Ansible configuration policy for the private network/home lab of Dustin C. Hatch
http://dustin.hatch.name/
Dustin
e4ecd5d58a
For some time, I have been trying to design a new configuration for the reverse proxy on port 443 to correctly handle all the types of traffic on that port. In the original implementation, all traffic on port 443 was forwarded by the gateway to HAProxy. HAproxy then used TLS SNI to route connections to the correct backend server based the requested host name. This allowed both HTTPS and OpenVPN-over-TLS to use the same port, however it was not without issues. A layer 4 (TCP) proxy like this "hides" the real source address of clients connecting to the backend, which makes IP-based security (e.g. rate limiting, blacklists, etc.) impossible at the application level. In particular, Nextcloud, which implements rate limiting was constantly imposing login delays on all users, because legitimate traffic was indistinguishable from Internet background noise. To alleviate these issues, I needed to change the proxy to operate in layer 7 (HTTP) mode, so that headers like *X-Forwarded-For* and *X-Forwarded-Host* could be added. Unfortunately, this was not easy, because of the simultaneous requirement to forward OpenVPN traffic. HAProxy can only do SNI inspection in TCP mode. So, I began looking for an alternate way to proxy both HTTP and non-HTTP traffic on the same port. The HTTP protocol defines the `CONNECT` method, which is used by forward proxies to tunnel HTTPS over plain HTTP. OpenVPN clients support tunneling OpenVPN over HTTP using this method as well. HAProxy has limited support for the CONNECT method (i.e. it doesn't do DNS resolution, and I could find no way of restricting the destination) with the `http_proxy` option, so I looked for alternate proxy servers that had more complete support. Unsurprisingly, Apache HTTPD has the most complete implementation of the `CONNECT` method (Nginx doesn't support it at all). Using a name-based virtual host on port 443, Apache will accept requests for *vpn.pyrocufflink.net* (using TLS SNI) and allow the clients to use the `CONNECT` method to create a tunnel to the OpenVPN server. This requires OpenVPN clients to a) use *stunnel* to wrap plain HTTP proxy connections in TLS and b) configure OpenVPN to use the TLS-wrapped HTTP proxy. With Apache accepting all incoming connections, it was trivial to also configure it as a layer 7 forward proxy for Bitwarden, Gitea, Jenkins, and Nextcloud. Unfortunately, proxying for the other websites (darkchestofwonders.us, chmod777.sh, dustin.hatch.name) was not quite as straightforward. These websites would need to have an internal name that differed from their external name, and thus a certificate valid for that name. Rather than reconfigure all of these sites and set all of that up, I decided to just move the responsibility for handling direct connections from outside to the *web0* and eliminate the dedicated reverse proxy. This was not possible before, because Apache could not forward the OpenVPN traffic directly, but now with the forward proxy configuration, there is no reason to have a separate server for these connections. Overall, I am pleased with how this turned out. It makes the OpenVPN configuration simpler (*stunnel* no longer needs to run on the OpenVPN server itself, since Apache is handling TLS termination), eliminates a network hop for the websites, makes the reverse proxy configuration for the other web applications much easier to understand, and resolves the original issue of losing client connection information. |
||
|---|---|---|
| .certs@7685cddf52 | ||
| certs | ||
| ci | ||
| group_vars | ||
| host_vars | ||
| passwords/kojiweb_secret | ||
| roles | ||
| vault | ||
| .gitignore | ||
| .gitmodules | ||
| .vault-secret.sh | ||
| ansible.cfg | ||
| ansible.yml | ||
| aria2.yml | ||
| base.yml | ||
| bitwarden_rs.yml | ||
| burp-client.yml | ||
| burp-server.yml | ||
| certbot.yml | ||
| dch-gw.yml | ||
| dch-proxy.yml | ||
| dch-root-ca.crt | ||
| dch-vpn.yml | ||
| dhcpcd.yml | ||
| dhcpd.yml | ||
| docker.yml | ||
| domain-controller.yml | ||
| dyngroups.yml | ||
| fileserver.yml | ||
| firewalld.yml | ||
| gitea.yml | ||
| homeassistant.yml | ||
| hostname.yml | ||
| hosts | ||
| hosts.offline | ||
| jenkins-slave.yml | ||
| koji-builder.yml | ||
| koji-hub.yml | ||
| koji-web.yml | ||
| koji.yml | ||
| named-server.yml | ||
| net-ifaces.yml | ||
| network.yml | ||
| nextcloud.yml | ||
| ntp.yml | ||
| postgresql.yml | ||
| pyrocufflink.yml | ||
| radius.yml | ||
| radvd.yml | ||
| remount.yml | ||
| rngd.yml | ||
| samba-dc.yml | ||
| smtp-relay.yml | ||
| squid.yml | ||
| taiga.yml | ||
| vmhost.yml | ||
| websites.yml | ||
| wheelhost.yml | ||
| zabbix-agent.yml | ||
| zabbix-server.yml | ||
| zabbix.yml | ||