Skip to content

feat(redis-ha-proxy): Configure Redis Ha Proxy TLS settings #1218

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
akhilnittala wants to merge 1 commit into
base: master
Choose a base branch
from
+33 −12
Open

feat(redis-ha-proxy): Configure Redis Ha Proxy TLS settings #1218

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 33 additions & 12 deletions build/redis/haproxy.cfg.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,27 @@
{{- if eq .UseTLS "true"}}
global
ca-base /app/config/redis/tls

{{- if .tlsMinVersion}}
ssl-default-bind-options ssl-min-ver TLSv{{.tlsMinVersion}}
ssl-default-server-options ssl-min-ver TLSv{{.tlsMinVersion}}
{{- end}}

{{- if .tlsCiphers}}
{{- if eq .tlsMinVersion "1.3"}}
# TLS 1.3 cipher suites
ssl-default-bind-ciphersuites {{.tlsCiphers}}
ssl-default-server-ciphersuites {{.tlsCiphers}}
{{- else}}
# TLS 1.2 and below cipher lists
ssl-default-bind-ciphers {{.tlsCiphers}}
ssl-default-server-ciphers {{.tlsCiphers}}

# Also configure TLS 1.3 cipher suites when TLS 1.3 is negotiated
ssl-default-bind-ciphersuites {{.tlsCiphers}}
ssl-default-server-ciphersuites {{.tlsCiphers}}
{{- end}}
Comment thread
akhilnittala marked this conversation as resolved.
{{- end}}
{{- end}}

defaults REDIS
Expand Down Expand Up @@ -37,9 +58,9 @@ backend check_if_redis_is_master_0
server R1 {{.ServiceName}}-announce-1:26379 check inter 3s
server R2 {{.ServiceName}}-announce-2:26379 check inter 3s
{{- else}}
server R0 {{.ServiceName}}-announce-0:26379 verify required ca-file tls.crt check inter 3s
server R1 {{.ServiceName}}-announce-1:26379 verify required ca-file tls.crt check inter 3s
server R2 {{.ServiceName}}-announce-2:26379 verify required ca-file tls.crt check inter 3s
server R0 {{.ServiceName}}-announce-0:26379 ssl verify required ca-file tls.crt check inter 3s
server R1 {{.ServiceName}}-announce-1:26379 ssl verify required ca-file tls.crt check inter 3s
server R2 {{.ServiceName}}-announce-2:26379 ssl verify required ca-file tls.crt check inter 3s
{{- end}}
# Check Sentinel and whether they are nominated master
backend check_if_redis_is_master_1
Expand All @@ -63,9 +84,9 @@ backend check_if_redis_is_master_1
server R1 {{.ServiceName}}-announce-1:26379 check inter 3s
server R2 {{.ServiceName}}-announce-2:26379 check inter 3s
{{- else}}
server R0 {{.ServiceName}}-announce-0:26379 verify required ca-file tls.crt check inter 3s
server R1 {{.ServiceName}}-announce-1:26379 verify required ca-file tls.crt check inter 3s
server R2 {{.ServiceName}}-announce-2:26379 verify required ca-file tls.crt check inter 3s
server R0 {{.ServiceName}}-announce-0:26379 ssl verify required ca-file tls.crt check inter 3s
server R1 {{.ServiceName}}-announce-1:26379 ssl verify required ca-file tls.crt check inter 3s
server R2 {{.ServiceName}}-announce-2:26379 ssl verify required ca-file tls.crt check inter 3s
{{- end}}
# Check Sentinel and whether they are nominated master
backend check_if_redis_is_master_2
Expand All @@ -89,9 +110,9 @@ backend check_if_redis_is_master_2
server R1 {{.ServiceName}}-announce-1:26379 check inter 3s
server R2 {{.ServiceName}}-announce-2:26379 check inter 3s
{{- else}}
server R0 {{.ServiceName}}-announce-0:26379 verify required ca-file tls.crt check inter 3s
server R1 {{.ServiceName}}-announce-1:26379 verify required ca-file tls.crt check inter 3s
server R2 {{.ServiceName}}-announce-2:26379 verify required ca-file tls.crt check inter 3s
server R0 {{.ServiceName}}-announce-0:26379 ssl verify required ca-file tls.crt check inter 3s
server R1 {{.ServiceName}}-announce-1:26379 ssl verify required ca-file tls.crt check inter 3s
server R2 {{.ServiceName}}-announce-2:26379 ssl verify required ca-file tls.crt check inter 3s
{{- end}}

# decide redis backend to use
Expand Down Expand Up @@ -125,9 +146,9 @@ backend bk_redis_master
server R2 {{.ServiceName}}-announce-2:6379 check inter 3s fall 1 rise 1
{{- else}}
use-server R0 if { srv_is_up(R0) } { nbsrv(check_if_redis_is_master_0) ge 2 }
server R0 {{.ServiceName}}-announce-0:6379 verify required ca-file tls.crt check inter 3s fall 1 rise 1
server R0 {{.ServiceName}}-announce-0:6379 ssl verify required ca-file tls.crt check inter 3s fall 1 rise 1
use-server R1 if { srv_is_up(R1) } { nbsrv(check_if_redis_is_master_1) ge 2 }
server R1 {{.ServiceName}}-announce-1:6379 verify required ca-file tls.crt check inter 3s fall 1 rise 1
server R1 {{.ServiceName}}-announce-1:6379 ssl verify required ca-file tls.crt check inter 3s fall 1 rise 1
use-server R2 if { srv_is_up(R2) } { nbsrv(check_if_redis_is_master_2) ge 2 }
server R2 {{.ServiceName}}-announce-2:6379 verify required ca-file tls.crt check inter 3s fall 1 rise 1
server R2 {{.ServiceName}}-announce-2:6379 ssl verify required ca-file tls.crt check inter 3s fall 1 rise 1
{{- end}}
Loading