Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- global
- log /dev/log local0
- log /dev/log local1 notice
- chroot /var/lib/haproxy
- stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
- stats timeout 30s
- user haproxy
- group haproxy
- daemon
- # Default SSL material locations
- ca-base /etc/ssl/certs
- crt-base /etc/ssl/private
- # See: https://ssl-config.mozilla.org/#server=haproxy&server-version=2.0.3&config=intermediate
- ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
- ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
- ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets
- defaults
- log global
- mode http
- option httplog
- option dontlognull
- timeout connect 5000
- timeout client 50000
- timeout server 50000
- errorfile 400 /etc/haproxy/errors/400.http
- errorfile 403 /etc/haproxy/errors/403.http
- errorfile 408 /etc/haproxy/errors/408.http
- errorfile 500 /etc/haproxy/errors/500.http
- errorfile 502 /etc/haproxy/errors/502.http
- errorfile 503 /etc/haproxy/errors/503.http
- errorfile 504 /etc/haproxy/errors/504.http
- frontend https
- bind public-ip:443
- mode tcp
- tcp-request inspect-delay 5s
- tcp-request content accept if { req_ssl_hello_type 1 }
- use_backend dnsdist if { req_ssl_sni -i doh.example.com }
- use_backend nginx if { req_ssl_sni -i nss1.example.com }
- use_backend nginx if { req_ssl_sni -i dot.example.com }
- default_backend dnsdist
- backend dnsdist
- mode tcp
- option ssl-hello-chk
- server dnsdist 127.0.0.1:443
- backend nginx
- mode tcp
- option ssl-hello-chk
- server nginx 127.0.0.2:443 check
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement