Repository navigation
Expand file tree
/
Copy pathhaproxy.cfg.example
More file actions
88 lines (71 loc) · 2.87 KB
/
Copy pathhaproxy.cfg.example
File metadata and controls
88 lines (71 loc) · 2.87 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
#
# haproxy.cfg.example - minimal configuration using the haproxy_req_fp SPOE agent
#
# Requirements:
# HAProxy 2.0+ with SPOE support
# haproxy_req_fp_spoa.py running on 127.0.0.1:9002
#
# Optional:
# --http-endpoint URL on the SPOA to POST JSON fingerprints
# A JA4 Lua module (e.g. FriendlyCaptcha/ja4-haproxy) setting txn.ja4
# The SPOE agent logs any extra args you pass (e.g. h2_fingerprint=var(...))
#
global
log stdout format raw local0
defaults
mode http
timeout connect 5s
timeout client 30s
timeout server 30s
log global
# ---------------------------------------------------------------------------
# Basic usage: fingerprint in access log
# ---------------------------------------------------------------------------
frontend http-in
bind *:80
# If using a JA4 Lua module, compute it before the SPOE message fires:
# http-request lua.ja4
filter spoe engine req-fp config /etc/haproxy/haproxy_req_fp.spoe.conf
log-format "%ci:%cp [%tQ] %f %b/%s %Tq/%Tw/%Tc/%Tr/%Ta %ST %B %{+Q}r %[var(txn.reqfp.req_fp)]"
default_backend app
# ---------------------------------------------------------------------------
# Structured JSON log (easier to ingest into a SIEM or ML pipeline)
# ---------------------------------------------------------------------------
frontend http-in-json
bind *:8080
filter spoe engine req-fp config /etc/haproxy/haproxy_req_fp.spoe.conf
log-format '{"ts":"%tQ","client":"%ci","method":"%HM","path":"%HP","status":%ST,"bytes":%B,"fp":"%[var(txn.reqfp.req_fp)]"}'
default_backend app
# ---------------------------------------------------------------------------
# Inject fingerprint as response header
# ---------------------------------------------------------------------------
frontend http-in-header
bind *:8081
filter spoe engine req-fp config /etc/haproxy/haproxy_req_fp.spoe.conf
http-response set-header X-Req-FP %[var(txn.reqfp.req_fp)]
default_backend app
# ---------------------------------------------------------------------------
# High-performance: compute fingerprint in HAProxy Lua
# ---------------------------------------------------------------------------
# In this mode the Lua module computes txn.req_fp, the SPOE filter sends only
# the precomputed value to the Python SPOA, and req.hdrs is not shipped across
# SPOE. Requires the SPOE config to use:
# args req_fp=var(txn.req_fp) client_ip=src ja4=var(txn.ja4)
#
# global
# log stdout format raw local0
# lua-load /etc/haproxy/haproxy_req_fp.lua
#
# frontend http-in-lua
# bind *:8082
# http-response lua.req_fp
# filter spoe engine req-fp config /etc/haproxy/haproxy_req_fp.spoe.conf
# default_backend app
backend req-fp-backend
mode tcp
balance roundrobin
timeout connect 5s
timeout server 3m
server req-fp-srv 127.0.0.1:9002
backend app
server s1 127.0.0.1:8000 check