@@ -42,8 +42,8 @@ defaults
4242 option dontlog-normal
4343
4444 timeout connect 5000
45- timeout client 50000
46- timeout server 50000
45+ timeout client 300000
46+ timeout server 300000
4747
4848 errorfile 500 /etc/haproxy/errors/500.http
4949 errorfile 502 /etc/haproxy/errors/502.http
@@ -97,35 +97,6 @@ frontend http
9797 mode http
9898
9999 default_backend default
100-
101- # ACL function declarations for Rate Limits
102- #capture request header Host len 20
103- #capture response header Location len 20
104-
105- #acl is_abuse src_http_req_rate(Abuse) ge {{ haproxy_lb_rate_limit_per_min }}
106- #acl inc_abuse_cnt src_inc_gpc0(Abuse) gt 0 # Increments counter GPC0 (general purpose counter 0) by one when called/matched - Activates limiter
107- #acl abuse_cnt src_get_gpc0(Abuse) gt 0 # Query GPC0 for > 0 - checks on limiter
108-
109- ### Rate limiter
110- #tcp-request connection track-sc0 src table Abuse
111- #tcp-request connection reject if abuse_cnt !{ src -f /etc/haproxy/allowlist.acl }
112-
113- #http-request track-sc0 src table Abuse
114- #http-request reject if abuse_cnt !{ src -f /etc/haproxy/allowlist.acl }
115-
116- # Tarpit ratelimited requests for 10s
117- #timeout tarpit 10s
118-
119- #{% for item in haproxy_lb_rate_limit_targets %}
120-
121- # Rate limiter ACL for {{ item.name }}
122- #acl ratehost_{{ item.name }} hdr(host) -i {{ item.domain }}
123- #acl ratehost_{{ item.name }} hdr(host) -i {{ item.domain }}:80
124- #acl ratehost_{{ item.name }} hdr(host) -i {{ item.domain }}:443
125- #http-request tarpit deny_status 429 if ratehost_{{ item.name }} is_abuse inc_abuse_cnt !{ src -f /etc/haproxy/allowlist.acl }
126- #{% endfor %}
127-
128-
129100 # HSTS (63072000 seconds)
130101 http-response set-header Strict-Transport-Security max-age=63072000
131102
0 commit comments