eventually-consistent-highly-scalable-system/load_balancer/haproxy.cfg at main · jbdoster/eventually-consistent-highly-scalable-system · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
global
    daemon
    maxconn 256
    # SSL/TLS Configuration
    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
    ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets
    ssl-default-server-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
    ssl-default-server-options ssl-min-ver TLSv1.2 no-tls-tickets
    # Enable DNS resolution
    resolvers docker
        nameserver dns1 127.0.0.11:53
        resolve_retries 3
        timeout retry 1s
        hold valid 10s

defaults
    mode http
    timeout connect 5000ms
    timeout client 50000ms
    timeout server 50000ms
    option httplog
    log stdout local0

frontend http-in
    bind *:8080
    bind *:8443 ssl crt /certs/backend.pem

    # Security headers
    http-response set-header X-Frame-Options DENY
    http-response set-header X-Content-Type-Options nosniff
    http-response set-header X-XSS-Protection "1; mode=block"
    http-response set-header Strict-Transport-Security "max-age=31536000; includeSubDomains"
    http-response set-header Referrer-Policy "strict-origin-when-cross-origin"

    # Rate limiting for security
    stick-table type ip size 100k expire 30s store http_req_rate(10s)
    http-request track-sc0 src
    http-request deny if { sc_http_req_rate(0) gt 20 }

    # Redirect HTTP to HTTPS for production security
    redirect prefix https://localhost:8443 code 301 if !{ ssl_fc }

    # Route coupon read requests to coupon service
    acl is_coupon_read path_beg /api/v1/coupons
    use_backend coupon_read_servers if is_coupon_read

    # Route write requests to write layer
    acl is_write_request path_beg /api/write
    use_backend write_servers if is_write_request

    # Route Keycloak requests (modern URL structure)
    acl is_auth_request path_beg /realms
    acl is_auth_request path_beg /admin
    acl is_auth_request path_beg /metrics
    acl is_auth_request path_beg /health
    acl is_auth_request path_beg /js/
    acl is_auth_request path_beg /resources/
    use_backend auth_servers if is_auth_request

    # Route other API requests to appropriate services
    acl is_public_api path_beg /api/v1
    use_backend public_api_servers if is_public_api

    # Route all API requests to appropriate backends
    acl is_api_request path_beg /api
    use_backend write_servers if is_api_request

    # Default to web app for all other requests (static files, UI)
    default_backend web_servers

backend coupon_read_servers
    balance roundrobin
    option httpchk GET /actuator/health
    server coupon1 coupon-service:8086 check

backend write_servers
    balance roundrobin
    option httpchk GET /actuator/health
    server write1 write-layer:8081 check
    server write2 write-layer-2:8081 check

backend auth_servers
    balance roundrobin
    option httpchk GET /realms/event-system
    server keycloak1 keycloak-1:8080 check
    server keycloak2 keycloak-2:8080 check

backend public_api_servers
    balance roundrobin
    option httpchk GET /actuator/health
    server public1 public-api:8082 check

backend web_servers
    balance roundrobin
    option httpchk GET /
    server web1 web-app:80 check