Trace: • haconfig

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
deb13:haconfig [2026/09/20 21:12] – [Dynamic Whitelist] Bernard Condraudeb13:haconfig [2026/10/29 17:30] (current) – Bernard Condrau
Line 43: Line 43:
     log-format "%ci:%cp [%t] %ft %b/%s %Tw/%Tc/%Tt %B %ts %ac/%fc/%bc/%sc/%rc %sq/%bq"     log-format "%ci:%cp [%t] %ft %b/%s %Tw/%Tc/%Tt %B %ts %ac/%fc/%bc/%sc/%rc %sq/%bq"
     timeout connect 5s     timeout connect 5s
-    timeout client  50s +    timeout client  30s 
-    timeout server  50s+    timeout server  5m # set this high enough to allow complex websites to reply, for example Joomla during install or php calculations
  
 # 1. Public Interface (SNI Router) # 1. Public Interface (SNI Router)
Line 76: Line 76:
     # Remove once all hosts are terminated here     # Remove once all hosts are terminated here
     acl terminate_ssl req.ssl_sni -i bak.condrau.com     acl terminate_ssl req.ssl_sni -i bak.condrau.com
 +    acl terminate_mail req.ssl_sni -i mail.condrau.com
  
     # Route conditionally based on SNI     # Route conditionally based on SNI
     use_backend http_dispatcher if terminate_ssl     use_backend http_dispatcher if terminate_ssl
 +    use_backend webmail_server if terminate_mail
     default_backend passthrough_server     default_backend passthrough_server
  
Line 117: Line 119:
  
     # downstream server handling its own TLS certificates (Calypso)     # downstream server handling its own TLS certificates (Calypso)
-    server calypso 192.168.3.18:443 check+    server calypso 192.168.3.90:443 check 
 + 
 +backend webmail_server 
 +    mode tcp 
 + 
 +    # downstream (synology mail) server handling its own TLS certificates (Merkur) 
 +    server merkur 192.168.3.90:443 check check-ssl verify none
  
 # 3. Intermediary loopback backend # 3. Intermediary loopback backend
Line 197: Line 205:
 echo "clear table stick_table_whitelist" | sudo /usr/bin/socat /run/haproxy/admin.sock stdio echo "clear table stick_table_whitelist" | sudo /usr/bin/socat /run/haproxy/admin.sock stdio
 </code> </code>
-  * To make this work you need to add <user> to file ''update-ip'' in ''/etc/sudoers.d'' so he can execute the command as root without password:<code>vim /etc/sudoers.d/update-ip+  * To make this work you need to add <user> to file ''update-ip'' in ''/etc/sudoers.d'' so <user> can execute the command as root without password:<code>vim /etc/sudoers.d/update-ip
 <user> ALL=(root) NOPASSWD: /usr/bin/socat</code> <user> ALL=(root) NOPASSWD: /usr/bin/socat</code>
   * Call the script from another linux computer or WSL with the following file:<code>#!/bin/bash   * Call the script from another linux computer or WSL with the following file:<code>#!/bin/bash
Line 220: Line 228:
   * Put a shortcut on the Windows Desktop for easy access:<code>C:\Windows\System32\wsl.exe bash ~/batch/updateIP</code>   * Put a shortcut on the Windows Desktop for easy access:<code>C:\Windows\System32\wsl.exe bash ~/batch/updateIP</code>
   * This way you can add your computer to the trusted IP list (whitelist) no matter what is the current IP address.   * This way you can add your computer to the trusted IP list (whitelist) no matter what is the current IP address.
- 
-===== Powershell ===== 
-  * Create the following Powershell script and use it with a shortcut to ''C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "D:\update-dns.ps1"'':<code># D:\update-dns.ps1 
-# This is an example Powershell file for DuckDNS updater, see https://www.duckdns.org 
-param($domain) 
-$duckdomain = if (!$domain) { "my-default-domain-name" } else { $domain } 
-$addr = curl.exe -s "https://api.ipify.org" 
-curl.exe -k "https://www.duckdns.org/update?domains=$duckdomain&token=xxxxxxxx-yyyy-zzzz-*my*-*duckdnstoken*&ip=$addr" 
-</code> 
  

Know How

© 2007-2026 Bernard Condrau - Powered by DokuWiki