home-stack-ansible/roles/haproxy/templates/haproxy.cfg

global
    daemon
    maxconn 1024
    log 127.0.0.1 local0
    stats timeout 30s

    tune.ssl.default-dh-param 2048

defaults
    log global
    log /dev/log local0 notice

    timeout connect 5s
    timeout client 120s
    timeout server 120s
    timeout tunnel 1h

    default-server init-addr last,none resolvers dns

resolvers dns
    parse-resolv-conf

## FRONTENDS ##

# haproxy stuff
frontend http_management
    bind *:8080
    mode http

    # redirects /status to haproxy monitor
    monitor-uri /status

    # redirects /stats to stats backend
    acl prefixed-with-stats path_beg -i /stats
    use_backend haproxy_stats if prefixed-with-stats

    # redirects /metrics to metrics backend
    acl prefixed-with-metrics path_beg -i /metrics
    use_backend haproxy_metrics if prefixed-with-metrics

frontend http_in
    bind *:80
    mode http

    # force https
    redirect scheme https

# https frontend
frontend https_in
    # backend is assumed to be http, perform ssl termination here
    bind *:443 ssl crt /etc/letsencrypt/live/{{ letsencrypt.domains[0] }}/{{ letsencrypt.domains[0] }}.pem alpn h2,http/1.1

    mode http
    option httplog

    # set HSTS
    http-response set-header Strict-Transport-Security "max-age=15552000; includeSubDomains;"

    # set X-Forward-For
    http-request del-header x-forwarded-for
    option forwardfor

    # set X-Forwarded-Proto
    http-request set-header X-Forwarded-Proto https

    default_backend default_backend

{% for http_route in https_routing %}
    use_backend https_{{ http_route.frontend[0]|replace('.','_') }} if { hdr_end(host) -i {% for src in http_route.frontend %}{{ src }} {% endfor %}}{% if 'allowlist' in http_route %} { src {% for ip in http_route.allowlist %}{{ ip }} {% endfor %}}{% endif %} 
{% endfor %}

## BACKENDS ##

# stat backend
backend haproxy_stats
    mode http
    stats uri /stats
    stats enable
    stats refresh 10s
    stats auth admin:admin

# metric backend
backend haproxy_metrics
    mode http
    http-request use-service prometheus-exporter

backend default_backend
    mode http
    http-request deny deny_status 404

{% for http_route in https_routing %}
# backend for {{ ', '.join(http_route.frontend) }}
backend https_{{ http_route.frontend[0]|replace('.','_') }}
    mode http
    balance roundrobin
{% for dst in http_route.backend %}
    server {{ dst.server }} {{ dst.server }}{% if ':' not in dst.server %}:443{% endif %} check {% if http_route.ssl|default(true) %}ssl verify none alpn h2,http/1.1{% endif %} {{ dst.extra_param|default('') }} 
{% endfor %}

{% endfor %}

## TCP ##

{% for tcp_route in tcp_routing %}
frontend tcp_{{ tcp_route.frontend }}
    bind *:{{ tcp_route.frontend }}
    mode tcp
    use_backend tcp_{{ tcp_route.frontend }}

backend tcp_{{ tcp_route.frontend }}
    mode tcp
{% for dst in tcp_route.backend %}
    server {{ dst.server }} {{ dst.server }} check {{ dst.extra_param|default('') }}
{% endfor %}
{% endfor %}