caddy-frontend: Put haproxy just before the backend
This is needed in order to provide future support for client certificates to the backend. Also it means that haproxy is used in all cases, with or without cache, and as a result the "cached" version of caddy is dropped. Let haproxy setup maxconn by itself, as it's wise enough. Also trust that it'll detect and use proper limits, instead enforcing them in the shell with ulimit trick (ulimit -n $(ulimit -Hn)). As empty server alias can impact the configuration, add proper test for checking it.
Showing
This diff is collapsed.
This diff is collapsed.
| global | ||
| pidfile {{ configuration['pid-file'] }} | ||
| # master-worker is compatible with foreground with process management | ||
| master-worker | ||
| log stderr local0 | ||
| defaults | ||
| log global | ||
| mode http | ||
| option httplog | ||
| timeout queue 60s | ||
| timeout server {{ configuration['request-timeout'] }}s | ||
| timeout client {{ configuration['request-timeout'] }}s | ||
| timeout connect {{ configuration['backend-connect-timeout'] }}s | ||
| retries {{ configuration['backend-connect-retries'] }} | ||
| # tentative below https://cbonte.github.io/haproxy-dconv/2.0/configuration.html#option%20httpclose | ||
| option httpclose | ||
|
||
| {%- macro frontend_entry(slave_instance, scheme) %} | ||
| {%- set host_list = (slave_instance.get('server-alias') or '').split() %} | ||
| {%- if slave_instance.get('custom_domain') not in host_list %} | ||
| {%- do host_list.append(slave_instance.get('custom_domain')) %} | ||
| {%- endif %} | ||
| {%- for host in host_list %} | ||
| {%- if host.startswith('*.') %} | ||
| {#- hdr_sub has to be used, as anyway something.example.com shall match *.example.com[:port], with optional port #} | ||
| acl is_{{ slave_instance['slave_reference'] }} hdr_sub(host) -i {{ host[2:] }} | ||
| {%- else %} | ||
| acl is_{{ slave_instance['slave_reference'] }} hdr_dom(host) -i {{ host }} | ||
| {%- endif %} | ||
| {%- endfor %} | ||
| use_backend {{ slave_instance['slave_reference'] }}-{{ scheme }} if is_{{ slave_instance['slave_reference'] }} | ||
| {%- endmacro %} | ||
| frontend http-backend | ||
| bind {{ configuration['local-ipv4'] }}:{{ configuration['http-port'] }} | ||
| {%- for slave_instance in backend_slave_list %} | ||
| {{ frontend_entry(slave_instance, 'http') }} | ||
| {%- endfor %} | ||
| frontend https-backend | ||
| bind {{ configuration['local-ipv4'] }}:{{ configuration['https-port'] }} | ||
| {%- for slave_instance in backend_slave_list %} | ||
| {{ frontend_entry(slave_instance, 'https') }} | ||
| {%- endfor %} | ||
| {%- for slave_instance in backend_slave_list %} | ||
| {%- for (scheme, prefix) in [('http', 'http_backend'), ('https', 'https_backend')] %} | ||
| {%- set info_dict = slave_instance[prefix] %} | ||
| {%- if info_dict['scheme'] == 'https' %} | ||
| {%- set ssl = ['ssl verify'] %} | ||
| {%- set path_to_ssl_proxy_ca_crt = slave_instance.get('path_to_ssl_proxy_ca_crt') %} | ||
| {%- if slave_instance['ssl_proxy_verify'] %} | ||
| {%- if path_to_ssl_proxy_ca_crt %} | ||
| {%- do ssl.append('required ca-file %s' % (path_to_ssl_proxy_ca_crt,)) %} | ||
| {%- else %} | ||
| {#- Backend SSL shall be verified, but not CA provided, disallow connection #} | ||
| {#- Simply dropping hostname from the dict will result with ignoring it... #} | ||
| {%- do info_dict.__setitem__('hostname', '') %} | ||
| {%- endif %} | ||
| {%- else %} | ||
| {%- do ssl.append('none') %} | ||
| {%- endif %} | ||
| {%- set ssl = ' '.join(ssl) %} | ||
| {%- else %} | ||
| {%- set ssl = '' %} | ||
| {%- endif %} | ||
| backend {{ slave_instance['slave_reference'] }}-{{ scheme }} | ||
| {%- set hostname = info_dict['hostname'] %} | ||
| {%- set port = info_dict['port'] %} | ||
| {%- set path = info_dict['path'].rstrip('/') %} | ||
| {%- if hostname and port %} | ||
| timeout server {{ slave_instance['request-timeout'] }}s | ||
| timeout connect {{ slave_instance['backend-connect-timeout'] }}s | ||
| retries {{ slave_instance['backend-connect-retries'] }} | ||
| server backend {{ hostname }}:{{ port }} {{ ssl }} | ||
| {%- if path %} | ||
| http-request set-path {{ path }}%[path] | ||
| {%- endif %} | ||
| {%- endif %} | ||
| {%- endfor %} | ||
| {%- endfor %} | ||
This diff is collapsed.