slfhst/ansible
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

♻️: refactor allowlist

Browse Source
This commit is contained in:
VC
2024-11-04 17:48:43 +01:00
parent 92cbac9568
commit 95f38ef6f7
19 changed files with 95 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
roles/haproxy/templates/haproxy.cfg.j2
View File

@@ -42,10 +42,10 @@ frontend http
acl letsencrypt path_beg /.well-known/acme-challenge
redirect scheme https code 301 if !letsencrypt
{% for server in groups['webservers'] | difference(groups['disabled_loadbalanced_webservers']) | sort %}
{% for hostname in hostvars[server]['web_hostname'] | sort %}
## {{ hostname }} configuration
acl host_{{ hostname }} hdr(host) -i {{ hostname }}
use_backend http_{{ server }} if letsencrypt host_{{ hostname }}
{% for hostname in hostvars[server]['web_hostname'] | sort(attribute='host') %}
## {{ hostname.host }} configuration
acl host_{{ hostname.host }} hdr(host) -i {{ hostname.host }}
use_backend http_{{ server }} if letsencrypt host_{{ hostname.host }}
{% endfor %}
{% endfor %}
@@ -57,13 +57,14 @@ frontend https
tcp-request inspect-delay 3s
tcp-request content accept if { req.ssl_hello_type 1 }
{% for server in groups['webservers'] | difference(groups['disabled_loadbalanced_webservers']) | sort %}
{% for hostname in hostvars[server]['web_hostname'] | sort %}
## {{ hostname }} configuration
acl host_{{ hostname }} req.ssl_sni -i {{ hostname }}
{% if hostname == "btf.mateu.be" %}
acl network_allowed_{{ hostname }} src 88.175.123.77
{% for hostname in hostvars[server]['web_hostname'] | sort(attribute='host') %}
## {{ hostname.host }} configuration
acl host_{{ hostname.host }} req.ssl_sni -i {{ hostname.host }}
{% if hostname.allowlistv4 is defined %}
acl network_allowed_{{ hostname.host }} src {% for addrv4 in hostname.allowlistv4 %}{{ addrv4 }}{% endfor %}
{% endif %}
use_backend https_{{ server }} if host_{{ hostname }}{% if hostname == "btf.mateu.be" %} network_allowed_{{ hostname }}{% endif %}
use_backend https_{{ server }} if host_{{ hostname.host }}{% if hostname.allowlistv4 is defined %} network_allowed_{{ hostname.host }}{% endif %}
{% endfor %}