From 6d0325190fcede5b912c20cfb6ffefab90a3f4f4 Mon Sep 17 00:00:00 2001 From: Viacheslav Hletenko Date: Sat, 13 May 2023 12:59:12 +0000 Subject: T5222: Add load-balancing for web traffic --- interface-definitions/include/haproxy/mode.xml.i | 22 ++ interface-definitions/include/haproxy/rule.xml.i | 130 +++++++++++ .../include/haproxy/timeout.xml.i | 45 ++++ .../load-balancing-haproxy.xml.in | 245 +++++++++++++++++++++ 4 files changed, 442 insertions(+) create mode 100644 interface-definitions/include/haproxy/mode.xml.i create mode 100644 interface-definitions/include/haproxy/rule.xml.i create mode 100644 interface-definitions/include/haproxy/timeout.xml.i create mode 100644 interface-definitions/load-balancing-haproxy.xml.in (limited to 'interface-definitions') diff --git a/interface-definitions/include/haproxy/mode.xml.i b/interface-definitions/include/haproxy/mode.xml.i new file mode 100644 index 000000000..672ea65b4 --- /dev/null +++ b/interface-definitions/include/haproxy/mode.xml.i @@ -0,0 +1,22 @@ + + + + Proxy mode + + http tcp + + invalid value + + http + HTTP proxy mode + + + tcp + TCP proxy mode + + + (http|tcp) + + + + diff --git a/interface-definitions/include/haproxy/rule.xml.i b/interface-definitions/include/haproxy/rule.xml.i new file mode 100644 index 000000000..9d9f63c9c --- /dev/null +++ b/interface-definitions/include/haproxy/rule.xml.i @@ -0,0 +1,130 @@ + + + + Proxy rule number + + u32:1-10000 + Number for this proxy rule + + + + + Proxy rule number must be between 1 and 10000 + + + + + Domain name to match + + txt + Domain address to match + + + + + + + + + Proxy modifications + + + + + Set URL location + + url + Set URL location + + + ^\/[\w\-.\/]+$ + + Incorrect URL format + + + + + Server name + + [-_a-zA-Z0-9]+ + + Server name must be alphanumeric and can contain hyphen and underscores + + + + + + + SSL match options + + req-ssl-sni ssl-fc-sni + + + req-ssl-sni + SSL Server Name Indication (SNI) request match + + + ssl-fc-sni + SSL frontend connection Server Name Indication match + + + ssl-fc-sni-end + SSL frontend match end of connection Server Name Indication + + + (req-ssl-sni|ssl-fc-sni|ssl-fc-sni-end) + + + + + + URL path match + + + + + Begin URL match + + url + Begin URL + + + ^\/[\w\-.\/]+$ + + Incorrect URL format + + + + + + End URL match + + url + End URL + + + ^\/[\w\-.\/]+$ + + Incorrect URL format + + + + + + Exactly URL match + + url + Exactly URL + + + ^\/[\w\-.\/]+$ + + Incorrect URL format + + + + + + + + diff --git a/interface-definitions/include/haproxy/timeout.xml.i b/interface-definitions/include/haproxy/timeout.xml.i new file mode 100644 index 000000000..250b35683 --- /dev/null +++ b/interface-definitions/include/haproxy/timeout.xml.i @@ -0,0 +1,45 @@ + + + + Tiemout options + + + + + Timeout in seconds for established connections + + u32:1-3600 + Check timeout in seconds + + + + + + + + + Set the maximum time to wait for a connection attempt to a server to succeed + + u32:1-3600 + Connect timeout in seconds + + + + + + + + + Set the maximum inactivity time on the server side + + u32:1-3600 + Server timeout in seconds + + + + + + + + + diff --git a/interface-definitions/load-balancing-haproxy.xml.in b/interface-definitions/load-balancing-haproxy.xml.in new file mode 100644 index 000000000..268f4cd18 --- /dev/null +++ b/interface-definitions/load-balancing-haproxy.xml.in @@ -0,0 +1,245 @@ + + + + + + + Configure reverse-proxy + + + + + Frontend name + + [-_a-zA-Z0-9]+ + + Server name must be alphanumeric and can contain hyphen and underscores + + + + + Backend member + + [-_a-zA-Z0-9]+ + + Backend name must be alphanumeric and can contain hyphen and underscores + + txt + Backend name + + + load-balancing reverse-proxy backend + + + + + #include + #include + #include + #include + #include + + + Redirect HTTP to HTTPS + + + + + + SSL Certificate, SSL Key and CA + + + #include + + + + + + + Backend name + + [-_a-zA-Z0-9]+ + + Backend name must be alphanumeric and can contain hyphen and underscores + + + + + Load-balancing algorithm + + source-address round-robin least-connection + + + source-address + Based on hash of source IP address + + + round-robin + Round robin + + + least-connection + Least connection + + + (source-address|round-robin|least-connection) + + + round-robin + + #include + #include + + + Backend parameters + + + + + HTTP health check + + + + + + #include + + + Backend server name + + + + + Backend server address + + ipv4 + IPv4 unicast peer address + + + ipv6 + IPv6 unicast peer address + + + + + + + + + + Active health check backend server + + + + #include + + + + + SSL Certificate, SSL Key and CA + + + #include + + + #include + + + + + Global perfomance parameters and limits + + + + + Maximum allowed connections + + u32:1-2000000 + Maximum allowed connections + + + + + + + + + Transport Layer Security (TLS) options + + + + + SSL default bind ciphers + + ecdhe-ecdsa-aes128-gcm-sha256 ecdhe-rsa-aes128-gcm-sha256 ecdhe-ecdsa-aes256-gcm-sha384 ecdhe-rsa-aes256-gcm-sha384 ecdhe-ecdsa-chacha20-poly1305 ecdhe-rsa-chacha20-poly1305 dhe-rsa-aes128-gcm-sha256 dhe-rsa-aes256-gcm-sha384 + + + ecdhe-ecdsa-aes128-gcm-sha256 + ecdhe-ecdsa-aes128-gcm-sha256 + + + ecdhe-rsa-aes128-gcm-sha256 + ecdhe-rsa-aes128-gcm-sha256 + + + ecdhe-ecdsa-aes256-gcm-sha384 + ecdhe-ecdsa-aes256-gcm-sha384 + + + ecdhe-rsa-aes256-gcm-sha384 + ecdhe-rsa-aes256-gcm-sha384 + + + ecdhe-ecdsa-chacha20-poly1305 + ecdhe-ecdsa-chacha20-poly1305 + + + ecdhe-rsa-chacha20-poly1305 + ecdhe-rsa-chacha20-poly1305 + + + dhe-rsa-aes128-gcm-sha256 + dhe-rsa-aes128-gcm-sha256 + + + dhe-rsa-aes256-gcm-sha384 + dhe-rsa-aes256-gcm-sha384 + + + (ecdhe-ecdsa-aes128-gcm-sha256|ecdhe-rsa-aes128-gcm-sha256|ecdhe-ecdsa-aes256-gcm-sha384|ecdhe-rsa-aes256-gcm-sha384|ecdhe-ecdsa-chacha20-poly1305|ecdhe-rsa-chacha20-poly1305|dhe-rsa-aes128-gcm-sha256|dhe-rsa-aes256-gcm-sha384) + + + + + ecdhe-ecdsa-aes128-gcm-sha256 ecdhe-rsa-aes128-gcm-sha256 ecdhe-ecdsa-aes256-gcm-sha384 ecdhe-rsa-aes256-gcm-sha384 ecdhe-ecdsa-chacha20-poly1305 ecdhe-rsa-chacha20-poly1305 dhe-rsa-aes128-gcm-sha256 dhe-rsa-aes256-gcm-sha384 + + + + Specify the minimum required TLS version + + 1.2 1.3 + + + 1.2 + TLS v1.2 + + + 1.3 + TLS v1.3 + + + (1.2|1.3) + + + 1.3 + + + + + + #include + + + + + -- cgit v1.2.3