PapaTramp/reverse-proxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(haproxy): Synology DSM heap и exchange с allowlist syno-allowed (0.7.4).

Browse Source 
heap.kalinamall.ru → 192.168.160.185:5001, exchange.kalinamall.ru → 192.168.160.35:5001.
This commit is contained in:
Andrey Lutsenko
2026-06-13 16:54:06 +10:00
parent e3f968347d
commit fc448fd589
4 changed files with 51 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/haproxy-install.md
+22 -1
View File
@@ -44,7 +44,7 @@ sudo haproxy -c -f /etc/haproxy/haproxy.cfg
```bash
sudo cp ~/reverse-proxy/haproxy.cfg /etc/haproxy/haproxy.cfg
sudo cp ~/reverse-proxy/git-sac-allowed ~/reverse-proxy/1c-allowed ~/reverse-proxy/zabbix-allowed /etc/haproxy/
sudo cp ~/reverse-proxy/git-sac-allowed ~/reverse-proxy/1c-allowed ~/reverse-proxy/zabbix-allowed ~/reverse-proxy/syno-allowed /etc/haproxy/
```
3. Проверка и перезапуск:
@@ -84,3 +84,24 @@ sudo haproxy -c -f /etc/haproxy/haproxy.cfg
```bash
curl -sI --resolve zabbix.kalinamall.ru:80:ПУБЛИЧНЫЙ_IP http://zabbix.kalinamall.ru/
```
## Synology DSM (heap, exchange)
| Имя | NAS | Порт DSM |
|-----|-----|----------|
| **`heap.kalinamall.ru`** | **192.168.160.185** | **5001** (HTTPS) |
| **`exchange.kalinamall.ru`** | **192.168.160.35** | **5001** (HTTPS) |
- Снаружи: **`https://heap.kalinamall.ru`**, **`https://exchange.kalinamall.ru`** (TCP passthrough, TLS на Synology)
- IP-allowlist: **`syno-allowed`**
- На NAS: сертификат **`*.kalinamall.ru`** (GlobalSign) и соответствующее имя в **Панель управления → Безопасность → Сертификат**
- **`exchange.kalinamall.ru`** — Synology, **не** Microsoft Exchange (**`ext.kalinamall.ru`**)
Проверка с allowlist IP:
```bash
curl -kI --resolve heap.kalinamall.ru:443:ПУБЛИЧНЫЙ_IP https://heap.kalinamall.ru/
curl -kI --resolve exchange.kalinamall.ru:443:ПУБЛИЧНЫЙ_IP https://exchange.kalinamall.ru/
```
При HTTP/2 coalescing в Chromium см. [sac-access.md](sac-access.md) — отдельная вкладка или `http2 off` на других бэкендах с тем же wildcard.