HAProxy ロードバランサー設定ジェネレーター

#---------------------------------------------------------------------
# HAProxy 3.0 Production Configuration
# Generated via ToolsAA 100% Client-Side Engine
#---------------------------------------------------------------------
global
    log 127.0.0.1:514 local0 notice
    chroot /var/lib/haproxy
    user haproxy
    group haproxy
    daemon
    maxconn 50000
    nbthread 4
    stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
    stats timeout 30s

    # Hardened Modern SSL/TLS Ciphers (OWASP & Mozilla Modern Standard)
    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256
    ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
    ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets

#---------------------------------------------------------------------
# Common Defaults for all Frontend & Backend Proxies
#---------------------------------------------------------------------
defaults
    log global
    mode http
    option httplog
    option dontlognull
    option redispatch
    retries 3
    timeout connect 5s
    timeout client  50s
    timeout server  50s
    timeout http-keep-alive 15s
    timeout http-request    10s
    timeout queue   1m
    maxconn 30000

#---------------------------------------------------------------------
# Frontend: fe_web_https
#---------------------------------------------------------------------
frontend fe_web_https
    bind *:80
    bind *:443 ssl crt /etc/haproxy/certs/site.pem alpn h2,http/1.1
    http-request redirect scheme https unless { ssl_fc }
    http-response set-header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
    option forwardfor
    http-request set-header X-Forwarded-Proto https if { ssl_fc }
    http-request set-header X-Forwarded-Proto http unless { ssl_fc }
    http-request set-header X-Forwarded-Port %[dst_port]
    compression algo gzip deflate
    compression type text/html text/plain text/css application/javascript application/json

    # Stick-table Rate Limiting & Anti-DDoS
    stick-table type ip size 100k expire 10s store http_req_rate(10s)
    http-request track-sc0 src
    http-request deny deny_status 429 if { sc_http_req_rate(0) gt 120 }

    # ACL Conditions
    acl is_static_assets path_beg /static /assets /favicon.ico

    # ACL Backend Routing Rules
    use_backend be_static_cache if is_static_assets
    default_backend be_app_cluster

#---------------------------------------------------------------------
# Backend: be_app_cluster
#---------------------------------------------------------------------
backend be_app_cluster
    mode http
    balance roundrobin
    cookie SERVERID insert indirect nocache
    option httpchk GET /healthz
    http-check expect status 200,204
    server web01 10.0.1.11:3000 weight 10 check inter 2000 rise 2 fall 3 cookie web01
    server web02 10.0.1.12:3000 weight 10 check inter 2000 rise 2 fall 3 cookie web02
    server web03 10.0.1.13:3000 weight 10 check inter 2000 rise 2 fall 3 cookie web03

#---------------------------------------------------------------------
# Backend: be_static_cache
#---------------------------------------------------------------------
backend be_static_cache
    mode http
    balance roundrobin
    option httpchk GET /healthz
    http-check expect status 200,204
    server nginx-cdn01 10.0.1.51:80 weight 10 check inter 2000 rise 2 fall 3
    server nginx-cdn02 10.0.1.52:80 weight 10 check inter 2000 rise 2 fall 3

#---------------------------------------------------------------------
# HAProxy Real-Time Statistics & Prometheus Metrics Hub
#---------------------------------------------------------------------
listen stats
    bind *:8404
    mode http
    stats enable
    stats uri /stats
    stats refresh 5s
    stats auth admin:SuperClusterSecret2026
    stats show-node
    stats show-legends

    # Prometheus Exporter Endpoint
    http-request use-service prometheus-exporter if { path /metrics }