108 lines
3.8 KiB
INI
108 lines
3.8 KiB
INI
|
#---------------------------------------------------------------------
|
||
|
|
# Example configuration for a possible web application. See the
|
||
|
|
# full configuration options online.
|
||
|
|
#
|
||
|
|
# https://www.haproxy.org/download/1.8/doc/configuration.txt
|
||
|
|
#
|
||
|
|
#---------------------------------------------------------------------
|
||
|
|
|
||
|
|
#---------------------------------------------------------------------
|
||
|
|
# Global settings
|
||
|
|
#---------------------------------------------------------------------
|
||
|
|
global
|
||
|
|
# to have these messages end up in /var/log/haproxy.log you will
|
||
|
|
# need to:
|
||
|
|
#
|
||
|
|
# 1) configure syslog to accept network log events. This is done
|
||
|
|
# by adding the '-r' option to the SYSLOGD_OPTIONS in
|
||
|
|
# /etc/sysconfig/syslog
|
||
|
|
#
|
||
|
|
# 2) configure local2 events to go to the /var/log/haproxy.log
|
||
|
|
# file. A line like the following can be added to
|
||
|
|
# /etc/sysconfig/syslog
|
||
|
|
#
|
||
|
|
# local2.* /var/log/haproxy.log
|
||
|
|
#
|
||
|
|
# log 127.0.0.1 local2
|
||
|
|
log /dev/log local0
|
||
|
|
|
||
|
|
chroot /var/lib/haproxy
|
||
|
|
pidfile /var/run/haproxy.pid
|
||
|
|
maxconn 4000
|
||
|
|
user haproxy
|
||
|
|
group haproxy
|
||
|
|
daemon
|
||
|
|
|
||
|
|
# turn on stats unix socket
|
||
|
|
stats socket /var/lib/haproxy/stats
|
||
|
|
|
||
|
|
# utilize system-wide crypto-policies
|
||
|
|
ssl-default-bind-ciphers PROFILE=SYSTEM
|
||
|
|
ssl-default-server-ciphers PROFILE=SYSTEM
|
||
|
|
|
||
|
|
# TLS
|
||
|
|
ssl-default-bind-options ssl-min-ver TLSv1.2
|
||
|
|
ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
|
||
|
|
|
||
|
|
#---------------------------------------------------------------------
|
||
|
|
# common defaults that all the 'listen' and 'backend' sections will
|
||
|
|
# use if not designated in their block
|
||
|
|
#---------------------------------------------------------------------
|
||
|
|
defaults
|
||
|
|
mode http
|
||
|
|
log global
|
||
|
|
option httplog
|
||
|
|
option dontlognull
|
||
|
|
option http-server-close
|
||
|
|
option forwardfor except 127.0.0.0/8
|
||
|
|
option redispatch
|
||
|
|
retries 3
|
||
|
|
timeout http-request 10s
|
||
|
|
timeout queue 1m
|
||
|
|
timeout connect 10s
|
||
|
|
timeout client 1m
|
||
|
|
timeout server 1m
|
||
|
|
timeout http-keep-alive 10s
|
||
|
|
timeout check 10s
|
||
|
|
maxconn 3000
|
||
|
|
|
||
|
|
#---------------------------------------------------------------------
|
||
|
|
# main frontend which proxys to the backends
|
||
|
|
#---------------------------------------------------------------------
|
||
|
|
frontend main
|
||
|
|
bind *:5000
|
||
|
|
acl url_static path_beg -i /static /images /javascript /stylesheets
|
||
|
|
acl url_static path_end -i .jpg .gif .png .css .js
|
||
|
|
|
||
|
|
use_backend static if url_static
|
||
|
|
|
||
|
|
frontend git-http
|
||
|
|
bind *:80
|
||
|
|
option forwardfor
|
||
|
|
http-request redirect scheme https unless { ssl_fc }
|
||
|
|
|
||
|
|
frontend git-https
|
||
|
|
bind *:443 ssl crt /etc/letsencrypt/live/git.mic.pp.ua/fullchain.pem alpn h2,http/1.1
|
||
|
|
mode http
|
||
|
|
option forwardfor
|
||
|
|
acl is_git hdr(host) -i git.mic.pp.ua
|
||
|
|
use_backend git_backend if is_git
|
||
|
|
|
||
|
|
#---------------------------------------------------------------------
|
||
|
|
# static backend for serving up images, stylesheets and such
|
||
|
|
#---------------------------------------------------------------------
|
||
|
|
backend static
|
||
|
|
balance roundrobin
|
||
|
|
server static 127.0.0.1:4331 check
|
||
|
|
|
||
|
|
#---------------------------------------------------------------------
|
||
|
|
# round robin balancing between the various backends
|
||
|
|
#---------------------------------------------------------------------
|
||
|
|
backend git_backend
|
||
|
|
balance roundrobin
|
||
|
|
mode http
|
||
|
|
server git_instance1 127.0.0.1:3000 check
|
||
|
|
|
||
|
|
backend letsencrypt-backend
|
||
|
|
server letsencrypt 127.0.0.1:8888
|