diff --git a/00global.cfg b/00global.cfg deleted file mode 100644 index f6eec27..0000000 --- a/00global.cfg +++ /dev/null @@ -1,20 +0,0 @@ -global - log /dev/log local0 - log /dev/log local1 notice - chroot /var/lib/haproxy - stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners - stats timeout 30s - user haproxy - group haproxy - daemon - - # TLS config - ca-base /etc/ssl/certs - crt-base /etc/ssl/private - # generated 2024-08-10, Mozilla Guideline v5.7, HAProxy 2.8.5, OpenSSL 3.0.13, modern configuration, no OCSP - # https://ssl-config.mozilla.org/#server=haproxy&version=2.8.5&config=modern&openssl=3.0.13&ocsp=false&guideline=5.7 - # modern configuration - ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 - ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets - ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 - ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets diff --git a/01defaults.cfg b/01defaults.cfg deleted file mode 100644 index 3ad6997..0000000 --- a/01defaults.cfg +++ /dev/null @@ -1,18 +0,0 @@ -defaults - log global - mode http - option httplog - option dontlognull - timeout connect 5s - timeout client 1m - timeout server 1m - timeout http-keep-alive 2m - timeout queue 15s - timeout tunnel 4h # for websocket - errorfile 400 /etc/haproxy/errors/400.http - errorfile 403 /etc/haproxy/errors/403.http - errorfile 408 /etc/haproxy/errors/408.http - errorfile 500 /etc/haproxy/errors/500.http - errorfile 502 /etc/haproxy/errors/502.http - errorfile 503 /etc/haproxy/errors/503.http - errorfile 504 /etc/haproxy/errors/504.http diff --git a/02cache.cfg b/02cache.cfg deleted file mode 100644 index 5cdab0d..0000000 --- a/02cache.cfg +++ /dev/null @@ -1,7 +0,0 @@ -# The cache instance used by the frontend (256MB, 50MB max object, 1 hour max) -# May be consulted using "show cache" on the CLI socket -cache cache - total-max-size 256 # RAM cache size in megabytes - max-object-size 52428800 # max cacheable object size in bytes - max-age 3600 # max cache duration in seconds - process-vary on # handle the Vary header (otherwise don't cache) diff --git a/03frontends.cfg b/03frontends.cfg deleted file mode 100644 index a482609..0000000 --- a/03frontends.cfg +++ /dev/null @@ -1,302 +0,0 @@ -frontend stats - mode http - bind *:8404 - stats enable - stats uri /stats - stats refresh 10s - stats admin if LOCALHOST - -frontend frontend_default - bind :80 name http - bind :::80 name httpv6 v6only - # Sadly we can't use strict-sni because of Let's Encrypt challenge on https - bind :443 name https ssl crt /etc/haproxy/crt alpn h2,http/1.1 - bind :::443 name httpsv6 v6only ssl crt /etc/haproxy/crt alpn h2,http/1.1 - - # silently ignore connect probes and pre-connect without request - option http-ignore-probes - - # pass client's IP address to the server and prevent against attempts - # to inject bad contents - http-request del-header x-forwarded-for - option forwardfor - - # enable HTTP compression of text contents - compression algo deflate gzip - compression type text/ application/javascript application/xhtml+xml image/x-icon - - # enable HTTP caching of any cacheable content - http-request cache-use cache - http-response cache-store cache - - # Redirect to HTTPS - http-request redirect scheme https unless { ssl_fc } - - # ACLs - # ACL for country blocks - acl AD src -f /etc/haproxy/country/AD.txt - acl AE src -f /etc/haproxy/country/AE.txt - acl AF src -f /etc/haproxy/country/AF.txt - acl AG src -f /etc/haproxy/country/AG.txt - acl AI src -f /etc/haproxy/country/AI.txt - acl AL src -f /etc/haproxy/country/AL.txt - acl AM src -f /etc/haproxy/country/AM.txt - acl AO src -f /etc/haproxy/country/AO.txt - acl AQ src -f /etc/haproxy/country/AQ.txt - acl AR src -f /etc/haproxy/country/AR.txt - acl AS src -f /etc/haproxy/country/AS.txt - acl AT src -f /etc/haproxy/country/AT.txt - acl AU src -f /etc/haproxy/country/AU.txt - acl AW src -f /etc/haproxy/country/AW.txt - acl AX src -f /etc/haproxy/country/AX.txt - acl AZ src -f /etc/haproxy/country/AZ.txt - acl BA src -f /etc/haproxy/country/BA.txt - acl BB src -f /etc/haproxy/country/BB.txt - acl BD src -f /etc/haproxy/country/BD.txt - acl BE src -f /etc/haproxy/country/BE.txt - acl BF src -f /etc/haproxy/country/BF.txt - acl BG src -f /etc/haproxy/country/BG.txt - acl BH src -f /etc/haproxy/country/BH.txt - acl BI src -f /etc/haproxy/country/BI.txt - acl BJ src -f /etc/haproxy/country/BJ.txt - acl BL src -f /etc/haproxy/country/BL.txt - acl BM src -f /etc/haproxy/country/BM.txt - acl BN src -f /etc/haproxy/country/BN.txt - acl BO src -f /etc/haproxy/country/BO.txt - acl BQ src -f /etc/haproxy/country/BQ.txt - acl BR src -f /etc/haproxy/country/BR.txt - acl BS src -f /etc/haproxy/country/BS.txt - acl BT src -f /etc/haproxy/country/BT.txt - acl BV src -f /etc/haproxy/country/BV.txt - acl BW src -f /etc/haproxy/country/BW.txt - acl BY src -f /etc/haproxy/country/BY.txt - acl BZ src -f /etc/haproxy/country/BZ.txt - acl CA src -f /etc/haproxy/country/CA.txt - acl CC src -f /etc/haproxy/country/CC.txt - acl CD src -f /etc/haproxy/country/CD.txt - acl CF src -f /etc/haproxy/country/CF.txt - acl CG src -f /etc/haproxy/country/CG.txt - acl CH src -f /etc/haproxy/country/CH.txt - acl CI src -f /etc/haproxy/country/CI.txt - acl CK src -f /etc/haproxy/country/CK.txt - acl CL src -f /etc/haproxy/country/CL.txt - acl CM src -f /etc/haproxy/country/CM.txt - acl CN src -f /etc/haproxy/country/CN.txt - acl CO src -f /etc/haproxy/country/CO.txt - acl CR src -f /etc/haproxy/country/CR.txt - acl CU src -f /etc/haproxy/country/CU.txt - acl CV src -f /etc/haproxy/country/CV.txt - acl CW src -f /etc/haproxy/country/CW.txt - acl CX src -f /etc/haproxy/country/CX.txt - acl CY src -f /etc/haproxy/country/CY.txt - acl CZ src -f /etc/haproxy/country/CZ.txt - acl DE src -f /etc/haproxy/country/DE.txt - acl DJ src -f /etc/haproxy/country/DJ.txt - acl DK src -f /etc/haproxy/country/DK.txt - acl DM src -f /etc/haproxy/country/DM.txt - acl DO src -f /etc/haproxy/country/DO.txt - acl DZ src -f /etc/haproxy/country/DZ.txt - acl EC src -f /etc/haproxy/country/EC.txt - acl EE src -f /etc/haproxy/country/EE.txt - acl EG src -f /etc/haproxy/country/EG.txt - acl EH src -f /etc/haproxy/country/EH.txt - acl ER src -f /etc/haproxy/country/ER.txt - acl ES src -f /etc/haproxy/country/ES.txt - acl ET src -f /etc/haproxy/country/ET.txt - acl FI src -f /etc/haproxy/country/FI.txt - acl FJ src -f /etc/haproxy/country/FJ.txt - acl FK src -f /etc/haproxy/country/FK.txt - acl FM src -f /etc/haproxy/country/FM.txt - acl FO src -f /etc/haproxy/country/FO.txt - acl FR src -f /etc/haproxy/country/FR.txt - acl GA src -f /etc/haproxy/country/GA.txt - acl GB src -f /etc/haproxy/country/GB.txt - acl GD src -f /etc/haproxy/country/GD.txt - acl GE src -f /etc/haproxy/country/GE.txt - acl GF src -f /etc/haproxy/country/GF.txt - acl GG src -f /etc/haproxy/country/GG.txt - acl GH src -f /etc/haproxy/country/GH.txt - acl GI src -f /etc/haproxy/country/GI.txt - acl GL src -f /etc/haproxy/country/GL.txt - acl GM src -f /etc/haproxy/country/GM.txt - acl GN src -f /etc/haproxy/country/GN.txt - acl GP src -f /etc/haproxy/country/GP.txt - acl GQ src -f /etc/haproxy/country/GQ.txt - acl GR src -f /etc/haproxy/country/GR.txt - acl GS src -f /etc/haproxy/country/GS.txt - acl GT src -f /etc/haproxy/country/GT.txt - acl GU src -f /etc/haproxy/country/GU.txt - acl GW src -f /etc/haproxy/country/GW.txt - acl GY src -f /etc/haproxy/country/GY.txt - acl HK src -f /etc/haproxy/country/HK.txt - acl HM src -f /etc/haproxy/country/HM.txt - acl HN src -f /etc/haproxy/country/HN.txt - acl HR src -f /etc/haproxy/country/HR.txt - acl HT src -f /etc/haproxy/country/HT.txt - acl HU src -f /etc/haproxy/country/HU.txt - acl ID src -f /etc/haproxy/country/ID.txt - acl IE src -f /etc/haproxy/country/IE.txt - acl IL src -f /etc/haproxy/country/IL.txt - acl IM src -f /etc/haproxy/country/IM.txt - acl IN src -f /etc/haproxy/country/IN.txt - acl IO src -f /etc/haproxy/country/IO.txt - acl IQ src -f /etc/haproxy/country/IQ.txt - acl IR src -f /etc/haproxy/country/IR.txt - acl IS src -f /etc/haproxy/country/IS.txt - acl IT src -f /etc/haproxy/country/IT.txt - acl JE src -f /etc/haproxy/country/JE.txt - acl JM src -f /etc/haproxy/country/JM.txt - acl JO src -f /etc/haproxy/country/JO.txt - acl JP src -f /etc/haproxy/country/JP.txt - acl KE src -f /etc/haproxy/country/KE.txt - acl KG src -f /etc/haproxy/country/KG.txt - acl KH src -f /etc/haproxy/country/KH.txt - acl KI src -f /etc/haproxy/country/KI.txt - acl KM src -f /etc/haproxy/country/KM.txt - acl KN src -f /etc/haproxy/country/KN.txt - acl KP src -f /etc/haproxy/country/KP.txt - acl KR src -f /etc/haproxy/country/KR.txt - acl KW src -f /etc/haproxy/country/KW.txt - acl KY src -f /etc/haproxy/country/KY.txt - acl KZ src -f /etc/haproxy/country/KZ.txt - acl LA src -f /etc/haproxy/country/LA.txt - acl LB src -f /etc/haproxy/country/LB.txt - acl LC src -f /etc/haproxy/country/LC.txt - acl LI src -f /etc/haproxy/country/LI.txt - acl LK src -f /etc/haproxy/country/LK.txt - acl LR src -f /etc/haproxy/country/LR.txt - acl LS src -f /etc/haproxy/country/LS.txt - acl LT src -f /etc/haproxy/country/LT.txt - acl LU src -f /etc/haproxy/country/LU.txt - acl LV src -f /etc/haproxy/country/LV.txt - acl LY src -f /etc/haproxy/country/LY.txt - acl MA src -f /etc/haproxy/country/MA.txt - acl MC src -f /etc/haproxy/country/MC.txt - acl MD src -f /etc/haproxy/country/MD.txt - acl ME src -f /etc/haproxy/country/ME.txt - acl MF src -f /etc/haproxy/country/MF.txt - acl MG src -f /etc/haproxy/country/MG.txt - acl MH src -f /etc/haproxy/country/MH.txt - acl MK src -f /etc/haproxy/country/MK.txt - acl ML src -f /etc/haproxy/country/ML.txt - acl MM src -f /etc/haproxy/country/MM.txt - acl MN src -f /etc/haproxy/country/MN.txt - acl MO src -f /etc/haproxy/country/MO.txt - acl MP src -f /etc/haproxy/country/MP.txt - acl MQ src -f /etc/haproxy/country/MQ.txt - acl MR src -f /etc/haproxy/country/MR.txt - acl MS src -f /etc/haproxy/country/MS.txt - acl MT src -f /etc/haproxy/country/MT.txt - acl MU src -f /etc/haproxy/country/MU.txt - acl MV src -f /etc/haproxy/country/MV.txt - acl MW src -f /etc/haproxy/country/MW.txt - acl MX src -f /etc/haproxy/country/MX.txt - acl MY src -f /etc/haproxy/country/MY.txt - acl MZ src -f /etc/haproxy/country/MZ.txt - acl NA src -f /etc/haproxy/country/NA.txt - acl NC src -f /etc/haproxy/country/NC.txt - acl NE src -f /etc/haproxy/country/NE.txt - acl NF src -f /etc/haproxy/country/NF.txt - acl NG src -f /etc/haproxy/country/NG.txt - acl NI src -f /etc/haproxy/country/NI.txt - acl NL src -f /etc/haproxy/country/NL.txt - acl NO src -f /etc/haproxy/country/NO.txt - acl NP src -f /etc/haproxy/country/NP.txt - acl NR src -f /etc/haproxy/country/NR.txt - acl NU src -f /etc/haproxy/country/NU.txt - acl NZ src -f /etc/haproxy/country/NZ.txt - acl OM src -f /etc/haproxy/country/OM.txt - acl PA src -f /etc/haproxy/country/PA.txt - acl PE src -f /etc/haproxy/country/PE.txt - acl PF src -f /etc/haproxy/country/PF.txt - acl PG src -f /etc/haproxy/country/PG.txt - acl PH src -f /etc/haproxy/country/PH.txt - acl PK src -f /etc/haproxy/country/PK.txt - acl PL src -f /etc/haproxy/country/PL.txt - acl PM src -f /etc/haproxy/country/PM.txt - acl PN src -f /etc/haproxy/country/PN.txt - acl PR src -f /etc/haproxy/country/PR.txt - acl PS src -f /etc/haproxy/country/PS.txt - acl PT src -f /etc/haproxy/country/PT.txt - acl PW src -f /etc/haproxy/country/PW.txt - acl PY src -f /etc/haproxy/country/PY.txt - acl QA src -f /etc/haproxy/country/QA.txt - acl RE src -f /etc/haproxy/country/RE.txt - acl RO src -f /etc/haproxy/country/RO.txt - acl RS src -f /etc/haproxy/country/RS.txt - acl RU src -f /etc/haproxy/country/RU.txt - acl RW src -f /etc/haproxy/country/RW.txt - acl SA src -f /etc/haproxy/country/SA.txt - acl SB src -f /etc/haproxy/country/SB.txt - acl SC src -f /etc/haproxy/country/SC.txt - acl SD src -f /etc/haproxy/country/SD.txt - acl SE src -f /etc/haproxy/country/SE.txt - acl SG src -f /etc/haproxy/country/SG.txt - acl SH src -f /etc/haproxy/country/SH.txt - acl SI src -f /etc/haproxy/country/SI.txt - acl SJ src -f /etc/haproxy/country/SJ.txt - acl SK src -f /etc/haproxy/country/SK.txt - acl SL src -f /etc/haproxy/country/SL.txt - acl SM src -f /etc/haproxy/country/SM.txt - acl SN src -f /etc/haproxy/country/SN.txt - acl SO src -f /etc/haproxy/country/SO.txt - acl SR src -f /etc/haproxy/country/SR.txt - acl SS src -f /etc/haproxy/country/SS.txt - acl ST src -f /etc/haproxy/country/ST.txt - acl SV src -f /etc/haproxy/country/SV.txt - acl SX src -f /etc/haproxy/country/SX.txt - acl SY src -f /etc/haproxy/country/SY.txt - acl SZ src -f /etc/haproxy/country/SZ.txt - acl TC src -f /etc/haproxy/country/TC.txt - acl TD src -f /etc/haproxy/country/TD.txt - acl TF src -f /etc/haproxy/country/TF.txt - acl TG src -f /etc/haproxy/country/TG.txt - acl TH src -f /etc/haproxy/country/TH.txt - acl TJ src -f /etc/haproxy/country/TJ.txt - acl TK src -f /etc/haproxy/country/TK.txt - acl TL src -f /etc/haproxy/country/TL.txt - acl TM src -f /etc/haproxy/country/TM.txt - acl TN src -f /etc/haproxy/country/TN.txt - acl TO src -f /etc/haproxy/country/TO.txt - acl TR src -f /etc/haproxy/country/TR.txt - acl TT src -f /etc/haproxy/country/TT.txt - acl TV src -f /etc/haproxy/country/TV.txt - acl TW src -f /etc/haproxy/country/TW.txt - acl TZ src -f /etc/haproxy/country/TZ.txt - acl UA src -f /etc/haproxy/country/UA.txt - acl UG src -f /etc/haproxy/country/UG.txt - acl UM src -f /etc/haproxy/country/UM.txt - acl US src -f /etc/haproxy/country/US.txt - acl UY src -f /etc/haproxy/country/UY.txt - acl UZ src -f /etc/haproxy/country/UZ.txt - acl VA src -f /etc/haproxy/country/VA.txt - acl VC src -f /etc/haproxy/country/VC.txt - acl VE src -f /etc/haproxy/country/VE.txt - acl VG src -f /etc/haproxy/country/VG.txt - acl VI src -f /etc/haproxy/country/VI.txt - acl VN src -f /etc/haproxy/country/VN.txt - acl VU src -f /etc/haproxy/country/VU.txt - acl WF src -f /etc/haproxy/country/WF.txt - acl WS src -f /etc/haproxy/country/WS.txt - acl XK src -f /etc/haproxy/country/XK.txt - acl YE src -f /etc/haproxy/country/YE.txt - acl YT src -f /etc/haproxy/country/YT.txt - acl ZA src -f /etc/haproxy/country/ZA.txt - acl ZM src -f /etc/haproxy/country/ZM.txt - acl ZW src -f /etc/haproxy/country/ZW.txt - - # Redirect www to non-www domains - http-request redirect prefix https://%[hdr(host),regsub(^www\.,,i)] code 301 if { hdr_beg(host) -i www. } - - acl letsencrypt path_beg /.well-known/acme-challenge/ - - acl laminar hdr(host) -i laminar.benoit.jp.net - acl forgejo hdr(host) -i forgejo.benoit.jp.net - #http-request deny if flux !JP !letsencrypt - #http-request deny if dns !JP !SG !letsencrypt - - use_backend letsencrypt if letsencrypt - use_backend laminar if laminar - use_backend forgejo if forgejo - - default_backend default diff --git a/04listen.cfg b/04listen.cfg deleted file mode 100644 index c6a24ec..0000000 --- a/04listen.cfg +++ /dev/null @@ -1,37 +0,0 @@ -# Listens (frontend and backend combined) - listen ssh - bind :22 - bind :::22 v6only - mode tcp - option tcplog - server git-ssh forgejo.incus:10022 send-proxy check -# listen smtp -# bind :25 -# bind :::25 v6only -# mode tcp -# option tcplog -# server mail 10.78.127.231:10025 send-proxy -# listen smtps -# bind :465 -# bind :::465 v6only -# mode tcp -# option tcplog -# server mail 10.78.127.231:10465 send-proxy -# listen imaps -# bind :993 -# bind :::993 v6only -# mode tcp -# option tcplog -# server mail 10.78.127.231:10993 send-proxy -# listen sieve -# bind :4190 -# bind :::4190 v6only -# mode tcp -# option tcplog -# server mail 10.78.127.231:14190 send-proxy -# listen adguard-dot -# bind :853 -# bind :::853 v6only -# mode tcp -# option tcplog -# server adguard 10.78.127.201:10853 send-proxy diff --git a/05backends.cfg b/05backends.cfg deleted file mode 100644 index 7786535..0000000 --- a/05backends.cfg +++ /dev/null @@ -1,26 +0,0 @@ -# Backends -backend default - tcp-request content reject - -backend letsencrypt - server certbot 127.0.0.1:8899 - -backend laminar - # set HSTS for one year after all responses - http-response set-header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" - # add some Security headers - http-response set-header X-Frame-Options "SAMEORIGIN" - http-response set-header X-Content-Type-Options "nosniff" - http-response set-header Referrer-Policy "strict-origin-when-cross-origin" - http-response set-header Cross-Origin-Resource-Policy "same-origin" - server laminar laminar.incus:8080 check - -backend forgejo - # set HSTS for one year after all responses - http-response set-header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" - # add some Security headers - http-response set-header X-Frame-Options "SAMEORIGIN" - http-response set-header X-Content-Type-Options "nosniff" - http-response set-header Referrer-Policy "strict-origin-when-cross-origin" - http-response set-header Cross-Origin-Resource-Policy "same-origin" - server laminar forgejo.incus:3000 check diff --git a/README.md b/README.md index bdbd294..4044d04 100644 --- a/README.md +++ b/README.md @@ -1,10 +1,3 @@ # Haproxy -Haproxy configuration files for my self-hosted setup. - -`/etc/systemd/system/haproxy.service.d/override.conf`: - -```HAProxy -[Service] -Environment="CONFIG=/etc/haproxy/config" -``` +Haproxy configuration files for my self-hosted setup. \ No newline at end of file