diff --git a/confd/conf.d/crt-list.toml b/confd/conf.d/crt-list.toml deleted file mode 100644 index ef435f2eebbd475736686c03fd1dfc4087cb78e2..0000000000000000000000000000000000000000 --- a/confd/conf.d/crt-list.toml +++ /dev/null @@ -1,7 +0,0 @@ -[template] -src = "crt-list.tmpl" -dest = "/etc/haproxy/crt-list" -keys = [ - "/services" -] -reload_cmd = "/docker kill --signal=\"SIGUSR1\" haproxy" diff --git a/confd/conf.d/haproxy.toml b/confd/conf.d/haproxy.toml deleted file mode 100644 index d3554213d797707dc76f507ce18dc280808e75a1..0000000000000000000000000000000000000000 --- a/confd/conf.d/haproxy.toml +++ /dev/null @@ -1,7 +0,0 @@ -[template] -src = "haproxy.cfg.tmpl" -dest = "/etc/haproxy/haproxy.cfg" -keys = [ - "/services" -] -reload_cmd = "/docker kill --signal=\"SIGUSR1\" haproxy" diff --git a/confd/templates/crt-list.tmpl b/confd/templates/crt-list.tmpl deleted file mode 100644 index 731e011f0a92b1cd88e09d8ed268725a4163ac0e..0000000000000000000000000000000000000000 --- a/confd/templates/crt-list.tmpl +++ /dev/null @@ -1,8 +0,0 @@ -{{range $app := lsdir "/services"}} -{{$hostnames := printf "/services/%s/*" $app}} - {{range gets $hostnames}} - {{$hostname := .Key}} -/etc/haproxy/approved-certs/{{base $hostname}}.pem {{base $hostname}} -/etc/haproxy/approved-certs/{{base $hostname}}.pem www.{{base $hostname}} - {{end}} -{{end}} diff --git a/confd/templates/haproxy.cfg.tmpl b/confd/templates/haproxy.cfg.tmpl deleted file mode 100644 index 1e2df798e0bef5695531800873699e6a859e4d6f..0000000000000000000000000000000000000000 --- a/confd/templates/haproxy.cfg.tmpl +++ /dev/null @@ -1,47 +0,0 @@ -global - maxconn 4096 - user haproxy - group haproxy - -defaults - mode http - option forwardfor - option httpclose - option httplog - option dontlognull - retries 3 - timeout connect 5000 - timeout client 50000 - timeout server 50000 - -frontend https-in -mode http - bind *:443 ssl crt-list /etc/haproxy/crt-list crt /etc/haproxy/approved-certs/default.pem - reqadd X-Forwarded-Proto:\ https -{{range $app := lsdir "/services"}} -{{$hostnames := printf "/services/%s/*" $app}} - {{range gets $hostnames}} - {{$hostname := .Key}} - {{$data := json .Value}} -# {{base $hostname}}: - acl https_{{base $hostname}} hdr(host) -i {{base $hostname}} - acl https_{{base $hostname}} hdr(host) -i www.{{base $hostname}} - use_backend {{base $hostname}} if https_{{base $hostname}} - {{end}} -{{end}} - -frontend http-in - bind *:80 - redirect scheme https code 301 - -{{range $app := lsdir "/services"}} -{{$hostnames := printf "/services/%s/*" $app}} - {{range gets $hostnames}} - {{$hostname := .Key}} - {{$data := json .Value}} -# {{base $hostname}}: -backend {{base $hostname}} - cookie SERVERID insert nocache indirect - server Server {{$data.ip}}:{{$data.port}} cookie Server - {{end}} -{{end}} diff --git a/dockerfiles/load-balancer/confd/confd/templates/crt-list.tmpl b/dockerfiles/load-balancer/confd/confd/templates/crt-list.tmpl index 391fa958ca43aafe16896f691311e48ed3a05e6d..731e011f0a92b1cd88e09d8ed268725a4163ac0e 100644 --- a/dockerfiles/load-balancer/confd/confd/templates/crt-list.tmpl +++ b/dockerfiles/load-balancer/confd/confd/templates/crt-list.tmpl @@ -3,5 +3,6 @@ {{range gets $hostnames}} {{$hostname := .Key}} /etc/haproxy/approved-certs/{{base $hostname}}.pem {{base $hostname}} +/etc/haproxy/approved-certs/{{base $hostname}}.pem www.{{base $hostname}} {{end}} {{end}} diff --git a/dockerfiles/load-balancer/confd/confd/templates/haproxy.cfg.tmpl b/dockerfiles/load-balancer/confd/confd/templates/haproxy.cfg.tmpl index bf6aab89fd5b72b1f7923ae6b6612fa6c03ece3c..1e2df798e0bef5695531800873699e6a859e4d6f 100644 --- a/dockerfiles/load-balancer/confd/confd/templates/haproxy.cfg.tmpl +++ b/dockerfiles/load-balancer/confd/confd/templates/haproxy.cfg.tmpl @@ -1,9 +1,3 @@ -{{$default_service_value := getv "/services/default"}} -{{$default_service := json $default_service_value}} -{{$default_url := printf "/services/%s/%s" $default_service.app $default_service.hostname}} -{{$default_value := getv $default_url}} -{{$default := json $default_value}} -{{$default := json $default_value}} global maxconn 4096 user haproxy @@ -11,6 +5,8 @@ global defaults mode http + option forwardfor + option httpclose option httplog option dontlognull retries 3 @@ -20,7 +16,7 @@ defaults frontend https-in mode http - bind *:443 ssl crt-list /etc/haproxy/crt-list crt /etc/haproxy/approved-certs/{{$default_service.hostname}}.pem + bind *:443 ssl crt-list /etc/haproxy/crt-list crt /etc/haproxy/approved-certs/default.pem reqadd X-Forwarded-Proto:\ https {{range $app := lsdir "/services"}} {{$hostnames := printf "/services/%s/*" $app}} @@ -29,24 +25,14 @@ mode http {{$data := json .Value}} # {{base $hostname}}: acl https_{{base $hostname}} hdr(host) -i {{base $hostname}} + acl https_{{base $hostname}} hdr(host) -i www.{{base $hostname}} use_backend {{base $hostname}} if https_{{base $hostname}} {{end}} {{end}} -default_backend {{$default_service.hostname}} - frontend http-in bind *:80 -{{range $app := lsdir "/services"}} -{{$hostnames := printf "/services/%s/*" $app}} - {{range gets $hostnames}} - {{$hostname := .Key}} - {{$data := json .Value}} -# {{base $hostname}}: - acl is_{{base $hostname}} hdr(host) -i {{base $hostname}} - use_backend {{base $hostname}} if is_{{base $hostname}} - {{end}} -{{end}} + redirect scheme https code 301 {{range $app := lsdir "/services"}} {{$hostnames := printf "/services/%s/*" $app}} @@ -56,8 +42,6 @@ frontend http-in # {{base $hostname}}: backend {{base $hostname}} cookie SERVERID insert nocache indirect - option httpclose - option forwardfor server Server {{$data.ip}}:{{$data.port}} cookie Server {{end}} {{end}} diff --git a/unit-files/haproxy-confd.service b/unit-files/haproxy-confd.service index fc97093c8c538cbbaa33f3b146622b32e44ad83a..a96a50191f5d306336fddd5717c9cada91d908ab 100644 --- a/unit-files/haproxy-confd.service +++ b/unit-files/haproxy-confd.service @@ -17,7 +17,6 @@ ExecStartPre=-/usr/bin/docker rm %p ExecStart=/usr/bin/docker run \ --name %p \ -v /data/runtime/haproxy/:/etc/haproxy/ \ - -v /data/indiehosters/confd/:/etc/confd/ \ -v /var/run/docker.sock:/var/run/docker.sock \ indiehosters/confd ExecReload=/usr/bin/docker restart %p