mirror of https://github.com/Aidaho12/haproxy-wi
68 lines
2.7 KiB
YAML
68 lines
2.7 KiB
YAML
---
|
|
# Main server configuration
|
|
nginx_proxy:
|
|
# Static files configuration
|
|
static_files:
|
|
enabled: false # Enable static file handling
|
|
path: "/var/www/static" # Physical path to static files
|
|
url_path: "/static/" # URL prefix for static files
|
|
|
|
# Security configurations
|
|
security:
|
|
hide_backend_headers: true # Hide backend server headers (e.g., X-Powered-By)
|
|
hsts_max_age: 15768000 # HSTS duration in seconds (6 months)
|
|
content_security_policy: "default-src 'self'" # Content Security Policy rules
|
|
|
|
# Rate limiting configuration
|
|
rate_limit:
|
|
enabled: false # Enable rate limiting
|
|
zone: "ratelimit 10m rate=100r/s" # Rate limit zone (10MB memory, 100 req/sec)
|
|
burst: 50 # Maximum burst capacity
|
|
|
|
# Caching configuration
|
|
caching:
|
|
enabled: false # Enable response caching
|
|
zones:
|
|
- name: "api_cache" # Cache zone name
|
|
path: "/var/cache/nginx/api" # Disk path for cache
|
|
size: "10m" # Memory zone size
|
|
inactive: "60m" # Cache retention time for inactive entries
|
|
levels: "1:2" # Directory structure levels
|
|
|
|
websocket:
|
|
enabled: false
|
|
|
|
# Custom error pages
|
|
error_pages:
|
|
enabled: false # Enable custom error pages
|
|
codes: [502, 503, 504] # HTTP status codes to handle
|
|
path: "/var/www/errors" # Directory containing error HTML files
|
|
|
|
# IP access control
|
|
access_control:
|
|
global_whitelist:
|
|
enabled: false # Global allow-list mode
|
|
ips: ["192.168.1.0/24", "127.0.0.1"] # Allowed IPs/CIDR ranges
|
|
global_blacklist:
|
|
enabled: false # Global deny-list mode
|
|
ips: ["203.0.113.0/24"] # Blocked IPs/CIDR ranges
|
|
location_whitelist:
|
|
enabled: false # Path-specific allow-list
|
|
ips: ["172.16.0.0/16"] # Allowed IPs for specific paths
|
|
apply_to: ["/admin", "/api"] # Protected paths
|
|
|
|
|
|
# TCP/UDP proxy configuration
|
|
tcp_proxies:
|
|
- name: "mysql_proxy" # Proxy name
|
|
enabled: false # Enable this proxy
|
|
listen_port: 3306 # Listening port
|
|
protocol: "tcp" # Protocol (tcp/udp)
|
|
upstream_servers:
|
|
- { ip: "10.0.1.1", port: 3306, weight: 3 } # Backend servers
|
|
ssl_enabled: true # Enable SSL termination
|
|
ssl_cert: "/etc/ssl/certs/mysql.crt" # SSL certificate
|
|
ssl_key: "/etc/ssl/private/mysql.key" # SSL private key
|
|
proxy_timeout: 3600s # Connection timeout
|
|
proxy_connect_timeout: 60s # Backend connect timeout
|