dts-services-haproxy/haproxy.cfg at main · cityofaustin/dts-services-haproxy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
global
    maxconn 4096

    # generated 2025-05-14, Mozilla Guideline v5.7, HAProxy 3.0, OpenSSL 3.4.0, intermediate config
    # https://ssl-config.mozilla.org/#server=haproxy&version=3.0&config=intermediate&openssl=3.4.0&guideline=5.7

    ssl-default-bind-curves X25519:prime256v1:secp384r1
    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
    ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
    ssl-default-bind-options prefer-client-ciphers ssl-min-ver TLSv1.2 no-tls-tickets

    ssl-default-server-curves X25519:prime256v1:secp384r1
    ssl-default-server-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
    ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
    ssl-default-server-options ssl-min-ver TLSv1.2 no-tls-tickets
    log stdout local0 info

defaults
    log     global
    option  dontlognull
    timeout connect 5s
    timeout client  50s
    timeout server  50s

frontend http_front
    bind *:80
    mode http
    log global

    capture request header host len 256
    capture request header referer len 512
    capture request header user-agent len 512

    log-format "%ci - - [%t] \"%r\" %ST %B \"%[capture.req.hdr(1)]\" \"%[capture.req.hdr(2)]\""

    redirect scheme https code 301 if !{ ssl_fc }


frontend https_front
    bind *:443 ssl crt /usr/local/etc/haproxy/ssl/equitytool.austinmobility.io.pem crt /usr/local/etc/haproxy/ssl/atd-postgrest.austinmobility.io.pem crt /usr/local/etc/haproxy/ssl/citybase.austinmobility.io.pem crt /usr/local/etc/haproxy/ssl/citybase-staging.austinmobility.io.pem crt /usr/local/etc/haproxy/ssl/citybase-uat.austinmobility.io.pem crt /usr/local/etc/haproxy/ssl/umami.austinmobility.io.pem alpn h2,http/1.1
    mode http
    option httplog

    capture request header host len 256
    capture request header referer len 512
    capture request header user-agent len 512

    log-format "%ci - - [%t] \"%r\" %ST %B \"%[capture.req.hdr(1)]\" \"%[capture.req.hdr(2)]\" backend=%s/%b"

    # to use postgrest, you need to be:

    # 1) using an approved path
    # 2) using the postgrest hostname
    # 3) be coming in from the COA network

    acl host_postgrest hdr(host) -i atd-postgrest.austinmobility.io
    acl src_postgrest_coa_network src 162.89.100.0/24

    use_backend postgrest if host_postgrest src_postgrest_coa_network


    # Use the equitymap backend if the equitymap ACL matches
    acl host_equitytool hdr(host) -i -m beg equitytool.austinmobility.io
    use_backend equitymap if host_equitytool

    # Citybase backends
    acl host_citybase_production hdr(host) -i citybase.austinmobility.io
    use_backend citybase_production if host_citybase_production
    acl host_citybase_staging hdr(host) -i citybase-staging.austinmobility.io
    use_backend citybase_staging if host_citybase_staging
    acl host_citybase_uat hdr(host) -i citybase-uat.austinmobility.io
    use_backend citybase_uat if host_citybase_uat

    # Umami backend
    acl host_umami hdr(host) -i umami.austinmobility.io
    use_backend umami if host_umami

    default_backend server_not_found

frontend postgresql_front
    mode tcp
    timeout client 10m
    bind *:5432
    default_backend postgresql_back

backend postgrest
    mode http
    server postgrest_server host.docker.internal:9001 check

backend equitymap
    mode http
    server equitymap_server host.docker.internal:9000 check

backend citybase_production
    mode http
    server citybase_production_server host.docker.internal:13100 check

backend citybase_staging
    mode http
    server citybase_staging_server host.docker.internal:13101 check

backend citybase_uat
    mode http
    server citybase_uat_server host.docker.internal:13102 check

backend umami
    mode http
    server umami_server host.docker.internal:3000 check

backend postgresql_back
  timeout server 10m
  server postgresql_server ${DATABASE_SERVER}:5432

backend server_not_found
    mode http
    # return 403
    http-request deny