From 888e681b238063687f348c9505b7035b0ef29e7f Mon Sep 17 00:00:00 2001 From: the1Riddle Date: Tue, 19 Dec 2023 00:39:22 +0300 Subject: [PATCH] commit --- 0x10-https_ssl/1-haproxy_ssl_termination | 45 ++++++++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100755 0x10-https_ssl/1-haproxy_ssl_termination diff --git a/0x10-https_ssl/1-haproxy_ssl_termination b/0x10-https_ssl/1-haproxy_ssl_termination new file mode 100755 index 0000000..5e0d7af --- /dev/null +++ b/0x10-https_ssl/1-haproxy_ssl_termination @@ -0,0 +1,45 @@ +global + log /dev/log local0 + log /dev/log local1 notice + chroot /var/lib/haproxy + stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners + stats timeout 30s + user haproxy + group haproxy + daemon + + # Default SSL material locations + ca-base /etc/ssl/certs + crt-base /etc/ssl/private + + # See: https://ssl-config.mozilla.org/#server=haproxy&server-version=2.0.3&config=intermediate + ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 + ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 + ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets + +defaults + log global + mode http + option httplog + option dontlognull + timeout connect 5000 + timeout client 50000 + timeout server 50000 + errorfile 400 /etc/haproxy/errors/400.http + errorfile 403 /etc/haproxy/errors/403.http + errorfile 408 /etc/haproxy/errors/408.http + errorfile 500 /etc/haproxy/errors/500.http + errorfile 502 /etc/haproxy/errors/502.http + errorfile 503 /etc/haproxy/errors/503.http + errorfile 504 /etc/haproxy/errors/504.http + +backend web-backend + balance roundrobin + option forwardfor + server 338390-web-01 52.204.118.62:80 check + server 338390-web-02 100.27.10.76:80 check +frontend proxynode + bind *:80 + mode http + bind *:443 ssl crt /etc/letsencrypt/live/www.rezzcode.tech/cets.tech.pem + default_backend web-backend