StuRa/stura-infra
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

try to explain haproxy i guess

Browse source
This commit is contained in:
goeranh 2026-02-28 02:10:42 +01:00
parent 65589c1586
commit 45ab9376f5
No known key found for this signature in database
1 changed files with 14 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

17
hosts/proxy/default.nix
View file

@ -157,6 +157,7 @@
timeout client 30s timeout client 30s
timeout server 30s timeout server 30s
# stats seite zeigt backend connection status, wenn check gesetzt ist
frontend stats frontend stats
bind 127.0.0.1:8404 bind 127.0.0.1:8404
mode http mode http
@ -170,12 +171,16 @@
frontend http-in frontend http-in
bind *:80 bind *:80
# hier wird eine regel pro domain aus der forwarder liste generiert
${lib.foldlAttrs ( ${lib.foldlAttrs (
prev: name: value: prev: name: value:
prev + "acl is_${name} hdr(host) -i ${value.domain}\n" prev + "acl is_${name} hdr(host) -i ${value.domain}\n"
) "" forwards} ) "" forwards}
# ist request eine acme challenge?
acl is_acme path_beg /.well-known/acme-challenge/ acl is_acme path_beg /.well-known/acme-challenge/
# pro domain wird ein backend festgelegt und auf https redirected wenn es keine acme request ist
${lib.foldlAttrs ( ${lib.foldlAttrs (
prev: name: value: prev: name: value:
prev + '' prev + ''
@ -184,11 +189,15 @@
'' ''
) "" forwards} ) "" forwards}
# das default backend zeigt die liste aller redirects an
# die liste darf nicht auf 443 redirected werden, da cert fehlt
default_backend default_backend default_backend default_backend
# ssh redirect srs2
frontend ssh_jump_alt frontend ssh_jump_alt
bind *:2142 bind *:2142
mode tcp mode tcp
# gönn mal session timeout
timeout client 30m timeout client 30m
log-format "%ci:%cp [%t] %ft %b/%s %Tw/%Tc/%Tt %B %ts %ac/%fc/%bc/%sc/%rc %sq/%bq dst:%[var(sess.dst)] " log-format "%ci:%cp [%t] %ft %b/%s %Tw/%Tc/%Tt %B %ts %ac/%fc/%bc/%sc/%rc %sq/%bq dst:%[var(sess.dst)] "
use_backend ssh_srs2 use_backend ssh_srs2
@ -197,19 +206,22 @@
frontend sni_router frontend sni_router
bind *:443 bind *:443
mode tcp mode tcp
# mehrere pakete puffern und connection beenden wenn es kein ssl handshake sieht
tcp-request inspect-delay 1s tcp-request inspect-delay 1s
tcp-request content accept if { req_ssl_hello_type 1 } tcp-request content accept if { req_ssl_hello_type 1 }
# terminated here # tcp redirect der anwendung basierend auf ssl_sni handshake parameter
${lib.foldlAttrs ( ${lib.foldlAttrs (
prev: name: value: prev: name: value:
prev + "use_backend ${name}_443 if { req_ssl_sni -i ${value.domain} }\n" prev + "use_backend ${name}_443 if { req_ssl_sni -i ${value.domain} }\n"
) "" forwards} ) "" forwards}
# default backend http static file generated above
backend default_backend backend default_backend
mode http mode http
http-request return status 200 content-type "text/html" file ${indexPage} http-request return status 200 content-type "text/html" file ${indexPage}
# ssh srs2 backend
backend ssh_srs2 backend ssh_srs2
mode tcp mode tcp
timeout server 30m timeout server 30m
@ -217,6 +229,7 @@
option tcpka option tcpka
server srs2 141.56.51.2:80 check server srs2 141.56.51.2:80 check
# ein backend pro forwards eintrag für port 80 und 443
${lib.foldlAttrs ( ${lib.foldlAttrs (
prev: name: value: prev: name: value:
prev prev
@ -236,8 +249,6 @@
}; };
environment.systemPackages = with pkgs; [ environment.systemPackages = with pkgs; [
openvpn
tcpdump
]; ];
system.stateVersion = "25.11"; system.stateVersion = "25.11";