forked from nyanloutre/nixos-config
Organisation service HAproxy
This commit is contained in:
parent
f2ac5a7fd1
commit
415c86221b
@ -6,6 +6,78 @@ let
|
|||||||
cfg = config.services.haproxy-acme;
|
cfg = config.services.haproxy-acme;
|
||||||
|
|
||||||
nginx_port = 54321;
|
nginx_port = 54321;
|
||||||
|
|
||||||
|
haproxyConf = ''
|
||||||
|
global
|
||||||
|
log /dev/log local0
|
||||||
|
log /dev/log local1 notice
|
||||||
|
user haproxy
|
||||||
|
group haproxy
|
||||||
|
ssl-default-bind-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
|
||||||
|
ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
|
||||||
|
ssl-default-server-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
|
||||||
|
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
|
||||||
|
defaults
|
||||||
|
option forwardfor
|
||||||
|
option http-server-close
|
||||||
|
timeout client 10s
|
||||||
|
timeout connect 4s
|
||||||
|
timeout server 30s
|
||||||
|
userlist LOUTRE
|
||||||
|
user paul password $6$6rDdCtzSVsAwB6KP$V8bR7KP7FSL2BSEh6n3op6iYhAnsVSPI2Ar3H6MwKrJ/lZRzUI8a0TwVBD2JPnAntUhLpmRudrvdq2Ls2odAy.
|
||||||
|
frontend public
|
||||||
|
bind :::80 v4v6
|
||||||
|
bind :::443 v4v6 ssl crt /var/lib/acme/${cfg.domaine}/full.pem alpn h2,http/1.1
|
||||||
|
mode http
|
||||||
|
acl letsencrypt-acl path_beg /.well-known/acme-challenge/
|
||||||
|
acl haproxy-acl path_beg /haproxy
|
||||||
|
redirect scheme https code 301 if !{ ssl_fc } !letsencrypt-acl
|
||||||
|
http-response set-header Strict-Transport-Security max-age=15768000
|
||||||
|
use_backend letsencrypt-backend if letsencrypt-acl
|
||||||
|
use_backend haproxy_stats if haproxy-acl
|
||||||
|
|
||||||
|
${concatStrings (
|
||||||
|
mapAttrsToList (name: value:
|
||||||
|
" acl ${name}-acl hdr(host) -i ${name}\n"
|
||||||
|
+ " use_backend ${name}-backend if ${name}-acl\n"
|
||||||
|
) cfg.services)}
|
||||||
|
|
||||||
|
backend letsencrypt-backend
|
||||||
|
mode http
|
||||||
|
server letsencrypt 127.0.0.1:${toString nginx_port}
|
||||||
|
backend haproxy_stats
|
||||||
|
mode http
|
||||||
|
stats enable
|
||||||
|
stats hide-version
|
||||||
|
acl AuthOK_LOUTRE http_auth(LOUTRE)
|
||||||
|
http-request auth realm LOUTRE if !AuthOK_LOUTRE
|
||||||
|
|
||||||
|
${concatStrings (
|
||||||
|
mapAttrsToList (name: value:
|
||||||
|
''
|
||||||
|
backend ${name}-backend
|
||||||
|
mode http
|
||||||
|
${(
|
||||||
|
if value.socket == "" then
|
||||||
|
''
|
||||||
|
server ${name} ${value.ip}:${toString value.port}
|
||||||
|
''
|
||||||
|
else
|
||||||
|
''
|
||||||
|
server ${name} ${value.socket}
|
||||||
|
''
|
||||||
|
)}
|
||||||
|
${(if value.auth then (
|
||||||
|
value.extraAcls
|
||||||
|
+ ''
|
||||||
|
acl AUTH_OK http_auth(LOUTRE)
|
||||||
|
http-request auth realm LOUTRE if ${value.aclBool}
|
||||||
|
''
|
||||||
|
) else "")}
|
||||||
|
''
|
||||||
|
) cfg.services)}
|
||||||
|
|
||||||
|
'';
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
options.services.haproxy-acme = {
|
options.services.haproxy-acme = {
|
||||||
@ -43,77 +115,7 @@ in
|
|||||||
|
|
||||||
services.haproxy.enable = true;
|
services.haproxy.enable = true;
|
||||||
|
|
||||||
services.haproxy.config = ''
|
services.haproxy.config = haproxyConf;
|
||||||
global
|
|
||||||
log /dev/log local0
|
|
||||||
log /dev/log local1 notice
|
|
||||||
user haproxy
|
|
||||||
group haproxy
|
|
||||||
ssl-default-bind-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
|
|
||||||
ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
|
|
||||||
ssl-default-server-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
|
|
||||||
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
|
|
||||||
defaults
|
|
||||||
option forwardfor
|
|
||||||
option http-server-close
|
|
||||||
timeout client 10s
|
|
||||||
timeout connect 4s
|
|
||||||
timeout server 30s
|
|
||||||
userlist LOUTRE
|
|
||||||
user paul password $6$6rDdCtzSVsAwB6KP$V8bR7KP7FSL2BSEh6n3op6iYhAnsVSPI2Ar3H6MwKrJ/lZRzUI8a0TwVBD2JPnAntUhLpmRudrvdq2Ls2odAy.
|
|
||||||
frontend public
|
|
||||||
bind :::80 v4v6
|
|
||||||
bind :::443 v4v6 ssl crt /var/lib/acme/${cfg.domaine}/full.pem alpn h2,http/1.1
|
|
||||||
mode http
|
|
||||||
acl letsencrypt-acl path_beg /.well-known/acme-challenge/
|
|
||||||
acl haproxy-acl path_beg /haproxy
|
|
||||||
redirect scheme https code 301 if !{ ssl_fc } !letsencrypt-acl
|
|
||||||
http-response set-header Strict-Transport-Security max-age=15768000
|
|
||||||
use_backend letsencrypt-backend if letsencrypt-acl
|
|
||||||
use_backend haproxy_stats if haproxy-acl
|
|
||||||
|
|
||||||
${concatStrings (
|
|
||||||
mapAttrsToList (name: value:
|
|
||||||
" acl ${name}-acl hdr(host) -i ${name}\n"
|
|
||||||
+ " use_backend ${name}-backend if ${name}-acl\n"
|
|
||||||
) cfg.services)}
|
|
||||||
|
|
||||||
backend letsencrypt-backend
|
|
||||||
mode http
|
|
||||||
server letsencrypt 127.0.0.1:${toString nginx_port}
|
|
||||||
backend haproxy_stats
|
|
||||||
mode http
|
|
||||||
stats enable
|
|
||||||
stats hide-version
|
|
||||||
acl AuthOK_LOUTRE http_auth(LOUTRE)
|
|
||||||
http-request auth realm LOUTRE if !AuthOK_LOUTRE
|
|
||||||
|
|
||||||
${concatStrings (
|
|
||||||
mapAttrsToList (name: value:
|
|
||||||
''
|
|
||||||
backend ${name}-backend
|
|
||||||
mode http
|
|
||||||
${(
|
|
||||||
if value.socket == "" then
|
|
||||||
''
|
|
||||||
server ${name} ${value.ip}:${toString value.port}
|
|
||||||
''
|
|
||||||
else
|
|
||||||
''
|
|
||||||
server ${name} ${value.socket}
|
|
||||||
''
|
|
||||||
)}
|
|
||||||
${(if value.auth then (
|
|
||||||
value.extraAcls
|
|
||||||
+ ''
|
|
||||||
acl AUTH_OK http_auth(LOUTRE)
|
|
||||||
http-request auth realm LOUTRE if ${value.aclBool}
|
|
||||||
''
|
|
||||||
) else "")}
|
|
||||||
''
|
|
||||||
) cfg.services)}
|
|
||||||
|
|
||||||
'';
|
|
||||||
|
|
||||||
services.nginx.enable = true;
|
services.nginx.enable = true;
|
||||||
services.nginx.virtualHosts = {
|
services.nginx.virtualHosts = {
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user