Added setup for HAProxy
This commit is contained in:
Matthew Raymer
181
README.md
181
README.md
@@ -22,6 +22,185 @@ networks:
|
||||
external: true
|
||||
```
|
||||
|
||||
ON first run you need to:
|
||||
On first run you need to:
|
||||
|
||||
`docker network create phoenix-network`
|
||||
|
||||
|
||||
## HAProxy setup
|
||||
|
||||
... in docker-compose.yml ...
|
||||
|
||||
```
|
||||
default-backend:
|
||||
container_name: 'default-backend'
|
||||
image: nginx:1.22.0-alpine
|
||||
volumes:
|
||||
- /docker-volumes/haproxy-config/core/nginx/html:/usr/share/nginx/html
|
||||
restart: always
|
||||
networks:
|
||||
- phoenix-network
|
||||
|
||||
rsyslog:
|
||||
container_name: 'rsyslog'
|
||||
hostname: 'rsyslog'
|
||||
image: alpine-rsyslog
|
||||
build:
|
||||
context: ./alpine-rsyslog
|
||||
volumes:
|
||||
- $PWD/haproxy-config/core/haproxy.conf:/etc/rsyslog.d/haproxy.conf
|
||||
- $PWD/haproxy-config/log:/var/log
|
||||
- $PWD/haproxy-config/spool:/var/spool
|
||||
- $PWD/rsyslog/rsyslog.conf:/etc/rsyslog.conf
|
||||
ports:
|
||||
- '127.0.0.1:514:514'
|
||||
networks:
|
||||
- phoenix-network
|
||||
|
||||
|
||||
haproxy:
|
||||
container_name: 'haproxy'
|
||||
hostname: 'haproxy'
|
||||
image: haproxytech/haproxy-alpine:latest
|
||||
ports:
|
||||
- 443:443
|
||||
- 80:80
|
||||
depends_on:
|
||||
- default-backend
|
||||
- rsyslog
|
||||
volumes:
|
||||
- $PWD/haproxy-config/log:/var/log
|
||||
- $PWD/haproxy-config/certs:/usr/local/etc/haproxy/certs:ro
|
||||
- $PWD/haproxy-config/core:/usr/local/etc/haproxy/core:ro
|
||||
- $PWD/haproxy-config/maps:/usr/local/etc/haproxy/maps:ro
|
||||
- $PWD/haproxy-config/sites:/usr/local/etc/haproxy/sites:ro
|
||||
command: "haproxy -f /usr/local/etc/haproxy/core/haproxy.cfg -f /usr/local/etc/haproxy/sites/"
|
||||
networks:
|
||||
- phoenix-network
|
||||
|
||||
```
|
||||
|
||||
in `haproxy-config/core/haproxy.conf`:
|
||||
|
||||
```
|
||||
$UDPServerAddress 127.0.0.1
|
||||
$UDPServerRun 514
|
||||
local0.* /var/log/haproxy.log
|
||||
& ~
|
||||
```
|
||||
|
||||
in `haproxy-config/core/haproxy.cfg`:
|
||||
|
||||
```
|
||||
global
|
||||
tune.ssl.default-dh-param 2048
|
||||
log rsyslog:514 local0
|
||||
maxconn 4096
|
||||
|
||||
defaults
|
||||
option httplog
|
||||
option forwardfor except 127.0.0.1
|
||||
option forwardfor header X-Real-IP
|
||||
option http-no-delay
|
||||
log global
|
||||
mode http
|
||||
|
||||
retries 10
|
||||
option redispatch
|
||||
timeout connect 4000
|
||||
timeout client 600000
|
||||
timeout server 600000
|
||||
timeout queue 10s
|
||||
|
||||
frontend default_frontend
|
||||
mode http
|
||||
|
||||
bind *:80
|
||||
bind *:443 ssl crt /usr/local/etc/haproxy/certs alpn h2,http/1.1
|
||||
|
||||
# redirect non-www
|
||||
|
||||
# http-request redirect prefix https://%[hdr(Host),regsub(^www\.,,i)] code 301 if { hdr_beg(host) -i www. }
|
||||
|
||||
# Make a rule that the server cannot be directly accessed by IP address
|
||||
|
||||
acl has_domain hdr(Host),map_str(/usr/local/etc/haproxy/maps/domains.map) -m found
|
||||
http-request deny if !has_domain
|
||||
|
||||
# ACME challenge rule?
|
||||
|
||||
acl letsencrypt-acl path_beg /.well-known/acme-challenge/
|
||||
redirect code 301 scheme https if !{ ssl_fc && letsencrypt-acl }
|
||||
compression algo gzip
|
||||
compression type text/css text/html text/javascript application/javascript text/plain text/xml application/json image/svg+xml
|
||||
acl is_content_type_html res.hdr(Content-Type) -i text/html
|
||||
http-response set-header Content-Type text/html;\ charset=UTF-8 if is_content_type_html
|
||||
http-response set-header Cache-Control no-cache,\ max-age=31536000
|
||||
http-response set-header Expires %[date(3600),http_date]
|
||||
http-response set-header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
|
||||
http-response set-header X-XSS-Protection "1; mode=block"
|
||||
http-response set-header X-Content-Type-Options "nosniff"
|
||||
http-response set-header Referrer-Policy "strict-origin-when-cross-origin"
|
||||
use_backend %[base,lower,regsub(^www\.,,i),map_beg(/usr/local/etc/haproxy/maps/sites.map,default_backend)]
|
||||
|
||||
|
||||
listen stats
|
||||
bind *:9999
|
||||
mode http
|
||||
log global
|
||||
stats enable
|
||||
stats realm Haproxy\ Statistics
|
||||
stats uri /haproxy_stats
|
||||
stats hide-version
|
||||
|
||||
|
||||
backend haproxy_stats_backend
|
||||
http-request auth realm haproxy-stats unless { http_auth_group(basic-auth-list) is-haproxy-stats }
|
||||
mode http
|
||||
compression algo gzip
|
||||
compression offload
|
||||
server server_nginx localhost:9999
|
||||
|
||||
|
||||
userlist basic-auth-list
|
||||
group is-guest
|
||||
group is-haproxy-stats
|
||||
|
||||
user guest password $5$N7CpS0mo$FyJtlwQOwzAi5HnCISumyBKWyPu6DhBO7eGzUUyWoJ7 groups is-guest
|
||||
```
|
||||
|
||||
... in `haproxy-config/sites/web-push.anomalistlabs.com.cfg` ...
|
||||
|
||||
define an HAProxy backend and map it to the Docker host and port
|
||||
NOTE: this also turned off CORS origin rule
|
||||
```
|
||||
backend web_push_backend
|
||||
mode http
|
||||
compression algo gzip
|
||||
compression offload
|
||||
http-response set-header Access-Control-Allow-Origin "*"
|
||||
server server_nginx endorser-push-server:3000
|
||||
```
|
||||
|
||||
... in `haproxy-config/maps/domains.map` ...
|
||||
|
||||
add a domain that will be used as a base
|
||||
|
||||
```
|
||||
timesafari.anomalistlabs.com
|
||||
```
|
||||
|
||||
|
||||
... in `haproxy-config/maps/sites.map` ...
|
||||
|
||||
map the `/web-push` path to the `web_push_backend`
|
||||
NOTE: `timesafari-pwa.anomalistlabs.com` PWA sits on the root
|
||||
|
||||
```
|
||||
timesafari-pwa.anomalistlabs.com/web-push/ web_push_backend
|
||||
```
|
||||
|
||||
## The rest ..
|
||||
|
||||
`docker-compose up -d` should just work :-)
|
||||
|
||||
|
||||
Reference in New Issue
Block a user