# HAProxy — домашняя сеть papatramp.ru # Версия синтаксиса: HAProxy 2.4+ # # TLS завершается на HAProxy. # Gitea снаружи: git.papatramp.ru # Gitea внутри: 192.168.128.100 (или git.papatramp.ru, если локально резолвится в LAN IP). global log stdout format raw local0 maxconn 40000 # tune.ssl.default-dh-param 2048 defaults mode http log global option httplog option dontlognull timeout connect 10s timeout client 300s timeout server 300s timeout http-request 10s # --- HTTP (80) frontend fe_http bind *:80 mode http option forwardfor except 127.0.0.0/8 acl path_acme path_beg /.well-known/acme-challenge/ acl trusted src -f /etc/haproxy/allowed_ips.lst acl trusted src -f /etc/haproxy/allowed_ips_knock.lst acl host_photo hdr(host) -i photostation.papatramp.ru acl host_oldbox hdr(host) -i oldbox.papatramp.ru acl host_git hdr(host) -i git.papatramp.ru # ACME не блокируем по trusted http-request deny deny_status 403 if host_photo !trusted !path_acme http-request deny deny_status 403 if host_oldbox !trusted !path_acme use_backend bk_acme if path_acme use_backend bk_gitea if host_git use_backend bk_photostation if host_photo use_backend bk_oldbox if host_oldbox use_backend bk_zabbix if { hdr(host) -i zabbix.papatramp.ru } default_backend bk_http_default # --- HTTPS (443) frontend fe_https # Только HTTP/1.1 к клиенту (как в текущем рабочем варианте) bind *:443 ssl crt /etc/haproxy/certs/papatramp.pem alpn http/1.1 mode http option forwardfor except 127.0.0.0/8 acl trusted src -f /etc/haproxy/allowed_ips.lst acl trusted src -f /etc/haproxy/allowed_ips_knock.lst acl host_photo hdr(host) -i photostation.papatramp.ru acl host_oldbox hdr(host) -i oldbox.papatramp.ru acl host_git hdr(host) -i git.papatramp.ru http-request deny deny_status 403 if host_photo !trusted http-request deny deny_status 403 if host_oldbox !trusted use_backend bk_gitea if host_git use_backend bk_photostation if host_photo use_backend bk_oldbox if host_oldbox use_backend bk_zabbix if { hdr(host) -i zabbix.papatramp.ru } default_backend bk_http_default # Заглушка для неизвестного Host backend bk_http_default mode http http-request deny deny_status 404 # ACME webroot через локальный nginx backend bk_acme mode http server nginx_acme 127.0.0.1:8080 # Synology Photo Station / DSM backend bk_photostation mode http balance roundrobin http-request set-header Host 192.168.128.190:5003 http-request set-header X-Forwarded-Host %[req.hdr(Host)] http-request set-header X-Forwarded-Proto https if { ssl_fc } http-request set-header X-Forwarded-Proto http if !{ ssl_fc } http-request set-header X-Forwarded-Port 443 if { ssl_fc } http-request set-header X-Forwarded-Port 80 if !{ ssl_fc } http-response replace-value Location ^https?://192\.168\.128\.190:5003/(.*)$ https://photostation.papatramp.ru/\1 http-response replace-value Location ^https?://192\.168\.128\.190:5000/(.*)$ https://photostation.papatramp.ru/\1 http-response replace-value Location ^https?://192\.168\.128\.190/(.*)$ https://photostation.papatramp.ru/\1 server syno190 192.168.128.190:5003 ssl verify none check inter 10s rise 2 fall 3 # Вариант только HTTP к NAS: # server syno190 192.168.128.190:5000 check inter 10s rise 2 fall 3 backend bk_oldbox mode http balance roundrobin http-request set-header Host 192.168.128.180:5001 http-request set-header X-Forwarded-Host %[req.hdr(Host)] http-request set-header X-Forwarded-Proto https if { ssl_fc } http-request set-header X-Forwarded-Proto http if !{ ssl_fc } http-request set-header X-Forwarded-Port 443 if { ssl_fc } http-request set-header X-Forwarded-Port 80 if !{ ssl_fc } http-response replace-value Location ^https?://192\.168\.128\.180:5001/(.*)$ https://oldbox.papatramp.ru/\1 http-response replace-value Location ^https?://192\.168\.128\.180:5000/(.*)$ https://oldbox.papatramp.ru/\1 http-response replace-value Location ^https?://192\.168\.128\.180/(.*)$ https://oldbox.papatramp.ru/\1 server syno180 192.168.128.180:5001 ssl verify none check inter 10s rise 2 fall 3 # server syno180 192.168.128.180:5000 check inter 10s rise 2 fall 3 # Zabbix backend bk_zabbix mode http balance roundrobin option httpchk http-check send meth GET uri / ver HTTP/1.1 hdr Host 192.168.128.52 http-check expect rstatus ^[23] http-request set-header X-Forwarded-Proto https if { ssl_fc } http-request set-header X-Forwarded-Proto http if !{ ssl_fc } http-request set-header X-Forwarded-Port 443 if { ssl_fc } http-request set-header X-Forwarded-Port 80 if !{ ssl_fc } http-request set-header Host 192.168.128.52 server zabbix1 192.168.128.52:80 check inter 15s rise 2 fall 3 # Gitea/Forgejo UI + Git over HTTP(S) backend bk_gitea mode http option httpchk http-check send meth GET uri /api/healthz ver HTTP/1.1 hdr Host git.papatramp.ru http-check expect status 200 http-request set-header Host git.papatramp.ru http-request set-header X-Forwarded-Host %[req.hdr(Host)] http-request set-header X-Forwarded-Proto https if { ssl_fc } http-request set-header X-Forwarded-Proto http if !{ ssl_fc } http-request set-header X-Forwarded-Port 443 if { ssl_fc } http-request set-header X-Forwarded-Port 80 if !{ ssl_fc } server gitea1 192.168.128.100:3000 check inter 10s rise 2 fall 3 # Если внутри хочешь ходить по имени: # server gitea1 git.papatramp.ru:3000 check inter 10s rise 2 fall 3 # Git SSH (внешний 2222 -> внутренний Gitea 2222) frontend fe_git_ssh bind *:2222 mode tcp option tcplog # При необходимости ограничения по IP: # acl ssh_trusted src -f /etc/haproxy/allowed_ips.lst # acl ssh_trusted src -f /etc/haproxy/allowed_ips_knock.lst # tcp-request connection reject if !ssh_trusted default_backend bk_git_ssh backend bk_git_ssh mode tcp server gitea_ssh 192.168.128.100:2222 check inter 10s rise 2 fall 3 # Вариант через имя: # server gitea_ssh git.papatramp.ru:2222 check inter 10s rise 2 fall 3 # --- RDP (TCP) frontend fe_rdp_papa bind *:3389 mode tcp option tcplog acl rdp_trusted src -f /etc/haproxy/allowed_ips.lst acl rdp_trusted src -f /etc/haproxy/allowed_ips_knock.lst tcp-request connection reject if !rdp_trusted default_backend bk_rdp_papa backend bk_rdp_papa mode tcp server win_papa 192.168.128.5:3389 check inter 5s rise 2 fall 3 # Второй RDP (:3390 -> 192.168.128.30) — пример #frontend fe_rdp_second # bind *:3390 # mode tcp # option tcplog # acl rdp_trusted src -f /etc/haproxy/allowed_ips.lst # acl rdp_trusted src -f /etc/haproxy/allowed_ips_knock.lst # tcp-request connection reject if !rdp_trusted # default_backend bk_rdp_second # #backend bk_rdp_second # mode tcp # server win_rdp2 192.168.128.30:3389 check inter 5s rise 2 fall 3 # --- SMTP (TCP/25) frontend fe_smtp bind *:25 mode tcp option tcplog default_backend bk_smtp backend bk_smtp mode tcp option smtpchk server mail_mx 192.168.128.80:25 check inter 15s rise 2 fall 3