nqdev/haproxy-alpine-custom repository overview

# START: docker-compose up -d --build --force-recreate --remove-orphans
# STOP: docker-compose down -v
docker-compose up -d --build --force-recreate --remove-orphans

# Build container
docker build -t nqdev/haproxy-alpine-custom:3.1.5 .

# Kiểm tra Lua modules
docker run --rm nqdev/haproxy-alpine-custom:3.1.5 luarocks list

# # # # # HAProxy - The Reliable, High Performance TCP/HTTP Load Balancer
# START: docker-compose up -d --build --force-recreate --remove-orphans
# STOP: docker-compose down -v
# # # # #

services:
  haproxy-server-custom:
    container_name: haproxy-server-custom
    image: nqdev/haproxy-alpine-custom:3.1.5-rc10
    build:
      context: ./
      dockerfile: ./Dockerfile
    ports:
      - "18080:80" # HTTP port
      - "17001:7001" # Stats dashboard
    environment:
      - TZ=Asia/Ho_Chi_Minh
      - REDIS_HOST=${REDIS_HOST}
      - REDIS_PORT=${REDIS_PORT}
      - REDIS_PASSWORD=${REDIS_PASSWORD}
    volumes:
      - ./haproxy:/usr/local/etc/haproxy:rw
    dns:
      - 8.8.8.8
      - 8.8.4.4
      - 1.1.1.1
      - 1.0.0.1
    deploy:
      resources:
        limits:
          cpus: "0.80"
          memory: "3.2G"
        reservations:
          cpus: "0.25"
          memory: "256M"

docker run -d \
  --name haproxy-server-custom \
  -p 18080:80 \
  -p 17001:7001 \
  -e TZ=Asia/Ho_Chi_Minh \
  -e REDIS_HOST=redis-server \
  -e REDIS_PORT=6379 \
  -v ./haproxy:/usr/local/etc/haproxy:rw \
  nqdev/haproxy-alpine-custom:3.1.5

/usr/local/etc/haproxy/               # HAProxy configuration
├── haproxy.cfg                       # Main configuration file

/nqdev/haproxy/                       # NQDEV custom structure
├── lua/                              # Lua scripts
│   ├── redis_connector.lua           # Redis connection utility
│   ├── redis_rate_limit.lua          # Rate limiting logic
│   └── cidr_check.lua               # IP/CIDR matching functions
├── map/                              # Map files
│   └── ipclient-rates.map           # IP-specific rate limits
└── errorfiles/                       # Custom error pages
    ├── 400.http, 403.http, 404.http
    ├── 408.http, 429.http, 500.http
    ├── 502.http, 503.http, 504.http
    └── README

-- Map file: /nqdev/haproxy/map/ipclient-rates.map
192.168.1.0/24    100    # Local network - 100 req/min
10.0.0.0/8        50     # VPN users - 50 req/min
0.0.0.0/0         10     # Default - 10 req/min

# Supported protocols and ciphers
ssl crt /etc/haproxy/ssl/ alpn h2,http/1.1 no-sslv3 no-tlsv10 no-tlsv11

# HSTS header (1 year)
http-after-response set-header Strict-Transport-Security "max-age=31536000"

# HTTP health check với expected status
option httpchk OPTIONS / HTTP/1.0
http-check expect rstatus (2|3)[0-9][0-9]

{
  "type": "haproxy",
  "timestamp": 1699891200,
  "frontend_name": "http_in",
  "client_ip": "192.168.1.100",
  "status_code": 200,
  "response_time": 45,
  "backend_server": "web_backend/server1"
}

x-ratelimit-limit: 100
x-ratelimit-usage: 23
x-ratelimit-remaining: 77
x-ratelimit-retry-after: 60
x-ratelimit-timestamp: 1699891200

-- Kiểm tra rate limit cho IP
core.register_action("action_ratelimit_req_check", { "http-req" }, function(txn)
  local client_ip = get_client_ip(txn)
  local rate_limit_ok = rate_limit_check(client_ip, txn)

  if not rate_limit_ok then
    txn:set_var("txn.is_rate_limit_reject_req", "true")
  end
end)

-- Kiểm tra IP trong CIDR range
if cidr_match("192.168.1.100", "192.168.1.0/24") then
  -- IP thuộc về local network
  allow_request()
end

-- Service trả về 429 Too Many Requests
core.register_service("action_ratelimit_check_deny_429", "http", function(applet)
  applet:set_status(429)
  applet:add_header("content-type", "application/json")

  local response = '{"status":"429","message":"Too Many Requests"}'
  applet:start_response()
  applet:send(response)
end)

# Test HAProxy configuration
docker exec haproxy-server-custom haproxy -c -f /usr/local/etc/haproxy/haproxy.cfg

# Check Lua scripts syntax
docker exec haproxy-server-custom lua -l /nqdev/haproxy/lua/redis_rate_limit.lua

# Test rate limiting với curl
for i in {1..15}; do
  curl -H "Host: nqdev.local" http://localhost:18080/ \
    -w "Request $i: %{http_code}\n" -o /dev/null -s
done

# Kiểm tra Redis connectivity
docker exec haproxy-server-custom lua /nqdev/haproxy/lua/redis_connector.lua

# Whitelist files
acl whitelist           src -f /etc/haproxy/whitelist.lst
acl whitelist_webadmin  src -f /etc/haproxy/whitelist-webadmin.lst

# Apply restrictions
http-request deny unless whitelist

# Security headers
http-after-response set-header Strict-Transport-Security "max-age=31536000"
http-response del-header server
http-response del-header x-powered-by

backend backend_maintenance_server
    balance random
    cookie backend_maintenance_server insert indirect nocache

    # Compression
    filter compression
    compression algo gzip
    compression type text/css text/html application/javascript

    # Health checks
    option httpchk OPTIONS / HTTP/1.0
    http-check expect rstatus (2|3)[0-9][0-9]

    # Servers with health monitoring
    server host1 192.168.2.78:17007 cookie s1 minconn 50 maxconn 500 check inter 1s

# docker-compose.prod.yml
services:
  haproxy-primary:
    image: nqdev/haproxy-alpine-custom:3.1.5
    environment:
      REDIS_HOST: redis-cluster
    networks:
      - frontend
      - backend

  haproxy-backup:
    image: nqdev/haproxy-alpine-custom:3.1.5
    environment:
      REDIS_HOST: redis-cluster
    networks:
      - frontend
      - backend

global
    maxconn       50000
    ulimit-n      100050

defaults
    maxconn                 50000
    timeout client          120000ms
    timeout server          120000ms
    timeout http-keep-alive 5m