aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--roles/relayd/templates/relayd.conf.j257
1 files changed, 45 insertions, 12 deletions
diff --git a/roles/relayd/templates/relayd.conf.j2 b/roles/relayd/templates/relayd.conf.j2
index a1abf23..dbd95ad 100644
--- a/roles/relayd/templates/relayd.conf.j2
+++ b/roles/relayd/templates/relayd.conf.j2
@@ -2,9 +2,7 @@
# relayd ~~ /etc/relayd.conf
# managed by Ansible
-# ====== #
-# tables
-# ====== #
+# hosts
table <local> { 127.0.0.1 }
{% for h in groups["servers"] %}
@@ -16,11 +14,36 @@ table <{{ h.ansible_host }}> { {{ h.ip.in }} }
{##}
{% endfor %}
-# ================ #
-# filter for vhost
-# ================ #
+# protocols
-http protocol reverse_proxy {
+http protocol "https" {
+
+ tls keypair "{{ global.domain_name }}"
+ tls ciphers "HIGH:!AES128:!kRSA:!aNULL"
+ tls ecdhe "P-384,P-256,X25519"
+
+ tcp { sack, backlog 128 }
+
+ match request header append "X-Forwarded-For" value "$REMOTE_ADDR"
+ match request header append "X-Forwarded-By" value "$SERVER_ADDR:$SERVER_PORT"
+ match request header set "Connection" value "close"
+ match request header set "X-Forwarded-Proto" value "https"
+ match request header set "X-Forwarded-Port" value "443"
+
+ pass request header "Host" value "{{ global.domain_name }}" forward to <local>
+{% for h in groups["servers"] %}
+{% set h = dict(hostvars[h]) %}
+{##}
+{% if h.ip.in is defined %}
+{% for service in h.services if service.domain is defined %}
+ pass request header "Host" value "{{ service.domain }}.{{ global.domain_name }}" forward to <{{ h.ansible_host }}>
+{% endfor %}
+{% endif %}
+{##}
+{% endfor %}
+}
+
+http protocol "http" {
pass request header "Host" value "{{ global.domain_name }}" forward to <local>
{% for h in groups["servers"] %}
{% set h = dict(hostvars[h]) %}
@@ -34,13 +57,11 @@ http protocol reverse_proxy {
{% endfor %}
}
-# ======================= #
-# relays for all protocol
-# ======================= #
+# relays
-relay www {
+relay "www" {
listen on egress port 80
- protocol reverse_proxy
+ protocol "http"
forward to <local> port 80 check icmp
{% for hostname in groups["servers"] %}
{% set h = dict(hostvars[hostname]) %}
@@ -50,3 +71,15 @@ relay www {
{% endfor %}
}
+relay "wwwtls" {
+ listen on egress port 443 tls
+ protocol "https"
+ forward to <local> port 80 check icmp
+{% for hostname in groups["servers"] %}
+{% set h = dict(hostvars[hostname]) %}
+{% for service in h.services if service.domain is defined %}
+ forward to <{{ hostname }}> port {{ service.port }} check http "/" code 200
+{% endfor %}
+{% endfor %}
+
+}
remember that computers suck.