Setting up haproxy

We need a few configuration files for haproxy. All these files go in the haproxy directory /srv/docker/clrghouz/haproxy). Make adjustments as appropriate.

This is 10-default.cfg

global
    log stdout format raw local0
    ssl-default-bind-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
    ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets
    user haproxy
    group haproxy

defaults
    mode tcp
    timeout connect 5s
    timeout client 10m
    timeout server 10m

#    email-alert mailers mailers
#    email-alert from me@example.com
#    email-alert to me@example.com

    option tcplog
    log global

#mailers mailers
#    mailer smtp [YOUR MAIL SERVER]:25

#resolvers dns
#    nameserver dns1 [YOUR DNS SERVER]:53

frontend stats
    bind :::8080
    mode http
    stats uri /
    stats enable
    stats refresh 10s

This is 20-clrghouz.cfg

# EMSI
frontend fe-clrg-emsi
    bind :::60179 v4v6
    default_backend be-clrg-emsi
    maxconn 4

    # Track the backend state - and reject any attempts if its down
    acl be-emsi-dead nbsrv(be-clrg-emsi) lt 1
    tcp-request connection reject if be-emsi-dead

    # stick table definition for storing rates
    stick-table type ipv6 size 500k expire 30m store conn_cur,conn_rate(60s)

    ## Allow clean known IPs to bypass the filter
    tcp-request connection accept if { src -f /usr/local/etc/haproxy/config/whitelist.lst }
    # Only allow 1 connections per IP opened
    tcp-request connection reject if { src_conn_cur ge 1 }
    # Only allow 1 connections per 60s
    tcp-request connection reject if { src_conn_rate ge 3 }
    tcp-request connection track-sc1 src

backend be-clrg-emsi
    balance roundrobin
    server clrghouz clrghouz-web-1:60179 send-proxy-v2

# BINKP
frontend fe-clrg-binkp
    bind :::24554 v4v6
    default_backend be-clrg-binkp
    maxconn 10

    stick-table type ipv6 size 500k expire 30m store conn_cur,conn_rate(60s)

    ## Allow clean known IPs to bypass the filter
    tcp-request connection accept if { src -f /usr/local/etc/haproxy/config/whitelist.lst }
    # Only allow 1 connections per IP opened
    tcp-request connection reject if { src_conn_cur ge 1 }
    # Only allow 1 connections per 60s
    tcp-request connection reject if { src_conn_rate ge 3 }
    tcp-request connection track-sc1 src

# BINKPS
frontend fe-clrg-binkps
    bind :::24553 v4v6 tfo ssl crt /usr/local/etc/haproxy/config/binkps.pem
    default_backend be-clrg-binkp
    maxconn 10

backend be-clrg-binkp
    balance roundrobin
    server clrghouz clrghouz-web-1:24554 send-proxy-v2

This is 20-https.cfg

frontend fe-http
    mode http
    bind :::80
    bind :::443 ssl crt-list /usr/local/etc/haproxy/config/crt-list.conf
    http-request add-header X-Forwarded-Proto https
    http-request redirect scheme https unless { ssl_fc }
    use_backend be-http-clrghouz if { ssl_fc_sni -i clrghouz.bbs.dege.au }
#    default_backend be-http-docker
    default_backend be-http-clrghouz

backend be-http-clrghouz
    mode http
    balance leastconn
    server clrghouz clrghouz-web-1:80

#backend be-http-docker
#    mode http
#    balance leastconn
#    server docker [YOUR WEBSERVER]:80

This is binkps.pem:

This is crt-list.conf

/usr/local/etc/haproxy/config/binkps.pem *.[YOUR DOMAIN]

This is whitelist.lst

#[IP6_PREFIX]::/MASK
2001:db8::/32