ansible-role-sso/templates/haproxy.cfg.j2

# {{ ansible_managed }}
global
    log /dev/log	local0 err
    log /dev/log	local1 err
    chroot /var/lib/haproxy
    stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
    stats timeout 30s
    user haproxy
    group haproxy
    daemon

    # Default SSL material locations
    ca-base /etc/ssl/certs
    crt-base /etc/ssl/private

    # See: https://ssl-config.mozilla.org/#server=haproxy&server-version=2.0.3&config=intermediate
    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
    ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
    ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets

defaults
    log	global
    mode	http
    option	httplog
    option	dontlognull
    timeout connect 5000
    timeout client  50000
    timeout server  50000
    errorfile 400 /etc/haproxy/errors/400.http
    errorfile 403 /etc/haproxy/errors/403.http
    errorfile 408 /etc/haproxy/errors/408.http
    errorfile 500 /etc/haproxy/errors/500.http
    errorfile 502 /etc/haproxy/errors/502.http
    errorfile 503 /etc/haproxy/errors/503.http
    errorfile 504 /etc/haproxy/errors/504.http

frontend http-in
    bind 0.0.0.0:80
    mode http
    
    maxconn 2000
{% if enable_hydra_dispatcher %}
    acl login_dispatcher path_beg -i {{ haproxy_hydra_dispatcher_base_path }}
{% endif %}
{% if enable_hydra_passwordless %}
    acl login_passwordless path_beg -i {{ haproxy_hydra_passwordless_base_path }}
{% endif %}
{% if enable_hydra_saml %}
    acl login_saml path_beg -i {{ haproxy_hydra_saml_base_path }}
{% endif %}
{% if enable_hydra_oidc %}
    acl login_oidc path_beg -i {{ haproxy_hydra_oidc_base_path }}
{% endif %}
{% if enable_hydra_ldap %}
    acl login_ldap path_beg -i {{ haproxy_hydra_ldap_base_path }}
{% endif %}
{% if enable_hydra_webauthn %}
    acl login_webauthn path_beg -i {{ haproxy_hydra_webauthn_base_path }}
{% endif %}
{% if enable_oidc_test_app %}
    acl oidc_test path_beg -i {{ haproxy_oidc_test_base_path }}
{% endif %}

{% if enable_hydra_dispatcher %}
    use_backend hydra_dispatcher if login_dispatcher
{% endif %}
{% if enable_hydra_passwordless %}
    use_backend hydra_passwordless if login_passwordless
{% endif %}
{% if enable_hydra_saml %}
    use_backend hydra_saml if login_saml
{% endif %}
{% if enable_hydra_oidc %}
    use_backend hydra_oidc if login_oidc
{% endif %}
{% if enable_hydra_ldap %}
    use_backend hydra_ldap if login_ldap
{% endif %}
{% if enable_hydra_webauthn %}
    use_backend hydra_webauthn if login_webauthn
{% endif %}
{% if enable_oidc_test_app %}
    use_backend oidc_test if oidc_test
{% endif %}
    use_backend hydra

option forwardfor

http-request set-header X-Forwarded-Proto {{ haproxy_forwarded_proto }}
http-request set-header X-Forwarded-Host {{ haproxy_forwarded_host }}

# Backend Hydra
backend hydra
    balance roundrobin
    http-request set-path %[path,regsub(^{{ haproxy_hydra_base_path }},)]
    server hydra 127.0.0.1:4444 check

{% if enable_hydra_dispatcher %}
# Backend Hydra Dispatcher
backend hydra_dispatcher
    balance roundrobin
    # Suppression du préfixe /auth/dispatcher dans l'URL
    http-request set-path %[path,regsub(^{{ haproxy_hydra_dispatcher_base_path }}/,/)]
    http-request set-header X-Forwarded-Prefix {{ haproxy_hydra_dispatcher_base_path }}

    server hydra-login-dispatcher 127.0.0.1:3000 check
{%- endif %}

{% if enable_hydra_passwordless %}
# Backend Hydra Passwordless
backend hydra_passwordless
    balance roundrobin
    # Suppression du préfixe /auth/passwordless dans l'URL
    http-request set-path %[path,regsub(^{{ haproxy_hydra_passwordless_base_path }},)]
    http-request set-header X-Forwarded-Prefix {{ haproxy_hydra_passwordless_base_path }}

    server hydra-login-passwordless 127.0.0.1:3001 check
{%- endif %}

{% if enable_hydra_oidc %}
# Backend Hydra OIDC
backend hydra_oidc
    balance roundrobin
    # Suppression du préfixe /auth/oidc dans l'URL
    http-request set-path %[path,regsub(^{{ haproxy_hydra_oidc_base_path }},)]
    http-request set-header X-Forwarded-Prefix {{ haproxy_hydra_oidc_base_path }}

    server hydra-login-oidc 127.0.0.1:3004 check
{%- endif %}

{% if enable_hydra_saml %}
# Backend Hydra SAML
backend hydra_saml
    balance roundrobin
    server hydra-login-saml 127.0.0.1:3002 check
{%- endif %}

{% if enable_hydra_ldap %}
# Backend Hydra LDAP
backend hydra_ldap
    balance roundrobin
    http-request set-path %[path,regsub(^{{ haproxy_hydra_ldap_base_path }},)]
    http-request set-header X-Forwarded-Prefix {{ haproxy_hydra_ldap_base_path }}
    server hydra-login-ldap 127.0.0.1:3005 check
{%- endif %}

{% if enable_hydra_webauthn %}
# Backend Hydra WebAuthn
backend hydra_webauthn
    balance roundrobin
    http-request set-path %[path,regsub(^{{ haproxy_hydra_webauthn_base_path }},)]
    http-request set-header X-Forwarded-Prefix {{ haproxy_hydra_webauthn_base_path }}
    server hydra-login-ldap 127.0.0.1:3006 check
{%- endif %}

{% if enable_oidc_test_app %}
backend oidc_test
    balance roundrobin
    # Suppression du préfixe /auth/test dans l'URL
    http-request set-path %[path,regsub(^{{ haproxy_oidc_test_base_path }},/)]
    http-request set-header X-Forwarded-Prefix {{ haproxy_oidc_test_base_path }}

    server oidc-test 127.0.0.1:8080 check
{% endif %}