Gitiles
Code Review Sign In
gerrit.nordix.org / onap / oom / 27fd7d8750ceeb798052eb8af36264c79b6536fb / . / kubernetes / aai / resources / config / haproxy / haproxy.cfg
blob: 1db4addb5a18516b2d82d1cd0ae648bb088f4539 [file] [log] [blame]
Sylvain Desbureaux47eb4d22020-12-10 12:15:27 +0100[diff] [blame]1{{/*
Sylvain Desbureaux70070412020-11-09 21:58:48 +0100[diff] [blame]2# Copyright © 2018 Amdocs, Bell Canada, AT&T
3#
4# Licensed under the Apache License, Version 2.0 (the "License");
5# you may not use this file except in compliance with the License.
6# You may obtain a copy of the License at
7#
8# http://www.apache.org/licenses/LICENSE-2.0
9#
10# Unless required by applicable law or agreed to in writing, software
11# distributed under the License is distributed on an "AS IS" BASIS,
12# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13# See the License for the specific language governing permissions and
14# limitations under the License.
Sylvain Desbureaux47eb4d22020-12-10 12:15:27 +0100[diff] [blame]15*/}}
Sylvain Desbureaux70070412020-11-09 21:58:48 +0100[diff] [blame]16global
17 log /dev/log local0
18 stats socket /usr/local/etc/haproxy/haproxy.socket mode 660 level admin
19 stats timeout 30s
20 daemon
21 #################################
22 # Default SSL material locations#
23 #################################
24 ca-base /etc/ssl/certs
25 crt-base /etc/ssl/private
26
27 # Default ciphers to use on SSL-enabled listening sockets.
28 # For more information, see ciphers(1SSL). This list is from:
29 # https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
30 # An alternative list with additional directives can be obtained from
31 # https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=haproxy
32 tune.ssl.default-dh-param 2048
33
34defaults
35 log global
36 mode http
37 option httplog
osk1146127fd7d82021-06-18 00:51:17 +0200[diff] [blame^]38{{- if ( include "common.needTLS" .) }}
Sylvain Desbureaux70070412020-11-09 21:58:48 +0100[diff] [blame]39 option ssl-hello-chk
osk1146127fd7d82021-06-18 00:51:17 +0200[diff] [blame^]40{{- end }}
Sylvain Desbureaux70070412020-11-09 21:58:48 +0100[diff] [blame]41 option httpchk GET /aai/util/echo HTTP/1.1\r\nHost:\ aai\r\nX-TransactionId:\ haproxy-0111\r\nX-FromAppId:\ haproxy\r\nAccept:\ application/json\r\nAuthorization:\ Basic\ QUFJOkFBSQ==
42 default-server init-addr none
43# option dontlognull
44# errorfile 400 /etc/haproxy/errors/400.http
45# errorfile 403 /etc/haproxy/errors/403.http
46# errorfile 408 /etc/haproxy/errors/408.http
47# errorfile 500 /etc/haproxy/errors/500.http
48# errorfile 502 /etc/haproxy/errors/502.http
49# errorfile 503 /etc/haproxy/errors/503.http
50# errorfile 504 /etc/haproxy/errors/504.http
51
52 option http-server-close
53 option forwardfor except 127.0.0.1
54 retries 6
55 option redispatch
56 maxconn 50000
57 timeout connect 50000
58 timeout client 480000
59 timeout server 480000
60 timeout http-keep-alive 30000
61
62
osk1146127fd7d82021-06-18 00:51:17 +0200[diff] [blame^]63frontend IST_8080
64 mode http
65 bind 0.0.0.0:8080
66 log-format "%ci:%cp [%tr] %ft %b/%s %TR/%Tw/%Tc/%Tr/%Ta %ST %B %CC \ %CS %tsc %ac/%fc/%bc/%sc/%rc %sq/%bq %hr %hs %{+Q}r"
67 option httplog
68 log global
69 option logasap
70 option forwardfor
71 capture request header Host len 100
72 capture response header Host len 100
73 option log-separate-errors
74 option forwardfor
75 http-request set-header X-Forwarded-Proto http
76 reqadd X-Forwarded-Proto:\ http
77 reqadd X-Forwarded-Port:\ 8080
78
79#######################
80#ACLS FOR PORT 8446####
81#######################
82
83 acl is_Port_8446_generic path_reg -i ^/aai/v[0-9]+/search/generic-query$
84 acl is_Port_8446_nodes path_reg -i ^/aai/v[0-9]+/search/nodes-query$
85 acl is_Port_8446_version path_reg -i ^/aai/v[0-9]+/query$
86 acl is_dsl path_reg -i ^/aai/v[0-9]+/dsl$
87 acl is_named-query path_beg -i /aai/search/named-query
88 acl is_search-model path_beg -i /aai/search/model
89 use_backend IST_AAI_8446 if is_Port_8446_generic or is_Port_8446_nodes or is_Port_8446_version or is_named-query or is_search-model or is_dsl
90
91 default_backend IST_Default_8447
92
93{{- if ( include "common.needTLS" .) }}
Sylvain Desbureaux70070412020-11-09 21:58:48 +0100[diff] [blame]94frontend IST_8443
95 mode http
Sylvain Desbureaux87f49af2020-12-15 11:56:51 +0100[diff] [blame]96 bind 0.0.0.0:8443 name https ssl crt /opt/app/osaaf/local/certs/fullchain.pem
Sylvain Desbureaux70070412020-11-09 21:58:48 +0100[diff] [blame]97# log-format %ci:%cp\ [%t]\ %ft\ %b/%s\ %Tq/%Tw/%Tc/%Tr/%Tt\ %ST\ %B\ %CC\ %CS\ %tsc\ %ac/%fc/%bc/%sc/%rc\ %sq/%bq\ %hr\ %hs\ {%[ssl_c_verify],%{+Q}[ssl_c_s_dn],%{+Q}[ssl_c_i_dn]}\ %{+Q}r
98 log-format "%ci:%cp [%tr] %ft %b/%s %TR/%Tw/%Tc/%Tr/%Ta %ST %B %CC \ %CS %tsc %ac/%fc/%bc/%sc/%rc %sq/%bq %hr %hs %{+Q}r"
99 option httplog
100 log global
101 option logasap
102 option forwardfor
103 capture request header Host len 100
104 capture response header Host len 100
105 option log-separate-errors
106 option forwardfor
107 http-request set-header X-Forwarded-Proto https if { ssl_fc }
108 http-request set-header X-AAI-Client-SSL TRUE if { ssl_c_used }
109 http-request set-header X-AAI-SSL %[ssl_fc]
110 http-request set-header X-AAI-SSL-Client-Verify %[ssl_c_verify]
111 http-request set-header X-AAI-SSL-Client-DN %{+Q}[ssl_c_s_dn]
112 http-request set-header X-AAI-SSL-Client-CN %{+Q}[ssl_c_s_dn(cn)]
113 http-request set-header X-AAI-SSL-Issuer %{+Q}[ssl_c_i_dn]
114 http-request set-header X-AAI-SSL-Client-NotBefore %{+Q}[ssl_c_notbefore]
115 http-request set-header X-AAI-SSL-Client-NotAfter %{+Q}[ssl_c_notafter]
116 http-request set-header X-AAI-SSL-ClientCert-Base64 %{+Q}[ssl_c_der,base64]
117 http-request set-header X-AAI-SSL-Client-OU %{+Q}[ssl_c_s_dn(OU)]
118 http-request set-header X-AAI-SSL-Client-L %{+Q}[ssl_c_s_dn(L)]
119 http-request set-header X-AAI-SSL-Client-ST %{+Q}[ssl_c_s_dn(ST)]
120 http-request set-header X-AAI-SSL-Client-C %{+Q}[ssl_c_s_dn(C)]
121 http-request set-header X-AAI-SSL-Client-O %{+Q}[ssl_c_s_dn(O)]
122 reqadd X-Forwarded-Proto:\ https
123 reqadd X-Forwarded-Port:\ 8443
osk1146127fd7d82021-06-18 00:51:17 +0200[diff] [blame^]124{{- end }}
Sylvain Desbureaux70070412020-11-09 21:58:48 +0100[diff] [blame]125
126#######################
127#ACLS FOR PORT 8446####
128#######################
129
130 acl is_Port_8446_generic path_reg -i ^/aai/v[0-9]+/search/generic-query$
131 acl is_Port_8446_nodes path_reg -i ^/aai/v[0-9]+/search/nodes-query$
132 acl is_Port_8446_version path_reg -i ^/aai/v[0-9]+/query$
133 acl is_dsl path_reg -i ^/aai/v[0-9]+/dsl$
134 acl is_named-query path_beg -i /aai/search/named-query
135 acl is_search-model path_beg -i /aai/search/model
136 use_backend IST_AAI_8446 if is_Port_8446_generic or is_Port_8446_nodes or is_Port_8446_version or is_named-query or is_search-model or is_dsl
137
138 default_backend IST_Default_8447
139
Sylvain Desbureaux70070412020-11-09 21:58:48 +0100[diff] [blame]140#######################
osk1146127fd7d82021-06-18 00:51:17 +0200[diff] [blame^]141#DEFAULT BACKEND 8447##
Sylvain Desbureaux70070412020-11-09 21:58:48 +0100[diff] [blame]142#######################
143
144backend IST_Default_8447
145 balance roundrobin
146 http-request set-header X-Forwarded-Port %[src_port]
147 http-response set-header Strict-Transport-Security max-age=16000000;\ includeSubDomains;\ preload;
osk1146127fd7d82021-06-18 00:51:17 +0200[diff] [blame^]148{{- if ( include "common.needTLS" .) }}
Sylvain Desbureaux70070412020-11-09 21:58:48 +0100[diff] [blame]149 server aai-resources.{{.Release.Namespace}} aai-resources.{{.Release.Namespace}}.svc.cluster.local:8447 resolvers kubernetes check check-ssl port 8447 ssl verify none
osk1146127fd7d82021-06-18 00:51:17 +0200[diff] [blame^]150{{- else }}
151 server aai-resources.{{.Release.Namespace}} aai-resources.{{.Release.Namespace}}.svc.cluster.local:8447 resolvers kubernetes check port 8447
152{{- end }}
Sylvain Desbureaux70070412020-11-09 21:58:48 +0100[diff] [blame]153
154#######################
155# BACKEND 8446#########
156#######################
157
158backend IST_AAI_8446
159 balance roundrobin
160 http-request set-header X-Forwarded-Port %[src_port]
161 http-response set-header Strict-Transport-Security max-age=16000000;\ includeSubDomains;\ preload;
osk1146127fd7d82021-06-18 00:51:17 +0200[diff] [blame^]162{{- if ( include "common.needTLS" .) }}
Sylvain Desbureaux70070412020-11-09 21:58:48 +0100[diff] [blame]163 server aai-traversal.{{.Release.Namespace}} aai-traversal.{{.Release.Namespace}}.svc.cluster.local:8446 resolvers kubernetes check check-ssl port 8446 ssl verify none
osk1146127fd7d82021-06-18 00:51:17 +0200[diff] [blame^]164{{- else }}
165 server aai-traversal.{{.Release.Namespace}} aai-traversal.{{.Release.Namespace}}.svc.cluster.local:8446 resolvers kubernetes check port 8446
166{{- end }}