blob: c9d81a3f1bd76ed446fc66b3ef3e53b71c9ed36e (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
|
resource "helm_release" "ingress_haproxy" {
name = "ingress-haproxy"
namespace = kubernetes_namespace.all["base-system"].metadata[0].name
repository = "https://haproxytech.github.io/helm-charts"
chart = "kubernetes-ingress"
version = "1.40.1"
values = [
<<-YAML
controller:
kind: DaemonSet
ingressClassResource:
name: "${local.ingress_haproxy_class}"
default: false
ingressClass: "${local.ingress_haproxy_class}"
config:
global-config-snippet: |
# SSL options
ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
ssl-default-bind-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256
frontend-config-snippet: |
# Track request rates
stick-table type ipv6 size 100k expire 30s store http_req_rate(10s)
http-request track-sc0 src
# Block known bad actors
acl ai_spam req.fhdr(User-Agent) -m sub -i ahrefsbot
acl ai_spam req.fhdr(User-Agent) -m sub -i amazonbot
acl ai_spam req.fhdr(User-Agent) -m sub -i applebot-extended
acl ai_spam req.fhdr(User-Agent) -m sub -i barkrowler
acl ai_spam req.fhdr(User-Agent) -m sub -i fxios
acl ai_spam req.fhdr(User-Agent) -m sub -i bytespider
acl ai_spam req.fhdr(User-Agent) -m sub -i ccbot
acl ai_spam req.fhdr(User-Agent) -m sub -i chatgpt-user
acl ai_spam req.fhdr(User-Agent) -m sub -i claude-web
acl ai_spam req.fhdr(User-Agent) -m sub -i claudebot
acl ai_spam req.fhdr(User-Agent) -m sub -i diffbot
acl ai_spam req.fhdr(User-Agent) -m sub -i dotbot
acl ai_spam req.fhdr(User-Agent) -m sub -i facebookbot
acl ai_spam req.fhdr(User-Agent) -m sub -i facebookexternalhit
acl ai_spam req.fhdr(User-Agent) -m sub -i friendlycrawler
acl ai_spam req.fhdr(User-Agent) -m sub -i google-extended
acl ai_spam req.fhdr(User-Agent) -m sub -i gptbot
acl ai_spam req.fhdr(User-Agent) -m sub -i image2dataset
acl ai_spam req.fhdr(User-Agent) -m sub -i imagesiftbot
acl ai_spam req.fhdr(User-Agent) -m sub -i meta-externalagent
acl ai_spam req.fhdr(User-Agent) -m sub -i mozilla\/5\.0\ \(linux\;\ android\ 6\.0\.1\;\ nexus\ 5x\ build\/mmb29p\)
acl ai_spam req.fhdr(User-Agent) -m sub -i omgili
acl ai_spam req.fhdr(User-Agent) -m sub -i perplexitybot
acl ai_spam req.fhdr(User-Agent) -m sub -i petalbot
acl ai_spam req.fhdr(User-Agent) -m sub -i presto
acl ai_spam req.fhdr(User-Agent) -m sub -i semrushbot
acl ai_spam req.fhdr(User-Agent) -m sub -i timpibot
http-request deny if ai_spam
#http-request deny if { sc_http_req_rate(0) gt 20 }
cookie-persistence: "tyilnet_k8s_haproxy_persistence"
forwarded-for: "true"
proxy-protocol: >
fd00:8::0/48,
172.28.0.0/16,
fd00:5::0/108,
172.25.0.0/16,
fd68:1057:1992:3381::/48,
10.57.0.0/16
ssl-redirect: "true"
ssl-redirect-port: "443"
response-set-header: |
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
resources:
requests:
memory: 256Mi
limits:
memory: 256Mi
logging:
level: info
traffic:
address: stdout
format: raw
facility: daemon
service:
enabled: true
type: NodePort
nodePorts:
http: 31080
https: 31443
stat: 31024
prometheus: 31060
ipFamilyPolicy: PreferDualStack
serviceMonitor:
enabled: true
YAML
]
}
locals {
ingress_haproxy_class = "haproxy"
}
|
