Skip to content

Proxy

Securely expose karo-stack services publicly

Experimental

See the karo-stack docs for details.

Ansible vault
# proxy

hazzuk_extra_proxy_server_enabled: true # proxyserver
hazzuk_extra_proxy_client_enabled: false # homeserver

hazzuk_extra_proxy_stack:
  haproxy:
    config_raw: |
      # haproxy config

See all defaults

HAProxy - High-performance TCP reverse proxy
HAProxy config example

Simple setup, traffic is routed to your server if the request's SNI hostname matches your domain name.

# haproxy config

  # wait for tls clienthello
  tcp-request inspect-delay 5s

  # accept clienthello
  tcp-request content accept if { req_ssl_hello_type 1 }

  # catch-all reject
  tcp-request content reject

  # sni routing
  use_backend homeserver if { req.ssl_sni -m end .{{ karo_compose_root_domain }} }

backend homeserver
  mode tcp
  server wg {{ hazzuk_extra_proxy_client_wireguard_ipv4 }}:443 send-proxy-v2 check

Links