f75cb8aab2
- Introduced multiple detailed plugin examples for Cloudflare IP restoration, IP whitelisting, JWT validation, and combined usage. - Added configurations for `docker-compose`, `Kubernetes`, and `Swarm` showcasing individual and multi-plugin use cases. - Included clear prerequisites, setup steps, and testing procedures for each example. - Documented advanced scenarios like path blocking, custom IP lists, and JWT validation for production environments.
106 lines
3.5 KiB
YAML
106 lines
3.5 KiB
YAML
# Multiple Plugins Combined Example
|
|
#
|
|
# This example demonstrates using multiple plugins together for enhanced security
|
|
#
|
|
# Prerequisites:
|
|
# 1. Generate JWT keys:
|
|
# openssl genrsa -out jwt_private.pem 2048
|
|
# openssl rsa -in jwt_private.pem -pubout -out jwt_pubkey.pem
|
|
#
|
|
# 2. Download Cloudflare IPs:
|
|
# curl https://www.cloudflare.com/ips-v4 > cloudflare_ips.lst
|
|
# curl https://www.cloudflare.com/ips-v6 >> cloudflare_ips.lst
|
|
#
|
|
# 3. Add to /etc/hosts:
|
|
# 127.0.0.1 website.local api.local admin.local
|
|
#
|
|
# 4. Start the stack:
|
|
# docker compose -f docker-compose-plugins-combined.yml up -d
|
|
#
|
|
# 5. Test each service:
|
|
# # Public website (Cloudflare + path blocking)
|
|
# curl http://website.local/
|
|
# curl http://website.local/admin # Should be blocked (404)
|
|
#
|
|
# # Protected API (JWT required)
|
|
# curl http://api.local/ # Should fail - no JWT
|
|
# curl -H "Authorization: Bearer <token>" http://api.local/ # Success
|
|
#
|
|
# # Admin panel (IP whitelist only)
|
|
# curl http://admin.local/ # Success from localhost
|
|
|
|
version: "3"
|
|
|
|
services:
|
|
haproxy:
|
|
image: byjg/easy-haproxy:4.6.0
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
- ./cloudflare_ips.lst:/etc/haproxy/cloudflare_ips.lst:ro
|
|
- ./jwt_pubkey.pem:/etc/haproxy/jwt_keys/api_pubkey.pem:ro
|
|
environment:
|
|
EASYHAPROXY_DISCOVER: docker
|
|
HAPROXY_CUSTOMERRORS: "true"
|
|
HAPROXY_USERNAME: admin
|
|
HAPROXY_PASSWORD: password
|
|
HAPROXY_STATS_PORT: 1936
|
|
ports:
|
|
- "80:80/tcp"
|
|
- "1936:1936/tcp"
|
|
|
|
# Public website with Cloudflare + path blocking
|
|
website:
|
|
image: byjg/static-httpserver
|
|
environment:
|
|
TITLE: "Public Website"
|
|
labels:
|
|
easyhaproxy.http.host: website.local
|
|
easyhaproxy.http.port: 80
|
|
easyhaproxy.http.localport: 8080
|
|
|
|
# Combine Cloudflare IP restoration + deny pages
|
|
easyhaproxy.http.plugins: cloudflare,deny_pages
|
|
|
|
# Block admin paths, config files, etc.
|
|
easyhaproxy.http.plugin.deny_pages.paths: /admin,/wp-admin,/wp-login.php,/.env,/config
|
|
easyhaproxy.http.plugin.deny_pages.status_code: 404
|
|
|
|
# Protected API with JWT validation + path blocking
|
|
api:
|
|
image: byjg/static-httpserver
|
|
environment:
|
|
TITLE: "Protected API"
|
|
labels:
|
|
easyhaproxy.http.host: api.local
|
|
easyhaproxy.http.port: 80
|
|
easyhaproxy.http.localport: 8080
|
|
|
|
# JWT validation + block internal endpoints
|
|
easyhaproxy.http.plugins: jwt_validator,deny_pages
|
|
|
|
# JWT configuration
|
|
easyhaproxy.http.plugin.jwt_validator.algorithm: RS256
|
|
easyhaproxy.http.plugin.jwt_validator.issuer: https://auth.example.com/
|
|
easyhaproxy.http.plugin.jwt_validator.audience: https://api.example.com
|
|
easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
|
|
|
|
# Block internal/debug endpoints
|
|
easyhaproxy.http.plugin.deny_pages.paths: /internal,/debug,/metrics
|
|
easyhaproxy.http.plugin.deny_pages.status_code: 403
|
|
|
|
# Admin panel with strict IP restrictions
|
|
admin:
|
|
image: byjg/static-httpserver
|
|
environment:
|
|
TITLE: "Admin Panel"
|
|
labels:
|
|
easyhaproxy.http.host: admin.local
|
|
easyhaproxy.http.port: 80
|
|
easyhaproxy.http.localport: 8080
|
|
|
|
# IP whitelist only (strictest security)
|
|
easyhaproxy.http.plugins: ip_whitelist
|
|
|
|
# Only allow local and private networks
|
|
easyhaproxy.http.plugin.ip_whitelist.allowed_ips: 127.0.0.1,192.168.0.0/16,10.0.0.0/8
|
|
easyhaproxy.http.plugin.ip_whitelist.status_code: 403
|