|
| 1 | +# HAProxy |
| 2 | + |
| 3 | +import CodeBlock from "@theme/CodeBlock"; |
| 4 | + |
| 5 | +To use Anubis with HAProxy, you have two variants: |
| 6 | + - simple - stick Anubis between HAProxy and your application backend (simple) |
| 7 | + - perfect if you only have a single application in general |
| 8 | + - advanced - force Anubis challenge by default and route to the application backend by HAProxy if the challenge is correct |
| 9 | + - useful for complex setups |
| 10 | + - routing can be done in HAProxy |
| 11 | + - define ACLs in HAProxy for domains, paths etc which are required/excluded regarding Anubis |
| 12 | + - HAProxy 3.0 recommended |
| 13 | + |
| 14 | +## Simple Variant |
| 15 | + |
| 16 | +```mermaid |
| 17 | +--- |
| 18 | +title: HAProxy with simple config |
| 19 | +--- |
| 20 | +flowchart LR |
| 21 | + T(User Traffic) |
| 22 | + HAProxy(HAProxy Port 80/443) |
| 23 | + Anubis |
| 24 | + Application |
| 25 | +
|
| 26 | + T --> HAProxy |
| 27 | + HAProxy --> Anubis |
| 28 | + Anubis --> |Happy Traffic| Application |
| 29 | +``` |
| 30 | + |
| 31 | +Your Anubis env file configuration may look like this: |
| 32 | + |
| 33 | +import simpleAnubis from "!!raw-loader!./haproxy/simple-config.env"; |
| 34 | + |
| 35 | +<CodeBlock language="bash">{simpleAnubis}</CodeBlock> |
| 36 | + |
| 37 | +The important part is that `TARGET` points to your actual application and if Anubis and HAProxy are on the same machine, a UNIX socket can be used. |
| 38 | + |
| 39 | +Your frontend and backend configuration of HAProxy may look like the following: |
| 40 | + |
| 41 | +import simpleHAProxy from "!!raw-loader!./haproxy/simple-haproxy.cfg"; |
| 42 | + |
| 43 | +<CodeBlock language="bash">{simpleHAProxy}</CodeBlock> |
| 44 | + |
| 45 | +This simply enables SSL offloading, sets some useful and required headers and routes to Anubis directly. |
| 46 | + |
| 47 | +## Advanced Variant |
| 48 | + |
| 49 | +Due to the fact that HAProxy can decode JWT, we are able to verify the Anubis token directly in HAProxy and route the traffic to the specific backends ourselves. |
| 50 | + |
| 51 | +In this example are three applications behind one HAProxy frontend. Only App1 and App2 are secured via Anubis; App3 is open for everyone. The path `/excluded/path` can also be accessed by anyone. |
| 52 | + |
| 53 | +```mermaid |
| 54 | +--- |
| 55 | +title: HAProxy with advanced config |
| 56 | +--- |
| 57 | +
|
| 58 | +flowchart LR |
| 59 | + T(User Traffic) |
| 60 | + HAProxy(HAProxy Port 80/443) |
| 61 | + B1(App1) |
| 62 | + B2(App2) |
| 63 | + B3(App3) |
| 64 | + Anubis |
| 65 | +
|
| 66 | + T --> HAProxy |
| 67 | + HAProxy --> |Traffic for App1 and App2 without valid challenge| Anubis |
| 68 | + HAProxy --> |app1.example.com | B1 |
| 69 | + HAProxy --> |app2.example.com| B2 |
| 70 | + HAProxy --> |app3.example.com| B3 |
| 71 | +``` |
| 72 | + |
| 73 | +:::note |
| 74 | + |
| 75 | +For an improved JWT decoding performance, it's recommended to use HAProxy version 3.0 or above. |
| 76 | + |
| 77 | +::: |
| 78 | + |
| 79 | +Your Anubis env file configuration may look like this: |
| 80 | + |
| 81 | +import advancedAnubis from "!!raw-loader!./haproxy/advanced-config.env"; |
| 82 | + |
| 83 | +<CodeBlock language="bash">{advancedAnubis}</CodeBlock> |
| 84 | + |
| 85 | +It's important to use `HS512_SECRET` which HAProxy understands. Please replace `<SECRET-HERE>` with your own secret string (alphanumerical string with 128 characters recommended). |
| 86 | + |
| 87 | +You can set Anubis to force a challenge for every request using the following policy file: |
| 88 | + |
| 89 | +import advancedAnubisPolicy from "!!raw-loader!./haproxy/advanced-config-policy.yml"; |
| 90 | + |
| 91 | +<CodeBlock language="yaml">{advancedAnubisPolicy}</CodeBlock> |
| 92 | + |
| 93 | +The HAProxy config file may look like this: |
| 94 | + |
| 95 | +import advancedHAProxy from "!!raw-loader!./haproxy/advanced-haproxy.cfg"; |
| 96 | + |
| 97 | +<CodeBlock language="haproxy">{advancedHAProxy}</CodeBlock> |
| 98 | + |
| 99 | +Please replace `<SECRET-HERE>` with the same secret from the Anubis config. |
0 commit comments