b9a9bee0b9
- Consolidated and simplified Swarm example README to focus on YAML header comments for documentation. - Removed redundant and extended sections, replacing with concise steps for getting started. - Standardized YAML headers across `easyhaproxy.yml`, `services.yml`, and `portainer.yml` with a clearer and more readable format. - Enhanced user guidance for deployment, setup requirements, verification, and cleanup.
81 lines
2.4 KiB
YAML
81 lines
2.4 KiB
YAML
# ==============================================================================
|
|
# EXAMPLE: IP Whitelist Plugin
|
|
# ==============================================================================
|
|
#
|
|
# WHAT THIS DEMONSTRATES:
|
|
# - Restricting access to specific IP addresses or CIDR ranges
|
|
# - Single IP, CIDR notation, and multiple IP support
|
|
# - Custom HTTP status code for blocked requests
|
|
# - Admin panel or sensitive application protection
|
|
#
|
|
# REQUIREMENTS (run these first):
|
|
# ```bash
|
|
# # Add to /etc/hosts (idempotent)
|
|
# grep -q "admin.local" /etc/hosts || echo "127.0.0.1 admin.local" | sudo tee -a /etc/hosts
|
|
#
|
|
# # IMPORTANT: Update the allowed_ips in this file (line 52) with your actual IPs!
|
|
# # Default allows localhost and private networks for testing
|
|
# ```
|
|
#
|
|
# HOW TO START:
|
|
# ```bash
|
|
# docker compose -f docker-compose-ip-whitelist.yml up -d
|
|
# ```
|
|
#
|
|
# HOW TO VERIFY IT'S WORKING:
|
|
# ```bash
|
|
# # Test from localhost (127.0.0.1 is whitelisted)
|
|
# curl http://admin.local/
|
|
# # Expected: 200 OK - Access granted
|
|
#
|
|
# # Test from non-whitelisted IP
|
|
# # You'll need to test from another machine or temporarily remove your IP
|
|
# # from the allowed_ips list to see the 403 Forbidden response
|
|
#
|
|
# # View HAProxy stats to see blocked requests
|
|
# # URL: http://localhost:1936
|
|
# # Username: admin
|
|
# # Password: password
|
|
# ```
|
|
#
|
|
# CLEAN UP:
|
|
# ```bash
|
|
# docker compose -f docker-compose-ip-whitelist.yml down
|
|
# ```
|
|
#
|
|
# ==============================================================================
|
|
|
|
services:
|
|
haproxy:
|
|
image: byjg/easy-haproxy:4.6.0
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
environment:
|
|
EASYHAPROXY_DISCOVER: docker
|
|
HAPROXY_CUSTOMERRORS: "true"
|
|
HAPROXY_USERNAME: admin
|
|
HAPROXY_PASSWORD: password
|
|
HAPROXY_STATS_PORT: 1936
|
|
ports:
|
|
- "80:80/tcp"
|
|
- "1936:1936/tcp"
|
|
|
|
# Admin panel with IP whitelist
|
|
admin:
|
|
image: byjg/static-httpserver
|
|
environment:
|
|
TITLE: "Admin Panel - IP Restricted"
|
|
labels:
|
|
easyhaproxy.http.host: admin.local
|
|
easyhaproxy.http.port: 80
|
|
easyhaproxy.http.localport: 8080
|
|
|
|
# Enable IP whitelist plugin
|
|
easyhaproxy.http.plugins: ip_whitelist
|
|
|
|
# Allow localhost and private networks
|
|
# UPDATE THIS with your actual IPs/networks!
|
|
easyhaproxy.http.plugin.ip_whitelist.allowed_ips: 127.0.0.1,192.168.0.0/16,10.0.0.0/8,172.16.0.0/12
|
|
|
|
# Status code to return for blocked IPs
|
|
easyhaproxy.http.plugin.ip_whitelist.status_code: 403
|