mirror of
https://gitlab.archlinux.org/archlinux/infrastructure.git
synced 2026-11-07 13:58:47 +01:00
Leonidas Spyropoulos
ac11200b21
The change in9f9e4f43introduced excessive logging resulting in monitoring running ouf of disk. Reduce logging for nginx stream. Fixes:9f9e4f43Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>
52 lines
1.8 KiB
Django/Jinja
52 lines
1.8 KiB
Django/Jinja
# {{ ansible_managed }}
|
|
#
|
|
# L4 front-proxy for the HAProxy ADN setup. It terminates the PROXY protocol
|
|
# from the ADN, denies banned clients by their *real* IP (rewritten by the
|
|
# stream realip module configured in snippets/proxy-settings-stream.conf) before
|
|
# any TLS handshake, then re-emits the PROXY protocol to the loopback http
|
|
# listeners (127.0.0.1:8080 / :8443) where TLS terminates and the real client IP
|
|
# is preserved.
|
|
#
|
|
# The deny lines are written by fail2ban (action.d/nginx-stream-deny.conf); a
|
|
# systemd path unit (nginx-stream-deny-reload) reloads nginx when they change.
|
|
# access_log is off on purpose: the http{} layer already logs every request with
|
|
# the real IP, and denials are visible in the error_log.
|
|
|
|
server {
|
|
listen 80 proxy_protocol;
|
|
listen [::]:80 proxy_protocol;
|
|
|
|
access_log off;
|
|
error_log syslog:server=unix:/dev/log,nohostname notice; # info logs every connection
|
|
|
|
{% if nginx_proxy_vendor %}
|
|
# Never block the ADN proxies themselves (avoid locking out a whole PoP).
|
|
{% for proxy_ip_addr in vault_proxy_vendor_trusted_ips[nginx_proxy_vendor] %}
|
|
allow {{ proxy_ip_addr }};
|
|
{% endfor %}
|
|
{% endif %}
|
|
include snippets/stream-fail2ban-deny.conf;
|
|
|
|
proxy_pass 127.0.0.1:8080;
|
|
proxy_protocol on;
|
|
}
|
|
|
|
server {
|
|
listen 443 proxy_protocol;
|
|
listen [::]:443 proxy_protocol;
|
|
|
|
access_log off;
|
|
error_log syslog:server=unix:/dev/log,nohostname notice; # info logs every connection
|
|
|
|
{% if nginx_proxy_vendor %}
|
|
# Never block the ADN proxies themselves (avoid locking out a whole PoP).
|
|
{% for proxy_ip_addr in vault_proxy_vendor_trusted_ips[nginx_proxy_vendor] %}
|
|
allow {{ proxy_ip_addr }};
|
|
{% endfor %}
|
|
{% endif %}
|
|
include snippets/stream-fail2ban-deny.conf;
|
|
|
|
proxy_pass 127.0.0.1:8443;
|
|
proxy_protocol on;
|
|
}
|