From 7c8208fc61bdffaedf80119935528e05350350f2 Mon Sep 17 00:00:00 2001 From: status404 Date: Thu, 2 Jul 2026 12:20:25 +0300 Subject: [PATCH] Block MS from the public entry --- docker/haproxy.cfg | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/docker/haproxy.cfg b/docker/haproxy.cfg index 7f98958..ce78381 100644 --- a/docker/haproxy.cfg +++ b/docker/haproxy.cfg @@ -26,6 +26,11 @@ frontend http acl certbot path_beg /.well-known/acme-challenge/ use_backend certbot if certbot +# # Fool-proof: MS has no auth — never expose /ms publicly. +# acl is_ms path -i /ms +# acl is_ms path_beg -i /ms/ +# http-request deny deny_status 404 if is_ms + frontend https bind *:443 ssl crt /usr/local/etc/haproxy/certificates/site.pem http-request add-header X-Forwarded-Proto https @@ -34,6 +39,11 @@ frontend https acl certbot path_beg /.well-known/acme-challenge/ use_backend certbot if certbot +# # Fool-proof: MS has no auth — never expose /ms publicly. +# acl is_ms path -i /ms +# acl is_ms path_beg -i /ms/ +# http-request deny deny_status 404 if is_ms + backend default-backend-http http-request set-header X-Forwarded-Proto https if { ssl_fc } server main nginx:80 check