mirror of
https://pagure.io/fedora-infra/ansible.git
synced 2026-04-26 03:23:08 +08:00
86 lines
2.6 KiB
Plaintext
86 lines
2.6 KiB
Plaintext
{% if rewrite %}
|
|
RewriteEngine On
|
|
RewriteRule ^{{remotepath}}$ %{REQUEST_URI}/ [R=301]
|
|
|
|
{% endif %}
|
|
{% if header_scheme %}
|
|
RequestHeader set X-Forwarded-Scheme https early
|
|
RequestHeader set X-Scheme https early
|
|
RequestHeader set X-Forwarded-Proto https early
|
|
|
|
{% endif %}
|
|
{% if header_expect %}
|
|
RequestHeader unset Expect early
|
|
|
|
{% endif %}
|
|
{% if keephost %}
|
|
ProxyPreserveHost On
|
|
{% endif %}
|
|
|
|
{% if balancer_name is defined %}
|
|
# This is something that wants a apache balancer
|
|
{% if 'iad2' in inventory_hostname or not ocp4|bool %}
|
|
# This proxy is in iad2 and so we setup the balancer.
|
|
# Non iad2 proxies just send a 421 for this application to avoid firefox h2 reuse bug
|
|
SSLProxyEngine On
|
|
|
|
{% if targettype is defined and targettype == "openshift" %}
|
|
SSLProxyVerify require
|
|
SSLProxyCheckPeerName Off
|
|
{% if ocp4 and env == "production" %}
|
|
SSLProxyCACertificateFile "/etc/haproxy/ocp-prod.pem"
|
|
{% elif ocp4 and env == "staging" %}
|
|
SSLProxyCACertificateFile "/etc/haproxy/ocp-stg.pem"
|
|
{% else %}
|
|
SSLProxyCACertificateFile "/etc/haproxy/os-master.pem"
|
|
{% endif %}
|
|
{% endif %}
|
|
|
|
<Proxy "balancer://{{balancer_name}}-websocket">
|
|
{% for member in balancer_members %}
|
|
{% if http_not_https_yes_this_is_insecure_and_i_feel_bad %}
|
|
{% if remotepath is defined and remotepath != "/" %}
|
|
BalancerMember "ws://{{ member }}{{ remotepath }}"
|
|
{% else %}
|
|
BalancerMember "ws://{{ member }}"
|
|
{% endif %}
|
|
{% else %}
|
|
{% if remotepath is defined and remotepath != "/" %}
|
|
BalancerMember "wss://{{ member }}{{ remotepath }}"
|
|
{% else %}
|
|
BalancerMember "wss://{{ member }}"
|
|
{% endif %}
|
|
{% endif %}
|
|
{% endfor %}
|
|
</Proxy>
|
|
|
|
RewriteEngine on
|
|
RewriteCond %{HTTP:Upgrade} ^WebSocket$ [NC]
|
|
RewriteCond %{HTTP:Connection} Upgrade [NC]
|
|
{% if remotepath is defined and remotepath != "/" %}
|
|
RewriteCond %{REQUEST_URI} ^{{ remotepath }}/(.)*
|
|
{% endif %}
|
|
RewriteRule .* "balancer://{{ balancer_name }}-websocket%{REQUEST_URI}" [P]
|
|
|
|
<Proxy "balancer://{{balancer_name}}">
|
|
{% for member in balancer_members %}
|
|
{% if http_not_https_yes_this_is_insecure_and_i_feel_bad %}
|
|
BalancerMember "http://{{ member }}"
|
|
{% else %}
|
|
BalancerMember "https://{{ member }}"
|
|
{% endif %}
|
|
{% endfor %}
|
|
</Proxy>
|
|
ProxyPass {{ localpath }} "balancer://{{balancer_name}}{{remotepath}}"
|
|
ProxyPassReverse {{ localpath }} "balancer://{{balancer_name}}{{remotepath}}"
|
|
{% elif ocp4|bool %}
|
|
# This is a non iad2 proxy and an app that only exists in iad2
|
|
# We do this to avoid a h2 connection reuse bug by firefox.
|
|
Redirect 421 /
|
|
{% endif %}
|
|
{% else %}
|
|
# This is an application that just goes to one url, not a balancer
|
|
ProxyPass {{ localpath }} {{ proxyurl }}{{remotepath}} {{ proxyopts }}
|
|
ProxyPassReverse {{ localpath }} {{ proxyurl }}{{remotepath}}
|
|
{% endif %}
|