monero-pool/haproxy.cfg at master · jessy2027/monero-pool · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
# =============================================================================
# HAProxy Configuration for EuroXMR SSL Stratum
# =============================================================================
# This configuration provides TLS termination for the Stratum mining protocol
# Miners can connect securely on port 4343 with SSL/TLS encryption
# =============================================================================

global
    log stdout format raw local0
    maxconn 4096
    # SSL tuning
    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
    ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets
    tune.ssl.default-dh-param 2048

defaults
    log     global
    mode    tcp
    option  tcplog
    option  dontlognull
    timeout connect 10s
    timeout client  120s
    timeout server  120s
    retries 3

# =============================================================================
# Frontend: SSL Stratum (port 4343)
# =============================================================================
frontend stratum_ssl
    bind *:4343 ssl crt /etc/ssl/certs/euroxmr.pem
    mode tcp
    option tcplog

    default_backend stratum_pool

# =============================================================================
# Frontend: HTTPS Web UI (port 443)
# =============================================================================
frontend web_https
    bind *:443 ssl crt /etc/ssl/certs/euroxmr.pem
    mode http
    option httplog

    # Redirect HTTP to HTTPS
    http-request redirect scheme https unless { ssl_fc }

    # Security headers
    http-response set-header Strict-Transport-Security "max-age=31536000; includeSubDomains"
    http-response set-header X-Content-Type-Options "nosniff"
    http-response set-header X-Frame-Options "SAMEORIGIN"

    default_backend web_pool

# =============================================================================
# Backend: Monero Pool Stratum
# =============================================================================
backend stratum_pool
    mode tcp
    balance roundrobin
    option tcp-check

    # Health check
    server pool1 monero-pool:4242 check inter 30s fall 3 rise 2

# =============================================================================
# Backend: Monero Pool Web UI
# =============================================================================
backend web_pool
    mode http
    balance roundrobin
    option httpchk GET /

    # Health check
    server web1 monero-pool:80 check inter 30s fall 3 rise 2