-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathhaproxy-internal.jinja.cfg
69 lines (64 loc) · 3.04 KB
/
haproxy-internal.jinja.cfg
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
global
log /dev/log local0
#log /dev/log local1 notice
chroot /var/lib/haproxy
stats socket /run/haproxy/admin-internal.sock mode 660 level admin
stats timeout 30s
user haproxy
group haproxy
daemon
# Default SSL material locations
ca-base /etc/ssl/certs
crt-base /etc/ssl/private
# Default ciphers to use on SSL-enabled listening sockets.
# For more information, see ciphers(1SSL). This list is from:
# https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=haproxy-1.5.14&openssl=1.0.1k&hsts=yes&profile=modern
# set default parameters to the modern configuration
tune.ssl.default-dh-param 2048
ssl-default-bind-ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK
ssl-default-bind-options no-sslv3
defaults
log global
mode http
option httplog
option dontlognull
timeout connect 5000
timeout client 50000
timeout server 50000
errorfile 400 /etc/haproxy/errors/400.http
errorfile 403 /etc/haproxy/errors/403.http
errorfile 408 /etc/haproxy/errors/408.http
errorfile 500 /etc/haproxy/errors/500.http
errorfile 502 /etc/haproxy/errors/502.http
errorfile 503 /etc/haproxy/errors/503.http
errorfile 504 /etc/haproxy/errors/504.http
{% set groups = services.group_by("name") %}
{% for name, group in groups.items() %}
frontend frontend-{{name}}
bind {{localip}}:{%- if group.tagvalue_set("haproxy:frontend:port:") -%}
{{group[0].tagvalue("haproxy:frontend:port:")}}
{%- else -%}
{{group[0].port}}
{%- endif %} {% if transparent_bind is defined %}transparent{% endif %}
default_backend backend-{{name}}
mode {% if group[0].mode %}{{group[0].mode}}{% else %}tcp{% endif %}
{% for option in group.tagvalue_set("haproxy:frontend:option:") %}
option {{option}}
{% endfor %}
{% for timeout in group.tagvalue_set("haproxy:frontend:timeout:") %}
timeout {{timeout.split(':', 1)[0]}} {{timeout.split(':', 1)[1]}}
{% endfor %}
{% endfor %}
{% for name, group in groups.items() %}
backend backend-{{name}}
{% for svc in group %}
server {{name}}-srv{{loop.index}} {{svc.ip}}:{{svc.port}} check
{% endfor %}
mode {% if group[0].mode %}{{group[0].mode}}{% else %}tcp{% endif %}
{% for option in group.tagvalue_set("haproxy:backend:option:") %}
option {{option}}
{% endfor %}
{% for timeout in group.tagvalue_set("haproxy:backend:timeout:") %}
timeout {{timeout.split(':', 1)[0]}} {{timeout.split(':', 1)[1]}}
{% endfor %}
{% endfor %}