dogeystamp
864c1bdfd3
docker is now listening on localhost, with a haproxy on the services server to forward the ports outwards. this is because docker tends to disregard UFW's rules, but haproxy should be better in that regard. meanwhile, the firewall rules have been configured properly to only allow the bastion IP in over the wireguard connection, for proper authentication.
18 lines
336 B
Django/Jinja
18 lines
336 B
Django/Jinja
defaults
|
|
log global
|
|
mode tcp
|
|
timeout connect 10s
|
|
timeout client 36h
|
|
timeout server 36h
|
|
balance leastconn
|
|
|
|
{% if groups["gitea"] | length > 0 %}
|
|
listen gitea_ssh
|
|
bind *:2499
|
|
option tcp-check
|
|
tcp-check expect rstring SSH-2.0-OpenSSH.*
|
|
{% for host in groups["gitea"] %}
|
|
server {{ host }} {{ host }}:2498
|
|
{% endfor %}
|
|
{% endif %}
|