blob: dbd95adca8b81066c34852f55487f9ac678df354 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
|
# relayd ~~ /etc/relayd.conf
# managed by Ansible
# hosts
table <local> { 127.0.0.1 }
{% for h in groups["servers"] %}
{% set h = dict(hostvars[h]) %}
{##}
{% if h.ip.in is defined %}
table <{{ h.ansible_host }}> { {{ h.ip.in }} }
{% endif %}
{##}
{% endfor %}
# protocols
http protocol "https" {
tls keypair "{{ global.domain_name }}"
tls ciphers "HIGH:!AES128:!kRSA:!aNULL"
tls ecdhe "P-384,P-256,X25519"
tcp { sack, backlog 128 }
match request header append "X-Forwarded-For" value "$REMOTE_ADDR"
match request header append "X-Forwarded-By" value "$SERVER_ADDR:$SERVER_PORT"
match request header set "Connection" value "close"
match request header set "X-Forwarded-Proto" value "https"
match request header set "X-Forwarded-Port" value "443"
pass request header "Host" value "{{ global.domain_name }}" forward to <local>
{% for h in groups["servers"] %}
{% set h = dict(hostvars[h]) %}
{##}
{% if h.ip.in is defined %}
{% for service in h.services if service.domain is defined %}
pass request header "Host" value "{{ service.domain }}.{{ global.domain_name }}" forward to <{{ h.ansible_host }}>
{% endfor %}
{% endif %}
{##}
{% endfor %}
}
http protocol "http" {
pass request header "Host" value "{{ global.domain_name }}" forward to <local>
{% for h in groups["servers"] %}
{% set h = dict(hostvars[h]) %}
{##}
{% if h.ip.in is defined %}
{% for service in h.services if service.domain is defined %}
pass request header "Host" value "{{ service.domain }}.{{ global.domain_name }}" forward to <{{ h.ansible_host }}>
{% endfor %}
{% endif %}
{##}
{% endfor %}
}
# relays
relay "www" {
listen on egress port 80
protocol "http"
forward to <local> port 80 check icmp
{% for hostname in groups["servers"] %}
{% set h = dict(hostvars[hostname]) %}
{% for service in h.services if service.domain is defined %}
forward to <{{ hostname }}> port {{ service.port }} check icmp
{% endfor %}
{% endfor %}
}
relay "wwwtls" {
listen on egress port 443 tls
protocol "https"
forward to <local> port 80 check icmp
{% for hostname in groups["servers"] %}
{% set h = dict(hostvars[hostname]) %}
{% for service in h.services if service.domain is defined %}
forward to <{{ hostname }}> port {{ service.port }} check http "/" code 200
{% endfor %}
{% endfor %}
}
|
