45 lines
1.8 KiB
INI
45 lines
1.8 KiB
INI
|
# ramiel's front on 443 (ADR 0039, D3, D10): HAProxy reads the name a TLS connection
|
||
|
|
# asks for (SNI) and passes halkyon.li's, unopened, through the tunnel to its instance
|
||
|
|
# at home; every other name goes to ramiel's own Caddy on the loopback, which serves
|
||
|
|
# code.halkyon.app and halkyon.app as before. Both get the visitor's address in a PROXY
|
||
|
|
# header (v2). As /etc/haproxy/haproxy.cfg on ramiel; check it with
|
||
|
|
# `haproxy -c -f /etc/haproxy/haproxy.cfg`. Setting it up: forward/README.md.
|
||
|
|
#
|
||
|
|
# Nothing is logged: no `log` line, so neither the visitors of halkyon.li nor those of
|
||
|
|
# the forge are kept here (Caddy behind each side logs what it logs, as before).
|
||
|
|
|
||
|
|
global
|
||
|
|
user haproxy
|
||
|
|
group haproxy
|
||
|
|
daemon
|
||
|
|
maxconn 2000
|
||
|
|
|
||
|
|
defaults
|
||
|
|
mode tcp
|
||
|
|
timeout connect 5s
|
||
|
|
# Jellyfin's streams, Serverpod's WebSockets and a forge's long clones stay open:
|
||
|
|
# an hour without a byte either way, as a tunnel's idle time.
|
||
|
|
timeout client 1h
|
||
|
|
timeout server 1h
|
||
|
|
timeout tunnel 1h
|
||
|
|
|
||
|
|
frontend tls
|
||
|
|
bind :::443 v4v6
|
||
|
|
# Wait for the ClientHello, which names the host; a connection that sends none
|
||
|
|
# within 5 s goes to the local Caddy, which answers it as before.
|
||
|
|
tcp-request inspect-delay 5s
|
||
|
|
tcp-request content accept if { req.ssl_hello_type 1 }
|
||
|
|
# halkyon.li's names exactly, as its DNS zone has them (D7): no wildcard, so no
|
||
|
|
# other name reaches home.
|
||
|
|
acl halkyon_li req.ssl_sni -i halkyon.li learn.halkyon.li todo.halkyon.li train.halkyon.li meditate.halkyon.li jellyfin.halkyon.li
|
||
|
|
use_backend home if halkyon_li
|
||
|
|
default_backend local
|
||
|
|
|
||
|
|
# halkyon.li's Caddy at home, at its address in the tunnel (D8), which it publishes
|
||
|
|
# 443 on alone.
|
||
|
|
backend home
|
||
|
|
server balthasar 10.61.97.2:443 send-proxy-v2
|
||
|
|
|
||
|
|
# ramiel's own Caddy, moved off 443 (Caddyfile.halkyon-li).
|
||
|
|
backend local
|
||
|
|
server caddy 127.0.0.1:8443 send-proxy-v2
|