Skip to content
Snippets Groups Projects
Commit eddf7b2a authored by Andre Zoledziowski's avatar Andre Zoledziowski Committed by Jairo Llopis
Browse files

Inverted HAProxy security policy.

parent 5a7bc8fd
Branches
Tags
No related merge requests found
Show whitespace changes
Inline Side-by-side
Showing
with 25 additions and 24 deletions
haproxy.cfg
+ 25
− 24
View file @ eddf7b2a
...@@ -42,28 +42,29 @@ backend dockerbackend ...@@ -42,28 +42,29 @@ backend dockerbackend
frontend dockerfrontend frontend dockerfrontend
bind :2375 bind :2375
http-request deny unless METH_GET || { env(POST) -m bool } http-request deny unless METH_GET || { env(POST) -m bool }
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/[^/]+/((stop)|(restart)|(kill)) } ! { env(ALLOW_RESTARTS) -m bool } http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/[^/]+/((stop)|(restart)|(kill)) } { env(ALLOW_RESTARTS) -m bool }
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/auth } ! { env(AUTH) -m bool } http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/auth } { env(AUTH) -m bool }
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/build } ! { env(BUILD) -m bool } http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/build } { env(BUILD) -m bool }
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/commit } ! { env(COMMIT) -m bool } http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/commit } { env(COMMIT) -m bool }
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/configs } ! { env(CONFIGS) -m bool } http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/configs } { env(CONFIGS) -m bool }
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers } ! { env(CONTAINERS) -m bool } http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers } { env(CONTAINERS) -m bool }
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/distribution } ! { env(DISTRIBUTION) -m bool } http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/distribution } { env(DISTRIBUTION) -m bool }
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/events } ! { env(EVENTS) -m bool } http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/events } { env(EVENTS) -m bool }
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/exec } ! { env(EXEC) -m bool } http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/exec } { env(EXEC) -m bool }
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/images } ! { env(IMAGES) -m bool } http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/images } { env(IMAGES) -m bool }
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/info } ! { env(INFO) -m bool } http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/info } { env(INFO) -m bool }
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/networks } ! { env(NETWORKS) -m bool } http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/networks } { env(NETWORKS) -m bool }
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/nodes } ! { env(NODES) -m bool } http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/nodes } { env(NODES) -m bool }
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/_ping } ! { env(PING) -m bool } http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/_ping } { env(PING) -m bool }
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/plugins } ! { env(PLUGINS) -m bool } http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/plugins } { env(PLUGINS) -m bool }
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/post } ! { env(POST) -m bool } http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/post } { env(POST) -m bool }
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/secrets } ! { env(SECRETS) -m bool } http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/secrets } { env(SECRETS) -m bool }
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/services } ! { env(SERVICES) -m bool } http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/services } { env(SERVICES) -m bool }
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/session } ! { env(SESSION) -m bool } http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/session } { env(SESSION) -m bool }
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/swarm } ! { env(SWARM) -m bool } http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/swarm } { env(SWARM) -m bool }
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/system } ! { env(SYSTEM) -m bool } http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/system } { env(SYSTEM) -m bool }
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/tasks } ! { env(TASKS) -m bool } http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/tasks } { env(TASKS) -m bool }
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/version } ! { env(VERSION) -m bool } http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/version } { env(VERSION) -m bool }
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/volumes } ! { env(VOLUMES) -m bool } http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/volumes } { env(VOLUMES) -m bool }
http-request deny
default_backend dockerbackend default_backend dockerbackend
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment