mirror of
https://gitgud.io/fatchan/haproxy-protection.git
synced 2025-05-09 02:05:37 +00:00
Add health check setup in server registration
Add observe layer4 inter to default server line Fix 3rd nginx and update docker-compose Remove x-haproxy-cn header fetch because it only needs to be a static fetch of haproxy_cn, since the logic overwrite it to be equivalent
This commit is contained in:
@ -1,5 +1,3 @@
|
|||||||
version: "3.9"
|
|
||||||
|
|
||||||
services:
|
services:
|
||||||
|
|
||||||
haproxy:
|
haproxy:
|
||||||
@ -67,7 +65,7 @@ services:
|
|||||||
|
|
||||||
nginx3:
|
nginx3:
|
||||||
build:
|
build:
|
||||||
context: ./nginx2
|
context: ./nginx3
|
||||||
dockerfile: Dockerfile
|
dockerfile: Dockerfile
|
||||||
ports:
|
ports:
|
||||||
- 1083:443
|
- 1083:443
|
||||||
|
@ -169,7 +169,7 @@ backend haproxy-to-varnish-cache
|
|||||||
|
|
||||||
backend servers
|
backend servers
|
||||||
balance roundrobin
|
balance roundrobin
|
||||||
default-server ssl verify required ca-file ca-certificates.crt sni req.hdr(Host)
|
default-server ssl verify required ca-file ca-certificates.crt sni req.hdr(Host) check observe layer4 inter 30
|
||||||
use-server %[lua.get_server_names] if TRUE
|
use-server %[lua.get_server_names] if TRUE
|
||||||
|
|
||||||
backend bot_check_post_throttle
|
backend bot_check_post_throttle
|
||||||
|
@ -1 +1,2 @@
|
|||||||
localhost admin
|
localhost admin
|
||||||
|
localhost.com admin
|
||||||
|
@ -1,2 +1,3 @@
|
|||||||
localhost 127.0.0.1:1082|NA
|
localhost 127.0.0.1:1082|XX
|
||||||
localhost 127.0.0.1:1083|SA
|
localhost 127.0.0.1:1083|XX
|
||||||
|
localhost 127.0.0.1:1084|XX
|
||||||
|
@ -4,16 +4,11 @@ local bot_check = require("bot-check")
|
|||||||
local utils = require("utils")
|
local utils = require("utils")
|
||||||
local server_cn_split_regex = "([^;]+)|(%u%u)$"
|
local server_cn_split_regex = "([^;]+)|(%u%u)$"
|
||||||
local backends_map = Map.new('/etc/haproxy/map/backends.map', Map._str)
|
local backends_map = Map.new('/etc/haproxy/map/backends.map', Map._str)
|
||||||
local haproxy_cn = os.getenv("HAPROXY_CONTINENT") or "XX" -- shoult never be XX but avoid typing issue
|
local haproxy_cn = os.getenv("HAPROXY_CONTINENT") or "XX" -- should never be XX but avoid typing issue
|
||||||
|
|
||||||
function Get_server_names(txn)
|
function Get_server_names(txn)
|
||||||
local key = txn.sf:hdr("Host")
|
local key = txn.sf:hdr("Host")
|
||||||
-- local user_cn = txn:get_var("txn.xcn") or "XX"
|
local target_backend_cn = haproxy_cn
|
||||||
local user_cn = txn.sf:hdr("X-Continent-Code") or "XX"
|
|
||||||
if user_cn ~= haproxy_cn then
|
|
||||||
-- dont sent to a further away backend for non-regional servers, until asvc kicks in
|
|
||||||
user_cn = haproxy_cn
|
|
||||||
end
|
|
||||||
local value = backends_map:lookup(key or "")
|
local value = backends_map:lookup(key or "")
|
||||||
if value ~= nil then
|
if value ~= nil then
|
||||||
local filtered_backends = {}
|
local filtered_backends = {}
|
||||||
@ -22,9 +17,12 @@ function Get_server_names(txn)
|
|||||||
-- Single pass to filter and collect backends
|
-- Single pass to filter and collect backends
|
||||||
for _, backend in ipairs(vals) do
|
for _, backend in ipairs(vals) do
|
||||||
local backend_server_name, backend_cn = backend:match(server_cn_split_regex)
|
local backend_server_name, backend_cn = backend:match(server_cn_split_regex)
|
||||||
if backend_server_name then
|
local server_up = txn.f:srv_is_up('servers/' .. backend_server_name)
|
||||||
|
-- print('backend_server_name: ' .. backend_server_name)
|
||||||
|
-- print('server_up: ' .. server_up)
|
||||||
|
if backend_server_name and server_up == 1 then
|
||||||
table.insert(all_backends, backend_server_name)
|
table.insert(all_backends, backend_server_name)
|
||||||
if backend_cn == user_cn then
|
if backend_cn == target_backend_cn then
|
||||||
table.insert(filtered_backends, backend_server_name)
|
table.insert(filtered_backends, backend_server_name)
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
@ -43,17 +43,18 @@ function setup_servers()
|
|||||||
if verify_backend_ssl ~= nil then
|
if verify_backend_ssl ~= nil then
|
||||||
if verify_none ~= nil then -- for development use only
|
if verify_none ~= nil then -- for development use only
|
||||||
tcp:send(string.format(
|
tcp:send(string.format(
|
||||||
"add server %s %s check ssl verify none ca-file ca-certificates.crt sni req.hdr(Host);",
|
"add server %s %s ssl verify none ca-file ca-certificates.crt sni req.hdr(Host) check observe layer4;",
|
||||||
server_name, backend_host))
|
server_name, backend_host))
|
||||||
else
|
else
|
||||||
tcp:send(string.format(
|
tcp:send(string.format(
|
||||||
"add server %s %s check ssl verify required ca-file ca-certificates.crt sni req.hdr(Host);",
|
"add server %s %s ssl verify required ca-file ca-certificates.crt sni req.hdr(Host) check observe layer4;",
|
||||||
server_name, backend_host))
|
server_name, backend_host))
|
||||||
end
|
end
|
||||||
else
|
else
|
||||||
tcp:send(string.format("add server %s %s;", server_name, backend_host))
|
tcp:send(string.format("add server %s %s;", server_name, backend_host))
|
||||||
end
|
end
|
||||||
tcp:send(string.format("enable server %s;", server_name))
|
tcp:send(string.format("enable server %s;", server_name))
|
||||||
|
tcp:send(string.format("enable health %s;", server_name))
|
||||||
line = handle:read("*line")
|
line = handle:read("*line")
|
||||||
counter = counter + 1
|
counter = counter + 1
|
||||||
end
|
end
|
||||||
|
Reference in New Issue
Block a user