owngit/haproxy/haproxy.cfg

# HAProxy — домашняя сеть papatramp.ru
# Версия синтаксиса: HAProxy 2.4+
#
# TLS завершается на HAProxy.
# Gitea снаружи: git.papatramp.ru
# Gitea внутри: 192.168.128.100 (или git.papatramp.ru, если локально резолвится в LAN IP).

global
    log stdout format raw local0
    maxconn 40000
    # tune.ssl.default-dh-param 2048

defaults
    mode http
    log global
    option httplog
    option dontlognull
    timeout connect 10s
    timeout client  300s
    timeout server  300s
    timeout http-request 10s

# --- HTTP (80)
frontend fe_http
    bind *:80
    mode http
    option forwardfor except 127.0.0.0/8

    acl path_acme path_beg /.well-known/acme-challenge/
    acl trusted src -f /etc/haproxy/allowed_ips.lst
    acl trusted src -f /etc/haproxy/allowed_ips_knock.lst
    acl host_photo   hdr(host) -i photostation.papatramp.ru
    acl host_oldbox  hdr(host) -i oldbox.papatramp.ru
    acl host_git     hdr(host) -i git.papatramp.ru

    # ACME не блокируем по trusted
    http-request deny deny_status 403 if host_photo !trusted !path_acme
    http-request deny deny_status 403 if host_oldbox !trusted !path_acme

    use_backend bk_acme if path_acme
    use_backend bk_gitea if host_git
    use_backend bk_photostation if host_photo
    use_backend bk_oldbox       if host_oldbox
    use_backend bk_zabbix       if { hdr(host) -i zabbix.papatramp.ru }

    default_backend bk_http_default

# --- HTTPS (443)
frontend fe_https
    # Только HTTP/1.1 к клиенту (как в текущем рабочем варианте)
    bind *:443 ssl crt /etc/haproxy/certs/papatramp.pem alpn http/1.1
    mode http
    option forwardfor except 127.0.0.0/8

    acl trusted src -f /etc/haproxy/allowed_ips.lst
    acl trusted src -f /etc/haproxy/allowed_ips_knock.lst

    acl host_photo   hdr(host) -i photostation.papatramp.ru
    acl host_oldbox  hdr(host) -i oldbox.papatramp.ru
    acl host_git     hdr(host) -i git.papatramp.ru

    http-request deny deny_status 403 if host_photo !trusted
    http-request deny deny_status 403 if host_oldbox !trusted

    use_backend bk_gitea if host_git
    use_backend bk_photostation if host_photo
    use_backend bk_oldbox       if host_oldbox
    use_backend bk_zabbix       if { hdr(host) -i zabbix.papatramp.ru }

    default_backend bk_http_default

# Заглушка для неизвестного Host
backend bk_http_default
    mode http
    http-request deny deny_status 404

# ACME webroot через локальный nginx
backend bk_acme
    mode http
    server nginx_acme 127.0.0.1:8080

# Synology Photo Station / DSM
backend bk_photostation
    mode http
    balance roundrobin
    http-request set-header Host 192.168.128.190:5003
    http-request set-header X-Forwarded-Host %[req.hdr(Host)]
    http-request set-header X-Forwarded-Proto https if { ssl_fc }
    http-request set-header X-Forwarded-Proto http if !{ ssl_fc }
    http-request set-header X-Forwarded-Port 443 if { ssl_fc }
    http-request set-header X-Forwarded-Port 80 if !{ ssl_fc }
    http-response replace-value Location ^https?://192\.168\.128\.190:5003/(.*)$ https://photostation.papatramp.ru/\1
    http-response replace-value Location ^https?://192\.168\.128\.190:5000/(.*)$ https://photostation.papatramp.ru/\1
    http-response replace-value Location ^https?://192\.168\.128\.190/(.*)$ https://photostation.papatramp.ru/\1
    server syno190 192.168.128.190:5003 ssl verify none check inter 10s rise 2 fall 3
    # Вариант только HTTP к NAS:
    # server syno190 192.168.128.190:5000 check inter 10s rise 2 fall 3

backend bk_oldbox
    mode http
    balance roundrobin
    http-request set-header Host 192.168.128.180:5001
    http-request set-header X-Forwarded-Host %[req.hdr(Host)]
    http-request set-header X-Forwarded-Proto https if { ssl_fc }
    http-request set-header X-Forwarded-Proto http if !{ ssl_fc }
    http-request set-header X-Forwarded-Port 443 if { ssl_fc }
    http-request set-header X-Forwarded-Port 80 if !{ ssl_fc }
    http-response replace-value Location ^https?://192\.168\.128\.180:5001/(.*)$ https://oldbox.papatramp.ru/\1
    http-response replace-value Location ^https?://192\.168\.128\.180:5000/(.*)$ https://oldbox.papatramp.ru/\1
    http-response replace-value Location ^https?://192\.168\.128\.180/(.*)$ https://oldbox.papatramp.ru/\1
    server syno180 192.168.128.180:5001 ssl verify none check inter 10s rise 2 fall 3
    # server syno180 192.168.128.180:5000 check inter 10s rise 2 fall 3

# Zabbix
backend bk_zabbix
    mode http
    balance roundrobin
    option httpchk
    http-check send meth GET uri / ver HTTP/1.1 hdr Host 192.168.128.52
    http-check expect rstatus ^[23]
    http-request set-header X-Forwarded-Proto https if { ssl_fc }
    http-request set-header X-Forwarded-Proto http if !{ ssl_fc }
    http-request set-header X-Forwarded-Port 443 if { ssl_fc }
    http-request set-header X-Forwarded-Port 80 if !{ ssl_fc }
    http-request set-header Host 192.168.128.52
    server zabbix1 192.168.128.52:80 check inter 15s rise 2 fall 3

# Gitea/Forgejo UI + Git over HTTP(S)
backend bk_gitea
    mode http
    option httpchk
    http-check send meth GET uri /api/healthz ver HTTP/1.1 hdr Host git.papatramp.ru
    http-check expect status 200
    http-request set-header Host git.papatramp.ru
    http-request set-header X-Forwarded-Host %[req.hdr(Host)]
    http-request set-header X-Forwarded-Proto https if { ssl_fc }
    http-request set-header X-Forwarded-Proto http if !{ ssl_fc }
    http-request set-header X-Forwarded-Port 443 if { ssl_fc }
    http-request set-header X-Forwarded-Port 80 if !{ ssl_fc }
    server gitea1 192.168.128.100:3000 check inter 10s rise 2 fall 3
    # Если внутри хочешь ходить по имени:
    # server gitea1 git.papatramp.ru:3000 check inter 10s rise 2 fall 3

# Git SSH (внешний 2222 -> внутренний Gitea 2222)
frontend fe_git_ssh
    bind *:2222
    mode tcp
    option tcplog
    # При необходимости ограничения по IP:
    # acl ssh_trusted src -f /etc/haproxy/allowed_ips.lst
    # acl ssh_trusted src -f /etc/haproxy/allowed_ips_knock.lst
    # tcp-request connection reject if !ssh_trusted
    default_backend bk_git_ssh

backend bk_git_ssh
    mode tcp
    server gitea_ssh 192.168.128.100:2222 check inter 10s rise 2 fall 3
    # Вариант через имя:
    # server gitea_ssh git.papatramp.ru:2222 check inter 10s rise 2 fall 3

# --- RDP (TCP)
frontend fe_rdp_papa
    bind *:3389
    mode tcp
    option tcplog
    acl rdp_trusted src -f /etc/haproxy/allowed_ips.lst
    acl rdp_trusted src -f /etc/haproxy/allowed_ips_knock.lst
    tcp-request connection reject if !rdp_trusted
    default_backend bk_rdp_papa

backend bk_rdp_papa
    mode tcp
    server win_papa 192.168.128.5:3389 check inter 5s rise 2 fall 3

# Второй RDP (:3390 -> 192.168.128.30) — пример
#frontend fe_rdp_second
#    bind *:3390
#    mode tcp
#    option tcplog
#    acl rdp_trusted src -f /etc/haproxy/allowed_ips.lst
#    acl rdp_trusted src -f /etc/haproxy/allowed_ips_knock.lst
#    tcp-request connection reject if !rdp_trusted
#    default_backend bk_rdp_second
#
#backend bk_rdp_second
#    mode tcp
#    server win_rdp2 192.168.128.30:3389 check inter 5s rise 2 fall 3

# --- SMTP (TCP/25)
frontend fe_smtp
    bind *:25
    mode tcp
    option tcplog
    default_backend bk_smtp

backend bk_smtp
    mode tcp
    option smtpchk
    server mail_mx 192.168.128.80:25 check inter 15s rise 2 fall 3