This configuration still provides HTTP access; to harden security and force HTTPS, change all of the bindAddress settings to 127.0.0.1.

","nestedContent":{"type":"doc","content":[{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"heading","attrs":{"level":3},"content":[{"text":"Forcing HTTPS","type":"text"}]},{"type":"paragraph","content":[{"text":"This configuration still provides HTTP access; to harden security and force HTTPS, change all of the ","type":"text"},{"text":"bindAddress","type":"text","marks":[{"type":"code"}]},{"text":" settings to 127.0.0.1.","type":"text"}]}]}],"version":1},"reason":"An info macro in a list item can't be created or edited in the new editor."}}}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Setup and install haproxy. This package is part of the EPEL repo.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Use the following haproxy configuration:","type":"text"}]},{"type":"paragraph","content":[{"text":"/etc/haproxy/haproxy.cfg","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"shell"},"content":[{"text":"global\n log 127.0.0.1 local2\n chroot /var/lib/haproxy\n stats socket /var/lib/haproxy/stats mode 660 level admin\n stats timeout 30s\n user haproxy\n group haproxy\n daemon\n \n ca-base /etc/pki/tls/certs\n crt-base /etc/pki/tls/private\n \n ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS\n ssl-default-bind-options no-sslv3\n maxconn 2048\n tune.ssl.default-dh-param 2048\n \ndefaults\n log global\n mode http\n option forwardfor\n option http-server-close\n option httplog\n option dontlognull\n timeout connect 5000\n timeout client 50000\n timeout server 50000\n \nfrontend www-http\n bind 0.0.0.0:80\n reqadd X-Forwarded-Proto:\\ http\n reqadd X-Forwarded-Port:\\ 80\n default_backend www-backend-scsp\n acl iss3 hdr_sub(Authorization) AWS\n acl iss3 url_reg [?&](AWSAccessKeyId|X-Amz-Credential)=\n use_backend www-backend-s3 if iss3\n \nfrontend www-https\n bind 0.0.0.0:443 ssl crt /etc/pki/tls/certs/selfsignedcert.pem\n reqadd X-Forwarded-Proto:\\ https\n reqadd X-Forwarded-Port:\\ 443\n default_backend www-backend-scsp\n acl iss3 hdr_sub(Authorization) AWS\n acl iss3 url_reg [?&](AWSAccessKeyId|X-Amz-Credential)=\n use_backend www-backend-s3 if iss3\n \nfrontend www-https-svc\n bind 0.0.0.0:91 ssl crt /etc/pki/tls/certs/selfsignedcert.pem\n reqadd X-Forwarded-Proto:\\ https\n reqadd X-Forwarded-Port:\\ 91\n default_backend www-backend-svc\n \nbackend www-backend-scsp\n #redirect scheme https if !{ ssl_fc } <--- Uncomment to force HTTPS\n server gw1 127.0.0.1:8080 check\n \nbackend www-backend-s3\n #redirect scheme https if !{ ssl_fc } <--- Uncomment to force HTTPS\n server gw1 127.0.0.1:8090 check\n \nbackend www-backend-svc\n # This rule rewrites CORS header to add the port number used on frontend\n http-request replace-value Access-Control-Allow-Origin (.*) \\1:91\n redirect scheme https if !{ ssl_fc }\n server gw1 127.0.0.1:8091 check","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Start haproxy.","type":"text"}]},{"type":"codeBlock","attrs":{"language":"shell"},"content":[{"text":"systemctl restart haproxy","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Edit the existing feed to enable SSL and point to the new endpoint (see next).","type":"text","marks":[{"type":"textColor","attrs":{"color":"#091e42"}}]}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Configuring the Feed","type":"text"}]},{"type":"paragraph","content":[{"text":"Configure the Swarm replication feed to use the SSL server once it is configured.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Swarm UI, navigate to ","type":"text"},{"text":"Cluster > Feeds","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Edit the affected replication feed.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Scroll to the ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]},{"text":"Target Remote Cluster","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}},{"type":"strong"}]},{"text":" settings.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Update the ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]},{"text":"Proxy or Host(s)","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}},{"type":"strong"}]},{"text":" and ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]},{"text":"Port","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}},{"type":"strong"}]},{"text":" to point to the offloader.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Select ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]},{"text":"Replicate via direct POST","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}},{"type":"strong"}]},{"text":" if the feed was configured to use the bidirectional GET mode.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enable ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]},{"text":"Require trusted SSL","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}},{"type":"strong"}]},{"text":" for ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]},{"text":"SSL Server","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}},{"type":"strong"}]},{"text":"; ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]},{"text":"Allow untrusted SSL ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}},{"type":"strong"}]},{"text":"is available but not intended for production systems. ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]},{"type":"hardBreak"},{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.migration","extensionKey":"inline-media-image","parameters":{"width":"800","id":"acabe6fc-c231-4eb4-b75a-3c71af8d47de","collection":"contentId-2443814996","height":""}}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Select ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]},{"text":"None","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}},{"type":"strong"}]},{"text":" for ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]},{"text":"Local Cluster Forward Proxy","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}},{"type":"strong"}]},{"text":", unless using one (See ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]},{"text":"Forward Proxy","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}},{"type":"em"}]},{"text":", below).","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]}]}]},{"type":"paragraph","content":[{"text":"See","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]},{"text":" ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}},{"type":"em"}]},{"type":"inlineCard","attrs":{"__confluenceMetadata":{"isRenamedTitle":true,"linkType":"page","contentTitle":"Managing Feeds","versionAtSave":"9"},"url":"https://perifery.atlassian.net/wiki/spaces/public/pages/2443814122"}},{"text":".","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}},{"type":"em"}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Forward Proxy","type":"text","marks":[{"type":"annotation","attrs":{"annotationType":"inlineComment","id":"10458a74-1820-4c26-a811-81dc018906c1"}},{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"drawio","parameters":{"macroParams":{"zoom":{"value":"1"},"simple":{"value":"0"},"inComment":{"value":"0"},"pageId":{"value":"461504537"},"custContentId":{"value":"1040908326"},"lbox":{"value":"1"},"diagramDisplayName":{"value":"Proxy-to-Proxy.drawio"},"contentVer":{"value":"1"},"revision":{"value":"1"},"baseUrl":{"value":"https://caringo.atlassian.net/wiki"},"diagramName":{"value":"Proxy-to-Proxy.drawio"},"pCenter":{"value":"0"},"_parentId":{"value":"2443814996"},"width":{"value":"465"},"links":{"value":""},"tbstyle":{"value":""},"height":{"value":"167"}},"macroMetadata":{"macroId":{"value":"1b071e6e-1c58-4100-a2d5-cf01459738b9"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"image","data":{"url":"https://ac.draw.io/connectImage?zoom=1&simple=0&inComment=0&pageId=461504537&custContentId=1040908326&lbox=1&diagramDisplayName=Proxy-to-Proxy.drawio&contentVer=1&revision=1&baseUrl=https%3A%2F%2Fcaringo.atlassian.net%2Fwiki&diagramName=Proxy-to-Proxy.drawio&pCenter=0&width=465&links=&tbstyle=&height=167&_parentId=2443814996"}}],"title":"draw.io Diagram"}},"localId":"8e3d603e-c9ee-4943-a949-8d11af564f11"}},{"type":"heading","attrs":{"level":1},"content":[{"text":"Selecting a Forward Proxy Server","type":"text"}]},{"type":"paragraph","content":[{"text":"HAProxy","type":"text","marks":[{"type":"link","attrs":{"href":"http://www.haproxy.org/"}}]},{"text":" works with a fixed back-end server list consisting of the distant Gateway front-end although it is not optimized to be a general purpose forward proxy.","type":"text"}]},{"type":"paragraph","content":[{"text":"Other alternatives:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"stunnel","type":"text","marks":[{"type":"link","attrs":{"href":"https://www.stunnel.org/"}}]},{"text":" - for fixed endpoints","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Squid","type":"text","marks":[{"type":"link","attrs":{"href":"http://www.squid-cache.org/"}}]},{"text":" - for a general purpose forward proxy","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"With this server configuration, the forward proxy receives an HTTP request from the Swarm node and then tunnels a Swarm HTTPS request over the Internet to the other cluster, hitting the SSL/TLS offloader in front of Gateway. The data is encrypted by Swarm, and passes blindly through the forward proxy.","type":"text"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Re-Configuring the Feed","type":"text"}]},{"type":"paragraph","content":[{"text":"Configure the Swarm replication feed to use the new outbound proxy once a forward proxy server is configured.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Swarm UI, navigate to ","type":"text"},{"text":"Cluster > Feeds","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Edit the replication feed already configured to use an SSL Server.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Select ","type":"text"},{"text":"Use proxy ","type":"text","marks":[{"type":"strong"}]},{"text":"for ","type":"text"},{"text":"Local Cluster Forward Proxy","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter the ","type":"text"},{"text":"Host","type":"text","marks":[{"type":"strong"}]},{"text":" (a fully qualified domain name or IP address) and the ","type":"text"},{"text":"Port","type":"text","marks":[{"type":"strong"}]},{"text":" for the proxy.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter the ","type":"text"},{"text":"Username","type":"text","marks":[{"type":"strong"}]},{"text":" and ","type":"text"},{"text":"Password","type":"text","marks":[{"type":"strong"}]},{"text":" for the forward proxy.","type":"text"}]}]}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":45.0},"content":[{"type":"media","attrs":{"__fileSize":40605,"__fileMimeType":"image/png","width":737,"id":"39752509-4c0f-4cde-bfac-632af001b576","collection":"contentId-2443814996","type":"file","__fileName":"image2018-12-12_19-27-6.png","height":525}}]},{"type":"paragraph","content":[{"text":"See","type":"text"},{"text":" ","type":"text","marks":[{"type":"em"}]},{"type":"inlineCard","attrs":{"__confluenceMetadata":{"isRenamedTitle":true,"linkType":"page","contentTitle":"Managing Feeds","versionAtSave":"9"},"url":"https://perifery.atlassian.net/wiki/spaces/public/pages/2443814122"}},{"text":".","type":"text","marks":[{"type":"em"}]}]}],"version":1}

Browser not supported