PapaTramp/reverse-proxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(haproxy): JSON tcplog с SNI capture на fe_https_sni (0.7.6).

Browse Source
This commit is contained in:
PTah
2026-06-15 13:39:06 +10:00
parent 027d64f245
commit 435a519b04
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
haproxy.cfg
+5 -1
View File
@@ -1,5 +1,5 @@
# HAProxy — периметровый reverse-proxy для kalinamall.ru # HAProxy — периметровый reverse-proxy для kalinamall.ru
# Config version: 0.7.5 # Config version: 0.7.6
# Режим: TCP + SNI на 443 (TLS end-to-end, сертификаты на бэкендах) # Режим: TCP + SNI на 443 (TLS end-to-end, сертификаты на бэкендах)
# HTTP на 80: zabbix.kalinamall.ru → 192.168.160.53 (allowlist zabbix-allowed) # HTTP на 80: zabbix.kalinamall.ru → 192.168.160.53 (allowlist zabbix-allowed)
# #
@@ -38,7 +38,11 @@ defaults
frontend fe_https_sni frontend fe_https_sni
bind *:443 bind *:443
mode tcp mode tcp
option tcplog
log-format '{"time":"%t","client":"%ci","port":%cp,"fe":"%f","be":"%b","srv":"%s","sni":%{+Q}[capture.req.hdr(0)],"bytes":%B,"term":"%tsc","tw":%Tw,"tc":%Tc,"tt":%Tt}'
tcp-request inspect-delay 5s tcp-request inspect-delay 5s
tcp-request content capture req.ssl_sni len 128
tcp-request content accept if { req_ssl_hello_type 1 } tcp-request content accept if { req_ssl_hello_type 1 }
# SNI должен быть из списка (несколько acl с одним именем — логическое ИЛИ) # SNI должен быть из списка (несколько acl с одним именем — логическое ИЛИ)