private-user
7c8208fc61
Build docker image and push to registry.bitdeals.org / main-build-job (push) Successful in 40s
57 lines
1.3 KiB
INI
57 lines
1.3 KiB
INI
global
|
|
# Enable HAProxy runtime API
|
|
stats socket :9999 level admin expose-fd listeners
|
|
|
|
defaults
|
|
mode http
|
|
default_backend default-backend-http
|
|
|
|
timeout connect 5s
|
|
timeout client 1m
|
|
timeout server 1m
|
|
|
|
option dontlog-normal
|
|
option tcp-smart-accept
|
|
option tcp-smart-connect
|
|
#option forwardfor
|
|
option http-keep-alive
|
|
|
|
http-reuse safe
|
|
|
|
frontend http
|
|
bind *:80
|
|
#http-request redirect scheme https code 301
|
|
|
|
# ACL
|
|
acl certbot path_beg /.well-known/acme-challenge/
|
|
use_backend certbot if certbot
|
|
|
|
# # Fool-proof: MS has no auth — never expose /ms publicly.
|
|
# acl is_ms path -i /ms
|
|
# acl is_ms path_beg -i /ms/
|
|
# http-request deny deny_status 404 if is_ms
|
|
|
|
frontend https
|
|
bind *:443 ssl crt /usr/local/etc/haproxy/certificates/site.pem
|
|
http-request add-header X-Forwarded-Proto https
|
|
|
|
# ACL
|
|
acl certbot path_beg /.well-known/acme-challenge/
|
|
use_backend certbot if certbot
|
|
|
|
# # Fool-proof: MS has no auth — never expose /ms publicly.
|
|
# acl is_ms path -i /ms
|
|
# acl is_ms path_beg -i /ms/
|
|
# http-request deny deny_status 404 if is_ms
|
|
|
|
backend default-backend-http
|
|
http-request set-header X-Forwarded-Proto https if { ssl_fc }
|
|
server main nginx:80 check
|
|
|
|
backend certbot
|
|
server certbot certbot:380
|
|
|
|
resolvers docker
|
|
nameserver dns1 127.0.0.11:53
|
|
|