EDUCATIC
/
digitaldemocratic
mirror of https://gitlab.com/digitaldemocratic/digitaldemocratic
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
digitaldemocratic/dd-sso/docker/haproxy/haproxy.cnf.parts/backends.cnf

58 lines
2.3 KiB
Plaintext
Raw Permalink Normal View History

Initial config modsecurity
2022-10-25 13:48:10 +02:00
#
[WAF] Consolidate proxies and documentation The environment / dd.conf variables: PROXY_PROTOCOL and DISABLE_WAF determine how DD and HAProxy will behave. - PROXY_PROTOCOL: whether or not the PROXY protocol will be accepted - DISABLE_WAF: whether or not WAF will be enabled This simplifies maintenance, as well as the overall architecture and operation. While at it, we now publish images for DD's HAProxy as well.
2022-11-23 20:10:13 +01:00
# BEGIN: backends.cnf
Initial config modsecurity
2022-10-25 13:48:10 +02:00
#
backend letsencrypt
server letsencrypt 127.0.0.1:8080
backend be_api
mode http
http-request set-path /img/favicon.ico if { path_end -i favicon.ico } or { path_end -i favicon } or { path_beg -i /apps/theming/favicon/ }
# Nextcloud use /avatar/username/32 /avatar/username/64 and /avatar/username/128
http-request set-path %[path,regsub(\"^(/avatar/[^/]+).*\",\"\1\")]
server api dd-sso-api:80 check port 80 inter 5s rise 2 fall 10 resolvers mydns init-addr none
backend be_sso
mode http
option httpclose
http-response replace-header Set-Cookie (KEYCLOAK_LOCALE=[^;]*);(.*) \1;Domain="${DOMAIN}";Version=1;Path=/;Secure;
server keycloak dd-sso-keycloak:8080 check port 8080 inter 5s rise 2 fall 10 resolvers mydns init-addr none
backend be_admin
mode http
timeout queue 600s
timeout server 600s
timeout connect 600s
server dd-sso-admin dd-sso-admin:9000 check port 9000 inter 5s rise 2 fall 10 resolvers mydns init-addr none
## APPS
backend be_moodle
mode http
server moodle dd-apps-moodle:8080 check port 8080 inter 5s rise 2 fall 10 resolvers mydns init-addr none
backend be_moodle_long
mode http
timeout server 900s
server moodle dd-apps-moodle:8080 check port 8080 inter 5s rise 2 fall 10 resolvers mydns init-addr none
backend be_nextcloud
mode http
server nextcloud dd-apps-nextcloud-nginx:80 check port 80 inter 5s rise 2 fall 10 resolvers mydns init-addr none
backend be_etherpad
mode http
server etherpad dd-apps-etherpad:9001 check port 9001 inter 5s rise 2 fall 10 resolvers mydns init-addr none
backend be_oof
mode http
server onlyoffice dd-apps-onlyoffice:80 check port 80 inter 5s rise 2 fall 10 resolvers mydns init-addr none
backend be_wp
mode http
[WP] Add CSP and Content-Type-Options headers We do this more reliably on HAProxy, as doing it from WP requires specialised plugins and in DD we are sure that traffic goes through the corresponding HAProxy backend.
2022-12-02 11:13:33 +01:00
# Add security headers here, as WP is a tad of a pain to setup
add yoututbe video in wp
2023-02-21 10:24:32 +01:00
http-response set-header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; connect-src 'self'; img-src 'self' data: *; style-src 'self' 'unsafe-inline' data: fonts.googleapis.com maxcdn.bootstrapcdn.com; font-src 'self' data: fonts.gstatic.com maxcdn.bootstrapcdn.com; frame-src youtube.com https://www.youtube.com"
[WP] Add CSP and Content-Type-Options headers We do this more reliably on HAProxy, as doing it from WP requires specialised plugins and in DD we are sure that traffic goes through the corresponding HAProxy backend.
2022-12-02 11:13:33 +01:00
http-response set-header X-Content-Type-Options "nosniff"
Initial config modsecurity
2022-10-25 13:48:10 +02:00
server wp dd-apps-wordpress:80 check port 80 inter 5s rise 2 fall 10 resolvers mydns init-addr none
[WAF] Consolidate proxies and documentation The environment / dd.conf variables: PROXY_PROTOCOL and DISABLE_WAF determine how DD and HAProxy will behave. - PROXY_PROTOCOL: whether or not the PROXY protocol will be accepted - DISABLE_WAF: whether or not WAF will be enabled This simplifies maintenance, as well as the overall architecture and operation. While at it, we now publish images for DD's HAProxy as well.
2022-11-23 20:10:13 +01:00
#
# END: backends.cnf
#