keycloak-quickstarts/proxy/haproxy/reencrypt/haproxy.cfg at main · keycloak/keycloak-quickstarts · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
global
    log stdout format raw local0

defaults
    log     global
    mode    http
    option  httplog
    option  dontlognull
    timeout connect 5s
    timeout client  50s
    timeout server  50s
    retries 3

frontend https_front
    bind *:8443 ssl crt /mnt/certs/haproxy-external.pem
    mode http
    http-request del-header Forwarded
    http-request del-header x-forwarded-for
    http-request del-header x-forwarded-proto
    http-request del-header x-forwarded-host
    http-request del-header x-forwarded-port
    http-request del-header x-forwarded-server
    default_backend keycloak_back

backend keycloak_back
    mode http
    balance roundrobin
    option forwarded host by by_port for
    option httpchk GET /health/ready
    http-check expect status 200
    server keycloak1 keycloak1:8443 ssl verify required crt /mnt/certs/haproxy-internal.pem ca-file /mnt/certs/keycloak1-cert.pem check port 9000 check-ssl verify none inter 5s fall 3 rise 2
    server keycloak2 keycloak2:8443 ssl verify required crt /mnt/certs/haproxy-internal.pem ca-file /mnt/certs/keycloak2-cert.pem check port 9000 check-ssl verify none inter 5s fall 3 rise 2

listen stats
    bind *:8404
    stats enable
    stats uri /stats
    stats refresh 10s