Trace: • haconfig

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
deb13:haconfig [2026/09/20 21:11] – [Dynamic Whitelist] Bernard Condraudeb13:haconfig [2026/10/29 17:30] (current) – Bernard Condrau
Line 43: Line 43:
     log-format "%ci:%cp [%t] %ft %b/%s %Tw/%Tc/%Tt %B %ts %ac/%fc/%bc/%sc/%rc %sq/%bq"     log-format "%ci:%cp [%t] %ft %b/%s %Tw/%Tc/%Tt %B %ts %ac/%fc/%bc/%sc/%rc %sq/%bq"
     timeout connect 5s     timeout connect 5s
-    timeout client  50s +    timeout client  30s 
-    timeout server  50s+    timeout server  5m # set this high enough to allow complex websites to reply, for example Joomla during install or php calculations
  
 # 1. Public Interface (SNI Router) # 1. Public Interface (SNI Router)
Line 76: Line 76:
     # Remove once all hosts are terminated here     # Remove once all hosts are terminated here
     acl terminate_ssl req.ssl_sni -i bak.condrau.com     acl terminate_ssl req.ssl_sni -i bak.condrau.com
 +    acl terminate_mail req.ssl_sni -i mail.condrau.com
  
     # Route conditionally based on SNI     # Route conditionally based on SNI
     use_backend http_dispatcher if terminate_ssl     use_backend http_dispatcher if terminate_ssl
 +    use_backend webmail_server if terminate_mail
     default_backend passthrough_server     default_backend passthrough_server
  
Line 117: Line 119:
  
     # downstream server handling its own TLS certificates (Calypso)     # downstream server handling its own TLS certificates (Calypso)
-    server calypso 192.168.3.18:443 check+    server calypso 192.168.3.90:443 check 
 + 
 +backend webmail_server 
 +    mode tcp 
 + 
 +    # downstream (synology mail) server handling its own TLS certificates (Merkur) 
 +    server merkur 192.168.3.90:443 check check-ssl verify none
  
 # 3. Intermediary loopback backend # 3. Intermediary loopback backend
Line 194: Line 202:
   * Remove IP address from whitelist stick table:<code>echo "clear table stick_table_whitelist key 192.168.1.99" | socat /run/haproxy/admin.sock stdio</code>   * Remove IP address from whitelist stick table:<code>echo "clear table stick_table_whitelist key 192.168.1.99" | socat /run/haproxy/admin.sock stdio</code>
   * Show content of whitelist stick table:<code>echo "show table stick_table_whitelist" | socat /run/haproxy/admin.sock stdio</code>   * Show content of whitelist stick table:<code>echo "show table stick_table_whitelist" | socat /run/haproxy/admin.sock stdio</code>
-  * To add an IP address for a remote computer not in one of your trusted IP ranges you should set the expire duration short in ''HAProxy.cfg'' because you cannot rely on the IP address being the same when you want to remove the IP address. You can add the following command to update and remove all entries in the stick table:<code>$ IP=$(curl -s https://api.ipify.org) && echo "set table stick_table_whitelist key $IP" | sudo /usr/bin/socat /run/haproxy/admin.sock stdio+  * To add an IP address for a remote computer not in one of your trusted IP ranges you should set the expire duration short in ''HAProxy.cfg'' because you cannot rely on the IP address being the same when you want to remove the IP address. You can add the following command to update and remove all entries in the stick table:<code>IP=$(curl -s https://api.ipify.org) && echo "set table stick_table_whitelist key $IP" | sudo /usr/bin/socat /run/haproxy/admin.sock stdio
 echo "clear table stick_table_whitelist" | sudo /usr/bin/socat /run/haproxy/admin.sock stdio echo "clear table stick_table_whitelist" | sudo /usr/bin/socat /run/haproxy/admin.sock stdio
 </code> </code>
-  * To make this work you need to add <user> to file ''update-ip'' in ''/etc/sudoers.d'' so he can execute the command as root without password:<code>vim /etc/sudoers.d/update-ip+  * To make this work you need to add <user> to file ''update-ip'' in ''/etc/sudoers.d'' so <user> can execute the command as root without password:<code>vim /etc/sudoers.d/update-ip
 <user> ALL=(root) NOPASSWD: /usr/bin/socat</code> <user> ALL=(root) NOPASSWD: /usr/bin/socat</code>
   * Call the script from another linux computer or WSL with the following file:<code>#!/bin/bash   * Call the script from another linux computer or WSL with the following file:<code>#!/bin/bash
Line 220: Line 228:
   * Put a shortcut on the Windows Desktop for easy access:<code>C:\Windows\System32\wsl.exe bash ~/batch/updateIP</code>   * Put a shortcut on the Windows Desktop for easy access:<code>C:\Windows\System32\wsl.exe bash ~/batch/updateIP</code>
   * This way you can add your computer to the trusted IP list (whitelist) no matter what is the current IP address.   * This way you can add your computer to the trusted IP list (whitelist) no matter what is the current IP address.
- 
-===== Powershell ===== 
-  * Create the following Powershell script and use it with a shortcut to ''C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "D:\update-dns.ps1"'':<code># D:\update-dns.ps1 
-# This is an example Powershell file for DuckDNS updater, see https://www.duckdns.org 
-param($domain) 
-$duckdomain = if (!$domain) { "my-default-domain-name" } else { $domain } 
-$addr = curl.exe -s "https://api.ipify.org" 
-curl.exe -k "https://www.duckdns.org/update?domains=$duckdomain&token=xxxxxxxx-yyyy-zzzz-*my*-*duckdnstoken*&ip=$addr" 
-</code> 
  

Know How

© 2007-2026 Bernard Condrau - Powered by DokuWiki