primo

2026-07-17 09:42:52 +02:00
commit 20d506407a
93 changed files with 14526 additions and 0 deletions
--- a/installa_haproxy.sh
+++ b/installa_haproxy.sh
@@ -0,0 +1,123 @@
+sudo apt update && sudo apt install -y haproxy
+
+sudo tee /etc/haproxy/haproxy.cfg > /dev/null <<'EOF'
+global
+  log /dev/log local0
+  maxconn 20000
+  tune.bufsize 16384
+ # SSL configuration for future HTTPS endpoints
+        ca-base /etc/ssl/certs
+        crt-base /etc/ssl/private
+        
+        # Modern SSL configuration - only secure protocols
+        ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
+        ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
+        ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets
+
+defaults
+        log     global
+        mode    http
+        option  httplog
+        option  dontlognull
+        timeout connect 5000
+        timeout client  50000
+        timeout server  50000
+        errorfile 400 /etc/haproxy/errors/400.http
+        errorfile 403 /etc/haproxy/errors/403.http
+        errorfile 408 /etc/haproxy/errors/408.http
+        errorfile 500 /etc/haproxy/errors/500.http
+        errorfile 502 /etc/haproxy/errors/502.http
+        errorfile 503 /etc/haproxy/errors/503.http
+        errorfile 504 /etc/haproxy/errors/504.http
+
+frontend rke2_registration_frontend
+    bind *:9345
+    mode tcp
+    option tcplog
+    default_backend rke2_registration_backend
+
+#---------------------------------------------------------------------
+# RKE2 Supervisor/Registration Backend
+# Round-robin between masters for node registration
+#---------------------------------------------------------------------
+backend rke2_registration_backend
+    mode tcp
+    balance roundrobin
+    option tcp-check
+    # Health check ensures we only send traffic to healthy masters
+    server POC-Master0 POC-Master0:9345 check
+    server POC-Master1 POC-Master1:9345 check
+    server POC-Master2 POC-Master2:9345 check
+
+#---------------------------------------------------------------------
+# Kubernetes API Frontend
+# This is where kubectl commands and apps connect
+#---------------------------------------------------------------------
+frontend k8s_api_frontend
+    bind *:6443
+    mode tcp
+    option tcplog
+    default_backend k8s_api_backend
+
+#---------------------------------------------------------------------
+# Kubernetes API Backend
+# Distributes API requests across all masters
+#---------------------------------------------------------------------
+backend k8s_api_backend
+    mode tcp
+    balance roundrobin
+    option tcp-check
+    # TCP health checks on the API port
+    server POC-Master0 POC-Master0:6443 check
+    server POC-Master1 POC-Master1:6443 check
+    server POC-Master2 POC-Master2:6443 check
+
+#---------------------------------------------------------------------
+# Statistics Page (Optional but useful for monitoring)
+#---------------------------------------------------------------------
+listen stats
+    bind *:8080
+    stats enable
+    stats uri /stats
+    stats refresh 30s
+    stats show-node
+    stats auth admin:admin  # Change this password!
+
+#---------------------------------------------------------------------
+# nginx ingress
+# This is where kubectl commands and apps connect
+#---------------------------------------------------------------------
+frontend nginx_frontend_443
+    bind *:443
+    mode tcp
+    option tcplog
+    default_backend nginx_backend
+
+frontend nginx_frontend_80
+    bind *:80
+    mode http
+    http-response set-header Access-Control-Allow-Origin %[hdr(origin)]
+    default_backend nginx_backend_http
+#---------------------------------------------------------------------
+# Kubernetes API Backend
+# Distributes API requests across all masters
+#---------------------------------------------------------------------
+backend nginx_backend
+    mode tcp
+    balance roundrobin
+    option tcp-check
+    # TCP health checks on the API port
+    server POC-Master0 POC-Master0:30864 check 
+    server POC-Master1 POC-Master1:30864 check
+    server POC-Master2 POC-Master2:30864 check
+
+backend nginx_backend_http
+    mode http
+    balance roundrobin
+    # TCP health checks on the API port
+    server POC-Master0 POC-Master0:30864 check ssl verify none
+    server POC-Master1 POC-Master1:30864 check ssl verify none
+    server POC-Master2 POC-Master2:30864 check ssl verify none
+EOF
+
+sudo systemctl enable --now haproxy