containermon/haproxy.cfg at main · Paslestrange/containermon · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
userlist authenticated
  user "$HTTP_BASIC_AUTH_USER" insecure-password "$HTTP_BASIC_AUTH_PASSWORD"

global
  log 127.0.0.1 local2 info
  pidfile /run/haproxy.pid
  daemon

  # Default SSL material locations
  ca-base /certs

  # Default ciphers to use on SSL-enabled listening sockets.
  # For more information, see ciphers(1SSL). This list is from:
  #  https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
  ssl-default-bind-ciphers EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
  ssl-default-bind-options no-sslv3 no-tlsv10
  ssl-default-server-ciphers EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH

  tune.ssl.default-dh-param 2048
  tune.ssl.cachesize 1000000
  tune.ssl.lifetime 3600

defaults
  log global
  mode http
  option httplog
  option dontlognull
  timeout connect 5000
  timeout client  50000
  timeout server  50000
  errorfile 400 /etc/haproxy/errors/400.http
  errorfile 403 /etc/haproxy/errors/403.http
  errorfile 408 /etc/haproxy/errors/408.http
  errorfile 500 /etc/haproxy/errors/500.http
  errorfile 502 /etc/haproxy/errors/502.http
  errorfile 503 /etc/haproxy/errors/503.http
  errorfile 504 /etc/haproxy/errors/504.http

# HAProxy Stats (optional - for monitoring HAProxy itself)
listen stats
  bind *:1936
  stats enable
  stats uri /
  stats hide-version
  stats auth admin:admin

# Main frontend - handles all HTTPS traffic on port 443
frontend https_frontend
  bind *:443 ssl crt /certs/live/${DOMAIN}/fullchain.pem no-sslv3
  mode http
  http-request set-header X-Forwarded-For %[src]
  reqadd X-Forwarded-Proto:\ https
  option http-server-close

  # Route based on path
  acl is_dozzle path_beg /dozzle
  acl is_netdata path_beg /netdata

  # Authentication checks are enforced in backends

  # Route to appropriate backend
  use_backend dozzle_backend if is_dozzle
  use_backend netdata_backend if is_netdata

  # Default to monitoring UI
  default_backend monitoring_ui_backend

# Monitoring UI backend (main dashboard)
backend monitoring_ui_backend
  mode http
  balance leastconn
  server monitoring-ui monitoring-ui:80 check

# Dozzle backend
backend dozzle_backend
  mode http
  balance leastconn
  http-request auth realm haproxy_basic_auth unless { http_auth(authenticated) }
  http-request set-path %[path,regsub(^/dozzle,/,)]
  server dozzle dozzle:8080 check

# Netdata backend
backend netdata_backend
  mode http
  balance leastconn
  http-request auth realm haproxy_basic_auth unless { http_auth(authenticated) }
  http-request set-path %[path,regsub(^/netdata,/,)]
  server netdata netdata:19999 check