53 lines
2.2 KiB
Django/Jinja
53 lines
2.2 KiB
Django/Jinja
global
|
|
log stdout format raw local0
|
|
maxconn 4096
|
|
|
|
defaults
|
|
log global
|
|
mode http
|
|
option httplog
|
|
option dontlognull
|
|
timeout connect 5s
|
|
timeout client 30s
|
|
timeout server 30s
|
|
timeout http-request 10s
|
|
retries 2
|
|
|
|
frontend fe_https
|
|
bind *:443 ssl crt /etc/haproxy/certs/mln-uber.club.pem
|
|
mode http
|
|
option forwardfor
|
|
http-request set-header X-Forwarded-Proto https
|
|
# Force le Host envoye aux backends : sans ca, un scan/requete directe sur l'IP
|
|
# publique (Host: <IP> ou absent) fait grimper le score d'anomalie ModSecurity
|
|
# (rule 920280 "Missing a Host Header") et se fait bloquer en 403 cote WAF.
|
|
http-request set-header Host {{ domain_name }}
|
|
|
|
# /api/* et /uploads/* -> pool backend (Go), tout le reste -> pool frontend (SPA)
|
|
acl is_api path_beg /api/ /uploads/ /webhook/telegram /webhook/nowpayment
|
|
use_backend be_api if is_api
|
|
default_backend be_frontend
|
|
|
|
# ============================================================
|
|
# Pool API — TODO : /api/health n'existe pas encore côté backend,
|
|
# ce check échouera tant que la route n'est pas ajoutée.
|
|
# ============================================================
|
|
backend be_api
|
|
mode http
|
|
http-check send meth GET uri /api/health hdr Host {{ domain_name }}
|
|
http-check expect status 200
|
|
|
|
server prod-uber {{ hostvars['prod-uber']['vpn_ip'] }}:443 ssl verify none check inter 2s fall 3 rise 2
|
|
server replica-prod-uber {{ hostvars['replica-prod-uber']['vpn_ip'] | default('TODO-vpn_ip-manquant') }}:443 ssl verify none check inter 2s fall 3 rise 2 backup
|
|
|
|
# ============================================================
|
|
# Pool frontend statique (SPA) — check sur "/" (toujours servi par nginx même si l'API est down)
|
|
# ============================================================
|
|
backend be_frontend
|
|
mode http
|
|
http-check send meth GET uri / hdr Host {{ domain_name }}
|
|
http-check expect status 200
|
|
|
|
server prod-uber {{ hostvars['prod-uber']['vpn_ip'] }}:443 ssl verify none check inter 2s fall 3 rise 2
|
|
server replica-prod-uber {{ hostvars['replica-prod-uber']['vpn_ip'] | default('TODO-vpn_ip-manquant') }}:443 ssl verify none check inter 2s fall 3 rise 2 backup
|