berghain/examples/haproxy/haproxy.cfg at b7eaab87d7b885df41dc8e4e71b2e6ca42b97d42 · DropMorePackets/berghain · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
global
    log stdout format raw local0

defaults
    mode http
    log global
    timeout client 5s
    timeout server 5s
    timeout connect 5s
    option httplog

listen stats
    bind 127.0.0.1:8000
    stats enable
    stats uri /
    stats refresh 15s

frontend test
    bind *:8080
    log-format "%ci:%cp\ [%t]\ %ft\ %b/%s\ %Th/%Ti/%TR/%Tq/%Tw/%Tc/%Tr/%Tt\ %ST\ %B\ %CC\ %CS\ %tsc\ %ac/%fc/%bc/%sc/%rc\ %sq/%bq\ %hr\ %hs\ %{+Q}r\ %ID spoa-error:\ %[var(txn.berghain.error)]"

    http-request track-sc1 src table st_src

    filter spoe engine berghain config examples/haproxy/berghain.cfg

    http-request set-var(req.berghain.level) int(1) if { sc1_http_req_rate gt 5 }
    http-request set-var(req.berghain.level) int(2) if { sc1_http_req_rate gt 10 }
    http-request set-var(req.berghain.level) int(3) if { sc1_http_req_rate gt 15 }

    acl berghain_active var(req.berghain.level) -m found

    acl berghain_path path /cdn-cgi/challenge-platform/challenge
    http-request send-spoe-group berghain validate if !berghain_path berghain_active
    http-request return status 501 if { var(txn.berghain.error) -m found }

    acl berghain_valid var(txn.berghain.valid) -m bool
    acl is_ssl ssl_fc

    http-request return status 403 content-type "text/html" file "web/dist/default/index.html" if !berghain_valid !berghain_path berghain_active !is_ssl
    http-request return status 403 content-type "text/html" file "web/dist/native-crypto/index.html" if !berghain_valid !berghain_path berghain_active is_ssl
    http-request wait-for-body time 5s if berghain_path METH_POST
    use_backend berghain_http if berghain_path

    default_backend app_backend

backend st_src
    stick-table type ipv6 size 1m expire 15m store http_req_rate(10s)

backend app_backend
    mode http
    http-request return status 200 content-type "text/plain" string "Hello World!"

backend berghain_http
    mode http
    filter spoe engine berghain_challenge config examples/haproxy/berghain.cfg

    acl is_challenge_path path /cdn-cgi/challenge-platform/challenge

    http-request send-spoe-group berghain_challenge challenge if is_challenge_path
    http-request return status 501 if { var(txn.berghain.error) -m found }

    acl has_token var(txn.berghain.token) -m found

    http-after-response add-header set-cookie "berghain=%[var(txn.berghain.token)]; %[var(txn.berghain.domain)] path=/;" if has_token
    http-request return status 200 content-type "application/json" lf-string "%[var(txn.berghain.response)]" if is_challenge_path

    http-request return status 404

backend berghain_spop
    mode tcp
    option spop-check
    server localhost unix@./spop.sock check