproxy/cloudflare_ips.lst
|
|
- source: jwt_api_pubkey
|
|
target: /etc/haproxy/jwt_keys/api_pubkey.pem
|
|
deploy:
|
|
replicas: 1
|
|
placement:
|
|
constraints:
|
|
- node.role == manager
|
|
environment:
|
|
EASYHAPROXY_DISCOVER: swarm
|
|
EASYHAPROXY_SSL_MODE: "loose"
|
|
HAPROXY_CUSTOMERRORS: "true"
|
|
HAPROXY_USERNAME: admin
|
|
HAPROXY_PASSWORD: password
|
|
HAPROXY_STATS_PORT: 1936
|
|
ports:
|
|
- "80:80/tcp"
|
|
- "443:443/tcp"
|
|
- "1936:1936/tcp"
|
|
networks:
|
|
- easyhaproxy
|
|
|
|
# Public website with Cloudflare + path blocking
|
|
website:
|
|
image: byjg/static-httpserver
|
|
environment:
|
|
TITLE: "Public Website"
|
|
deploy:
|
|
replicas: 4
|
|
labels:
|
|
easyhaproxy.http.host: "website.example.com"
|
|
easyhaproxy.http.port: "80"
|
|
easyhaproxy.http.localport: "8080"
|
|
|
|
# Cloudflare IP restoration + block sensitive paths
|
|
easyhaproxy.http.plugins: "cloudflare,deny_pages"
|
|
easyhaproxy.http.plugin.deny_pages.paths: "/admin,/wp-admin,/wp-login.php,/.env,/config"
|
|
easyhaproxy.http.plugin.deny_pages.status_code: "404"
|
|
networks:
|
|
- easyhaproxy
|
|
|
|
# Protected API with JWT + path blocking
|
|
api:
|
|
image: byjg/static-httpserver
|
|
environment:
|
|
TITLE: "Protected API"
|
|
deploy:
|
|
replicas: 6
|
|
labels:
|
|
easyhaproxy.http.host: "api.example.com"
|
|
easyhaproxy.http.port: "80"
|
|
easyhaproxy.http.localport: "8080"
|
|
|
|
# JWT validation + block internal endpoints
|
|
easyhaproxy.http.plugins: "jwt_validator,deny_pages"
|
|
|
|
# JWT configuration
|
|
easyhaproxy.http.plugin.jwt_validator.algorithm: "RS256"
|
|
easyhaproxy.http.plugin.jwt_validator.issuer: "https://auth.example.com/"
|
|
easyhaproxy.http.plugin.jwt_validator.audience: "https://api.example.com"
|
|
easyhaproxy.http.plugin.jwt_validator.pubkey_path: "/etc/haproxy/jwt_keys/api_pubkey.pem"
|
|
|
|
# Block internal/debug paths
|
|
easyhaproxy.http.plugin.deny_pages.paths: "/internal,/debug,/metrics"
|
|
easyhaproxy.http.plugin.deny_pages.status_code: "403"
|
|
networks:
|
|
- easyhaproxy
|
|
|
|
# Admin panel with strict IP whitelist
|
|
admin:
|
|
image: byjg/static-httpserver
|
|
environment:
|
|
TITLE: "Admin Panel"
|
|
deploy:
|
|
replicas: 2
|
|
labels:
|
|
easyhaproxy.http.host: "admin.example.com"
|
|
easyhaproxy.http.port: "80"
|
|
easyhaproxy.http.localport: "8080"
|
|
|
|
# IP whitelist only (strictest security)
|
|
easyhaproxy.http.plugins: "ip_whitelist"
|
|
|
|
# Only allow office network
|
|
# UPDATE with your actual office/VPN IPs!
|
|
easyhaproxy.http.plugin.ip_whitelist.allowed_ips: "203.0.113.0/24,10.0.0.0/8"
|
|
easyhaproxy.http.plugin.ip_whitelist.status_code: "403"
|
|
networks:
|
|
- easyhaproxy
|
|
|
|
networks:
|
|
easyhaproxy:
|
|
external: true
|
|
|
|
configs:
|
|
cloudflare_ips:
|
|
external: true
|
|
jwt_api_pubkey:
|
|
external: true
|