global
#log /dev/haproxy/log local0 # see https://en.wikipedia.org/wiki/Syslog#Facility
#log /dev/haproxy/log local1 notice # notice - Error level. The whole list: emerg, alert, crit, err, warning, notice, info, debug
log 127.0.0.1 local2
chroot /var/lib/haproxy # Change the execution directory to protect against attacks. The folder is empty and there are no permissions.
stats socket /run/haproxy/admin.sock mode 660 level admin
stats timeout 30s
# HAPROXY Immutable settings
user haproxy
group haproxy
daemon # Run the process in the background
defaults
log global
mode http
option httplog
option dontlognull
maxconn 256 # Maximum number of simultaneous connections.
# Timeouts
timeout connect 5000ms
timeout client 50000ms
timeout server 50000ms
retries 2 # retries before lowering server status
# Statistics
stats enable
stats hide-version
stats realm Haproxy\ Statistics
stats uri /haproxy #here's a link to the statistics page
stats auth stat:stat #statistics page credentials
option httpchk HEAD / HTTP/1.0
# Access settings
option redispatch # Allows users to go to another server if the server their cookies refer to doesn't work
balance source # Server selection algorithm
frontend frontend_pam
bind *:443 ssl crt /etc/ssl/certs/haproxy.indeed-id.local.pem # Setting up the frontend interface with the path to the certificate of this server
option forwardfor # Pass the original client ip address to the server
acl url_core path_beg /pam/core #
use_backend backend_core if url_core #
acl url_idp path_beg /pam/idp #
use_backend backend_idp if url_idp # balancing rules
acl url_mc path_beg /pam/mc #
use_backend backend_mc if url_mc #
acl url_uc path_beg /pam/uc #
use_backend backend_uc if url_uc #
backend backend_core
option prefer-last-server # Attempt to reuse the same connection to the server
option httpchk GET /pam/core/health # PAM web application availability check
stick-table type string len 35 size 1m expire 1d # The setting required for communication between gateway and core,
stick on path,word(34,/) if { path_beg -i /pam/core/screencastScreencasts/ } # otherwise viewing the video stream will not work
server srv1 192.168.48.21:443 ssl verify none check inter 1000ms fall 3 # Server names for HAProxy monitoring
server srv2 192.168.48.22:443 ssl verify none check inter 1000ms fall 3 #
backend backend_idp
option prefer-last-server # Attempt to reuse the same connection to the server
option httpchk GET /pam/idp/ # PAM web application availability check
server srv1 192.168.48.21:443 ssl verify none check inter 5000ms # Server names for HAProxy monitoring
server srv2 192.168.48.22:443 ssl verify none check inter 5000ms #
backend backend_mc
option prefer-last-server # Attempt to reuse the same connection to the server
option httpchk GET /pam/mc/ # PAM web application availability check
server srv1 192.168.48.21:443 ssl verify none check inter 5000ms # Server names for HAProxy monitoring
server srv2 192.168.48.22:443 ssl verify none check inter 5000ms #
backend backend_uc
option prefer-last-server # Attempt to reuse the same connection to the server
option httpchk GET /pam/uc/ # PAM web application availability check
server srv1 192.168.48.21:443 ssl verify none check inter 5000ms # Server names for HAProxy monitoring
server srv2 192.168.48.22:443 ssl verify none check inter 5000ms #
| 