HAProxy -aaa- Konfiguration

vrrp_script chk_haproxy {
    script "pidof haproxy"
    interval 2
    weight -20
}

vrrp_instance VI_251 {
    state MASTER
    interface ens3
    virtual_router_id 51
    priority 150
    advert_int 1

    authentication {
        auth_type PASS
        auth_pass supergeheim
    }

    virtual_ipaddress {
        192.168.100.251
    }

    garp_master_delay 1
    garp_master_repeat 5
    garp_master_refresh 10

    track_script {
        chk_haproxy
    }
}

vrrp_instance VI_252 {
    state BACKUP
    interface ens3
    virtual_router_id 52
    priority 120
    advert_int 1

    authentication {
        auth_type PASS
        auth_pass supergeheim
    }

    virtual_ipaddress {
        192.168.100.252
    }

    garp_master_delay 1
    garp_master_repeat 5
    garp_master_refresh 10

    track_script {
        chk_haproxy
    }
}

vrrp_instance VI_253 {
    state BACKUP
    interface ens3
    virtual_router_id 53
    priority 120
    advert_int 1

    authentication {
        auth_type PASS
        auth_pass supergeheim
    }

    virtual_ipaddress {
        192.168.100.253
    }

    garp_master_delay 1
    garp_master_repeat 5
    garp_master_refresh 10

    track_script {
        chk_haproxy
    }
}

vrrp_script chk_haproxy {
    script "pidof haproxy"
    interval 2
    weight -20
}

vrrp_instance VI_251 {
    state BACKUP
    interface ens3
    virtual_router_id 51
    priority 120
    advert_int 1

    authentication {
        auth_type PASS
        auth_pass supergeheim
    }

    virtual_ipaddress {
        192.168.100.251
    }

    garp_master_delay 1
    garp_master_repeat 5
    garp_master_refresh 10

    track_script {
        chk_haproxy
    }
}

vrrp_instance VI_252 {
    state MASTER
    interface ens3
    virtual_router_id 52
    priority 150
    advert_int 1

    authentication {
        auth_type PASS
        auth_pass supergeheim
    }

    virtual_ipaddress {
        192.168.100.252
    }

    garp_master_delay 1
    garp_master_repeat 5
    garp_master_refresh 10

    track_script {
        chk_haproxy
    }
}

vrrp_instance VI_253 {
    state BACKUP
    interface ens3
    virtual_router_id 53
    priority 120
    advert_int 1

    authentication {
        auth_type PASS
        auth_pass supergeheim
    }

    virtual_ipaddress {
        192.168.100.253
    }

    garp_master_delay 1
    garp_master_repeat 5
    garp_master_refresh 10

    track_script {
        chk_haproxy
    }
}

vrrp_script chk_haproxy {
    script "pidof haproxy"
    interval 2
    weight -20
}

vrrp_instance VI_251 {
    state BACKUP
    interface ens3
    virtual_router_id 51
    priority 120
    advert_int 1

    authentication {
        auth_type PASS
        auth_pass supergeheim
    }

    virtual_ipaddress {
        192.168.100.251
    }

    garp_master_delay 1
    garp_master_repeat 5
    garp_master_refresh 10

    track_script {
        chk_haproxy
    }
}

vrrp_instance VI_252 {
    state BACKUP
    interface ens3
    virtual_router_id 52
    priority 120
    advert_int 1

    authentication {
        auth_type PASS
        auth_pass supergeheim
    }

    virtual_ipaddress {
        192.168.100.252
    }

    garp_master_delay 1
    garp_master_repeat 5
    garp_master_refresh 10

    track_script {
        chk_haproxy
    }
}

vrrp_instance VI_253 {
    state MASTER
    interface ens3
    virtual_router_id 53
    priority 150
    advert_int 1

    authentication {
        auth_type PASS
        auth_pass supergeheim
    }

    virtual_ipaddress {
        192.168.100.253
    }

    garp_master_delay 1
    garp_master_repeat 5
    garp_master_refresh 10

    track_script {
        chk_haproxy
    }
}

global
  log /dev/log local0
  log /dev/log local1 notice
  daemon
  maxconn 50000

  # ACME in 3.2 ist (noch) EXPERIMENTELL – diese Zeile ist Pflicht
  expose-experimental-directives
  # ACME-Scheduler (Standard: auto)
  acme.scheduler auto

  # Moderne TLS-Defaults
  ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets
  ssl-default-bind-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
  ssl-default-bind-ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
  ssl-default-bind-curves X25519:P-256

  # Für ACME-Abfragen empfiehlt HAProxy ggf. IPv4 zu bevorzugen
  httpclient.resolvers.prefer ipv4

  # Runtime/Stats-Socket (für ACME „dump ssl cert“)
  stats socket /var/run/haproxy.sock mode 660 level admin

defaults
  mode http
  log global
  option httplog
  option dontlognull
  timeout connect 5s
  timeout client  30s
  timeout server  30s
  option forwardfor

# ---------- Frontends ----------
# Port 80 (HTTP): ACME-Challenges beantworten, sonst Redirect auf HTTPS
frontend fe_http
  bind :80
  mode http

  http-request return status 200 content-type text/plain lf-string "%[path,field(-1,/)].%[path,field(-1,/),map(virt@acme)]\n" if { path_beg "/.well-known/acme-challenge/" }

  # Sonst alles auf HTTPS umleiten
  http-request redirect scheme https code 301 unless { path_beg "/.well-known/acme-challenge/" }

# Port 443 (HTTPS): TLS, HTTP/2 und Host-basiertes Routing
frontend fe_https
  mode http
  bind :443 ssl alpn h2,http/1.1 default-crt /mnt/ceph/certs/placeholder.pem

  # ACME: Zertifikate pro Domain verknüpfen (Platzhalter-PEMs beim Start vorhanden)
  # 'ssl-f-use' weist der Bindung Zertifikate zu und koppelt sie an ACME. :contentReference[oaicite:2]{index=2}
  ssl-f-use crt "/mnt/ceph/certs/web1.36px.de.pem" acme LE domains "web1.36px.de"
  ssl-f-use crt "/mnt/ceph/certs/web2.36px.de.pem" acme LE domains "web2.36px.de"
  ssl-f-use crt "/mnt/ceph/certs/web3.36px.de.pem" acme LE domains "web3.36px.de"

  # Host-basierte Weiterleitung
  use_backend be_web1 if { hdr(host) -i web1.36px.de }
  use_backend be_web2 if { hdr(host) -i web2.36px.de }
  use_backend be_web3 if { hdr(host) -i web3.36px.de }

  http-response set-header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

# ---------- Backends ----------
backend be_web1
  mode http
  server web1 192.168.100.131:80 check inter 2s fall 3 rise 2

backend be_web2
  mode http
  server web2 192.168.100.127:80 check inter 2s fall 3 rise 2

backend be_web3
  mode http
  server web3 192.168.100.121:80 check inter 2s fall 3 rise 2
  
# ---------- ACME-Konfiguration ----------
acme LE
  #PRD
  # directory https://acme-v02.api.letsencrypt.org/directory
  #Staging
  directory https://acme-staging-v02.api.letsencrypt.org/directory
  # Optional: vorhandenen Account-Key benutzen (sonst erzeugt HAProxy einen)
  # account-key /etc/haproxy/acme/account.key
  contact alex.it@mailbox.org
  challenge http-01
  keytype ECDSA
  curves P-384
  map virt@acme

global
  log /dev/log local0
  log /dev/log local1 notice
  daemon
  maxconn 50000

  # ACME in 3.2 ist (noch) EXPERIMENTELL – diese Zeile ist Pflicht
  expose-experimental-directives
  # ACME-Scheduler (Standard: auto)
  acme.scheduler auto

  # Moderne TLS-Defaults
  ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets
  ssl-default-bind-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
  ssl-default-bind-ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
  ssl-default-bind-curves X25519:P-256

  # Für ACME-Abfragen empfiehlt HAProxy ggf. IPv4 zu bevorzugen
  httpclient.resolvers.prefer ipv4

  # Runtime/Stats-Socket (für ACME „dump ssl cert“)
  stats socket /var/run/haproxy.sock mode 660 level admin

defaults
  mode http
  log global
  option httplog
  option dontlognull
  timeout connect 5s
  timeout client  30s
  timeout server  30s
  option forwardfor

# ---------- Frontends ----------
# Port 80 (HTTP): ACME-Challenges beantworten, sonst Redirect auf HTTPS
frontend fe_http
  bind :80
  mode http

  http-request return status 200 content-type text/plain lf-string "%[path,field(-1,/)].%[path,field(-1,/),map(virt@acme)]\n" if { path_beg "/.well-known/acme-challenge/" }

  # Sonst alles auf HTTPS umleiten
  http-request redirect scheme https code 301 unless { path_beg "/.well-known/acme-challenge/" }

# Port 443 (HTTPS): TLS, HTTP/2 und Host-basiertes Routing
frontend fe_https
  bind :443 ssl alpn h2,http/1.1 strict-sni
  ssl-f-use crt "/mnt/ceph/certs/web1.36px.de.pem"
  ssl-f-use crt "/mnt/ceph/certs/web2.36px.de.pem"
  ssl-f-use crt "/mnt/ceph/certs/web3.36px.de.pem"

  # Host-basierte Weiterleitung
  use_backend be_web1 if { hdr(host) -i web1.36px.de }
  use_backend be_web2 if { hdr(host) -i web2.36px.de }
  use_backend be_web3 if { hdr(host) -i web3.36px.de }

  http-response set-header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

# ---------- Backends ----------
backend be_web1
  mode http
  server web1 192.168.100.131:80 check inter 2s fall 3 rise 2

backend be_web2
  mode http
  server web2 192.168.100.127:80 check inter 2s fall 3 rise 2

backend be_web3
  mode http
  server web3 192.168.100.121:80 check inter 2s fall 3 rise 2

global
  log /dev/log local0
  log /dev/log local1 notice
  daemon
  maxconn 50000

  # ACME in 3.2 ist (noch) EXPERIMENTELL – diese Zeile ist Pflicht
  expose-experimental-directives
  # ACME-Scheduler (Standard: auto)
  acme.scheduler auto

  # Moderne TLS-Defaults
  ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets
  ssl-default-bind-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
  ssl-default-bind-ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
  ssl-default-bind-curves X25519:P-256

  # Für ACME-Abfragen empfiehlt HAProxy ggf. IPv4 zu bevorzugen
  httpclient.resolvers.prefer ipv4

  # Runtime/Stats-Socket (für ACME „dump ssl cert“)
  stats socket /var/run/haproxy.sock mode 660 level admin

defaults
  mode http
  log global
  option httplog
  option dontlognull
  timeout connect 5s
  timeout client  30s
  timeout server  30s
  option forwardfor

# ---------- Frontends ----------
# Port 80 (HTTP): ACME-Challenges beantworten, sonst Redirect auf HTTPS
frontend fe_http
  bind :80
  mode http

  http-request return status 200 content-type text/plain lf-string "%[path,field(-1,/)].%[path,field(-1,/),map(virt@acme)]\n" if { path_beg "/.well-known/acme-challenge/" }

  # Sonst alles auf HTTPS umleiten
  http-request redirect scheme https code 301 unless { path_beg "/.well-known/acme-challenge/" }

# Port 443 (HTTPS): TLS, HTTP/2 und Host-basiertes Routing
frontend fe_https
  bind :443 ssl alpn h2,http/1.1 strict-sni
  ssl-f-use crt "/mnt/ceph/certs/web1.36px.de.pem"
  ssl-f-use crt "/mnt/ceph/certs/web2.36px.de.pem"
  ssl-f-use crt "/mnt/ceph/certs/web3.36px.de.pem"


  # Host-basierte Weiterleitung
  use_backend be_web1 if { hdr(host) -i web1.36px.de }
  use_backend be_web2 if { hdr(host) -i web2.36px.de }
  use_backend be_web3 if { hdr(host) -i web3.36px.de }

  http-response set-header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

# ---------- Backends ----------
backend be_web1
  mode http
  server web1 192.168.100.131:80 check inter 2s fall 3 rise 2

backend be_web2
  mode http
  server web2 192.168.100.127:80 check inter 2s fall 3 rise 2

backend be_web3
  mode http
  server web3 192.168.100.121:80 check inter 2s fall 3 rise 2