PapaTramp/reverse-proxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(haproxy): fe_stats, stats-allowed, sync с prod (0.7.7).

Browse Source
This commit is contained in:
PTah
2026-06-15 14:05:17 +10:00
parent 435a519b04
commit 2ce71df1f8
3 changed files with 21 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/haproxy-install.md
+1 -1
View File
@@ -44,7 +44,7 @@ sudo haproxy -c -f /etc/haproxy/haproxy.cfg
```bash ```bash
sudo cp ~/reverse-proxy/haproxy.cfg /etc/haproxy/haproxy.cfg sudo cp ~/reverse-proxy/haproxy.cfg /etc/haproxy/haproxy.cfg
sudo cp ~/reverse-proxy/git-sac-allowed ~/reverse-proxy/1c-allowed ~/reverse-proxy/zabbix-allowed ~/reverse-proxy/syno-allowed ~/reverse-proxy/rds-allowed-static /etc/haproxy/ sudo cp ~/reverse-proxy/git-sac-allowed ~/reverse-proxy/1c-allowed ~/reverse-proxy/zabbix-allowed ~/reverse-proxy/syno-allowed ~/reverse-proxy/rds-allowed-static ~/reverse-proxy/stats-allowed /etc/haproxy/
sudo install -m 0755 ~/reverse-proxy/scripts/haproxy-rds-allowed-deploy.sh ~/reverse-proxy/scripts/haproxy_ru_ipdeny_lib.sh /usr/local/bin/ sudo install -m 0755 ~/reverse-proxy/scripts/haproxy-rds-allowed-deploy.sh ~/reverse-proxy/scripts/haproxy_ru_ipdeny_lib.sh /usr/local/bin/
sudo /usr/local/bin/haproxy-rds-allowed-deploy.sh sudo /usr/local/bin/haproxy-rds-allowed-deploy.sh
sudo cp ~/reverse-proxy/scripts/haproxy-rds-allowed.cron /etc/cron.d/haproxy-rds-allowed sudo cp ~/reverse-proxy/scripts/haproxy-rds-allowed.cron /etc/cron.d/haproxy-rds-allowed
haproxy.cfg
+15 -10
View File
@@ -1,5 +1,5 @@
# HAProxy — периметровый reverse-proxy для kalinamall.ru # HAProxy — периметровый reverse-proxy для kalinamall.ru
# Config version: 0.7.6 # Config version: 0.7.7
# Режим: TCP + SNI на 443 (TLS end-to-end, сертификаты на бэкендах) # Режим: TCP + SNI на 443 (TLS end-to-end, сертификаты на бэкендах)
# HTTP на 80: zabbix.kalinamall.ru → 192.168.160.53 (allowlist zabbix-allowed) # HTTP на 80: zabbix.kalinamall.ru → 192.168.160.53 (allowlist zabbix-allowed)
# #
@@ -40,7 +40,6 @@ frontend fe_https_sni
mode tcp mode tcp
option tcplog option tcplog
log-format '{"time":"%t","client":"%ci","port":%cp,"fe":"%f","be":"%b","srv":"%s","sni":%{+Q}[capture.req.hdr(0)],"bytes":%B,"term":"%tsc","tw":%Tw,"tc":%Tc,"tt":%Tt}' log-format '{"time":"%t","client":"%ci","port":%cp,"fe":"%f","be":"%b","srv":"%s","sni":%{+Q}[capture.req.hdr(0)],"bytes":%B,"term":"%tsc","tw":%Tw,"tc":%Tc,"tt":%Tt}'
tcp-request inspect-delay 5s tcp-request inspect-delay 5s
tcp-request content capture req.ssl_sni len 128 tcp-request content capture req.ssl_sni len 128
tcp-request content accept if { req_ssl_hello_type 1 } tcp-request content accept if { req_ssl_hello_type 1 }
@@ -152,12 +151,18 @@ backend be_ksmg_smtp
server ksmg 192.168.160.57:25 check server ksmg 192.168.160.57:25 check
# ----------------------------------------------------------------------------- # -----------------------------------------------------------------------------
# Опционально: статистика (раскомментируйте и задайте пароль) # Статистика HAProxy — только LAN/admin (allowlist stats-allowed)
# Пароль stats auth задаётся на сервере (/etc/haproxy/haproxy.cfg), не в GitHub.
# ----------------------------------------------------------------------------- # -----------------------------------------------------------------------------
# frontend fe_stats
# bind *:8404 frontend fe_stats
# mode http bind 192.168.160.117:8404
# stats enable mode http
# stats uri /stats option httplog
# stats refresh 10s acl src_stats_allowed src -f /etc/haproxy/stats-allowed
# stats auth admin:CHANGEME http-request deny deny_status 403 if !src_stats_allowed
stats enable
stats uri /stats
stats refresh 10s
stats auth admin:CHANGEME
# stats hide-version
stats-allowed
+5
View File
@@ -0,0 +1,5 @@
# HAProxy stats (:8404) — src ACL для fe_stats
192.168.128.0/17
5.100.81.121
109.109.217.150
109.110.54.2