51 lines
1.7 KiB
Plaintext
51 lines
1.7 KiB
Plaintext
# Template for a dedicated Ubuntu 24.04 relay. Render with configure-oracle.py.
|
|
# No TLS termination, certificates, PROXY protocol, or personal proxy on Oracle.
|
|
global
|
|
log /dev/log local0
|
|
user haproxy
|
|
group haproxy
|
|
daemon
|
|
maxconn 2048
|
|
maxconnrate 400
|
|
stats socket /run/haproxy/admin.sock mode 600 level admin
|
|
stats timeout 10s
|
|
# Reloads drain old connections for at most 10 minutes, then cut them.
|
|
hard-stop-after 10m
|
|
|
|
defaults
|
|
log global
|
|
mode tcp
|
|
option tcplog
|
|
option dontlognull
|
|
timeout connect 5s
|
|
timeout client 5m
|
|
timeout server 5m
|
|
timeout client-fin 15s
|
|
timeout server-fin 15s
|
|
timeout check 5s
|
|
timeout queue 5s
|
|
|
|
frontend home_https
|
|
bind 0.0.0.0:443
|
|
maxconn 2048
|
|
backlog 2048
|
|
stick-table type ip size 100k expire 30s store conn_cur,conn_rate(1s)
|
|
tcp-request connection track-sc0 src
|
|
tcp-request connection reject if { sc0_conn_cur gt 100 }
|
|
tcp-request connection reject if { sc0_conn_rate gt 30 }
|
|
|
|
# Wait at most 5s for an ordinary TLS ClientHello for an allowed SNI.
|
|
# This is routing hygiene, not user authentication or HTTP filtering.
|
|
tcp-request inspect-delay 5s
|
|
acl hello req.ssl_hello_type 1
|
|
acl allowed_sni req.ssl_sni -m reg -i ^([a-z0-9-]+\.)*@@DOMAIN_REGEX@@$
|
|
tcp-request content reject if hello !allowed_sni
|
|
tcp-request content accept if hello allowed_sni
|
|
tcp-request content reject if WAIT_END
|
|
default_backend home_npm
|
|
|
|
backend home_npm
|
|
# TCP checks only. The home watchdog verifies HTTPS and the response body.
|
|
# Fixed current home IPv4. Update this if your ISP changes the address.
|
|
server home @@HOME_IPV4@@:443 check inter 5s fall 3 rise 2
|