blob: 307260e7666234aea4ea33e72ce35ac2be1b5d55 [file] [log] [blame]
Sylvain Desbureaux47eb4d22020-12-10 12:15:27 +01001{{/*
Sylvain Desbureaux70070412020-11-09 21:58:48 +01002# Copyright © 2018 Amdocs, Bell Canada, AT&T
efiacord12c1672023-03-23 12:10:50 +00003# Modifications Copyright © 2023 Nordix Foundation
Sylvain Desbureaux70070412020-11-09 21:58:48 +01004#
5# Licensed under the Apache License, Version 2.0 (the "License");
6# you may not use this file except in compliance with the License.
7# You may obtain a copy of the License at
8#
9# http://www.apache.org/licenses/LICENSE-2.0
10#
11# Unless required by applicable law or agreed to in writing, software
12# distributed under the License is distributed on an "AS IS" BASIS,
13# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14# See the License for the specific language governing permissions and
15# limitations under the License.
Sylvain Desbureaux47eb4d22020-12-10 12:15:27 +010016*/}}
Sylvain Desbureaux70070412020-11-09 21:58:48 +010017global
18 log /dev/log local0
19 stats socket /usr/local/etc/haproxy/haproxy.socket mode 660 level admin
20 stats timeout 30s
leila8bd5bf32022-11-16 19:42:09 -050021 # it is required else pod will not come up
22 maxconn 50000
Niharika Sharma22a994c2022-11-25 11:32:27 -050023 user haproxy
24 group haproxy
Sylvain Desbureaux70070412020-11-09 21:58:48 +010025 daemon
26 #################################
27 # Default SSL material locations#
28 #################################
29 ca-base /etc/ssl/certs
30 crt-base /etc/ssl/private
31
32 # Default ciphers to use on SSL-enabled listening sockets.
33 # For more information, see ciphers(1SSL). This list is from:
34 # https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
35 # An alternative list with additional directives can be obtained from
36 # https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=haproxy
37 tune.ssl.default-dh-param 2048
38
39defaults
40 log global
41 mode http
42 option httplog
43 option ssl-hello-chk
leila8bd5bf32022-11-16 19:42:09 -050044 option httpchk
45 http-check send meth GET uri /aai/util/echo ver HTTP/1.1 hdr Host aai hdr X-TransactionId haproxy-0111 hdr X-FromAppId haproxy hdr Accept application/json hdr Authorization 'Basic QUFJOkFBSQ=='
Sylvain Desbureaux70070412020-11-09 21:58:48 +010046 default-server init-addr none
47# option dontlognull
48# errorfile 400 /etc/haproxy/errors/400.http
49# errorfile 403 /etc/haproxy/errors/403.http
50# errorfile 408 /etc/haproxy/errors/408.http
51# errorfile 500 /etc/haproxy/errors/500.http
52# errorfile 502 /etc/haproxy/errors/502.http
53# errorfile 503 /etc/haproxy/errors/503.http
54# errorfile 504 /etc/haproxy/errors/504.http
55
56 option http-server-close
57 option forwardfor except 127.0.0.1
58 retries 6
59 option redispatch
60 maxconn 50000
61 timeout connect 50000
62 timeout client 480000
63 timeout server 480000
64 timeout http-keep-alive 30000
65
leila8bd5bf32022-11-16 19:42:09 -050066frontend stats
67 bind *:8448
68 http-request use-service prometheus-exporter if { path /metrics }
69 stats enable
70 stats uri /stats
71 stats refresh 10s
Sylvain Desbureaux70070412020-11-09 21:58:48 +010072
73frontend IST_8443
74 mode http
Sylvain Desbureaux87f49af2020-12-15 11:56:51 +010075 bind 0.0.0.0:8443 name https ssl crt /opt/app/osaaf/local/certs/fullchain.pem
Sylvain Desbureaux70070412020-11-09 21:58:48 +010076# log-format %ci:%cp\ [%t]\ %ft\ %b/%s\ %Tq/%Tw/%Tc/%Tr/%Tt\ %ST\ %B\ %CC\ %CS\ %tsc\ %ac/%fc/%bc/%sc/%rc\ %sq/%bq\ %hr\ %hs\ {%[ssl_c_verify],%{+Q}[ssl_c_s_dn],%{+Q}[ssl_c_i_dn]}\ %{+Q}r
77 log-format "%ci:%cp [%tr] %ft %b/%s %TR/%Tw/%Tc/%Tr/%Ta %ST %B %CC \ %CS %tsc %ac/%fc/%bc/%sc/%rc %sq/%bq %hr %hs %{+Q}r"
78 option httplog
79 log global
80 option logasap
81 option forwardfor
82 capture request header Host len 100
83 capture response header Host len 100
84 option log-separate-errors
85 option forwardfor
leila8bd5bf32022-11-16 19:42:09 -050086
87 http-request set-header X-Forwarded-Proto https
88 http-request add-header X-Forwarded-Port 8443
89
Sylvain Desbureaux70070412020-11-09 21:58:48 +010090 http-request set-header X-Forwarded-Proto https if { ssl_fc }
91 http-request set-header X-AAI-Client-SSL TRUE if { ssl_c_used }
92 http-request set-header X-AAI-SSL %[ssl_fc]
93 http-request set-header X-AAI-SSL-Client-Verify %[ssl_c_verify]
94 http-request set-header X-AAI-SSL-Client-DN %{+Q}[ssl_c_s_dn]
95 http-request set-header X-AAI-SSL-Client-CN %{+Q}[ssl_c_s_dn(cn)]
96 http-request set-header X-AAI-SSL-Issuer %{+Q}[ssl_c_i_dn]
97 http-request set-header X-AAI-SSL-Client-NotBefore %{+Q}[ssl_c_notbefore]
98 http-request set-header X-AAI-SSL-Client-NotAfter %{+Q}[ssl_c_notafter]
99 http-request set-header X-AAI-SSL-ClientCert-Base64 %{+Q}[ssl_c_der,base64]
100 http-request set-header X-AAI-SSL-Client-OU %{+Q}[ssl_c_s_dn(OU)]
101 http-request set-header X-AAI-SSL-Client-L %{+Q}[ssl_c_s_dn(L)]
102 http-request set-header X-AAI-SSL-Client-ST %{+Q}[ssl_c_s_dn(ST)]
103 http-request set-header X-AAI-SSL-Client-C %{+Q}[ssl_c_s_dn(C)]
104 http-request set-header X-AAI-SSL-Client-O %{+Q}[ssl_c_s_dn(O)]
Suresh Charanc1aa7582022-01-31 06:25:37 -0500105#######################################
106## Request blocking configuration ###
107#######################################
108 {{- if eq $.Values.haproxy.requestBlocking.enabled true }}
109 {{- range $custom_config := $.Values.haproxy.requestBlocking.customConfigs }}
110 {{ $custom_config }}
111 {{- end }}
112 {{- end }}
113
Sylvain Desbureaux70070412020-11-09 21:58:48 +0100114#######################
115#ACLS FOR PORT 8446####
116#######################
117
118 acl is_Port_8446_generic path_reg -i ^/aai/v[0-9]+/search/generic-query$
119 acl is_Port_8446_nodes path_reg -i ^/aai/v[0-9]+/search/nodes-query$
120 acl is_Port_8446_version path_reg -i ^/aai/v[0-9]+/query$
leila8bd5bf32022-11-16 19:42:09 -0500121 acl is_dsl path_reg -i ^/aai/v[0-9]+/dsl$
Sylvain Desbureaux70070412020-11-09 21:58:48 +0100122 acl is_named-query path_beg -i /aai/search/named-query
123 acl is_search-model path_beg -i /aai/search/model
leila8bd5bf32022-11-16 19:42:09 -0500124 use_backend IST_AAI_8446 if is_Port_8446_generic or is_Port_8446_nodes or is_Port_8446_version or is_named-query or is_search-model or is_dsl
Sylvain Desbureaux70070412020-11-09 21:58:48 +0100125
126 default_backend IST_Default_8447
127
128
129#######################
osk1146127fd7d82021-06-18 00:51:17 +0200130#DEFAULT BACKEND 8447##
Sylvain Desbureaux70070412020-11-09 21:58:48 +0100131#######################
132
133backend IST_Default_8447
134 balance roundrobin
leila8bd5bf32022-11-16 19:42:09 -0500135 stick-table type string len 100 size 200k expire 2m
136 stick on path
Sylvain Desbureaux70070412020-11-09 21:58:48 +0100137 http-request set-header X-Forwarded-Port %[src_port]
138 http-response set-header Strict-Transport-Security max-age=16000000;\ includeSubDomains;\ preload;
leila8bd5bf32022-11-16 19:42:09 -0500139 server-template aai-resources.{{.Release.Namespace}} {{$.Values.haproxy.replicas.aaiResources}} aai-resources.{{.Release.Namespace}}.svc.cluster.local:8447 resolvers kubernetes check check-ssl port 8447 ssl verify none
Sylvain Desbureaux70070412020-11-09 21:58:48 +0100140
141
142#######################
143# BACKEND 8446#########
144#######################
145
146backend IST_AAI_8446
147 balance roundrobin
leila8bd5bf32022-11-16 19:42:09 -0500148 stick-table type string len 100 size 200k expire 2m
149 stick on path
Sylvain Desbureaux70070412020-11-09 21:58:48 +0100150 http-request set-header X-Forwarded-Port %[src_port]
151 http-response set-header Strict-Transport-Security max-age=16000000;\ includeSubDomains;\ preload;
leila8bd5bf32022-11-16 19:42:09 -0500152 server-template aai-traversal.{{.Release.Namespace}} {{$.Values.haproxy.replicas.aaiTraversal}} aai-traversal.{{.Release.Namespace}}.svc.cluster.local:8446 resolvers kubernetes check check-ssl port 8446 ssl verify none
Sylvain Desbureaux70070412020-11-09 21:58:48 +0100153
154listen IST_AAI_STATS
155 mode http
156 bind *:8080
157 stats uri /stats
158 stats enable
159 stats refresh 30s
160 stats hide-version
161 stats auth admin:admin
162 stats show-legends
163 stats show-desc IST AAI APPLICATION NODES
164 stats admin if TRUE