Skip to content

Commit f803aa6

Browse files
e-n-0e-n-0
committed
Add haproxy configuration example
1 parent 83c0f77 commit f803aa6

File tree

6 files changed

+148
-0
lines changed

6 files changed

+148
-0
lines changed

‎contrib/haproxy/stream-processing-offload/cmd/spoa/haproxyconf/CHANGELOG.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# CHANGELOG
2+
3+
## 1.0.0
4+
5+
### Added
6+
7+
- Initial release

‎contrib/haproxy/stream-processing-offload/cmd/spoa/haproxyconf/backend.cfg‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# ========== Datadog App & API Protection Configuration ==========
2+
# This is the backend that will be used to send the request to the SPOA Agent.
3+
# Please edit the values below to match your configuration.
4+
backend spoa-backend
5+
mode spop
6+
timeout connect 5s
7+
timeout server 3m
8+
option spop-check
9+
balance roundrobin
10+
server spoa1 127.0.0.1:3000 check
11+
# ================================================================

‎contrib/haproxy/stream-processing-offload/cmd/spoa/haproxyconf/datadog_aap_blocking_response.lua‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
core.register_action("send_blocking_response", { "http-req" }, function(txn)
2+
print("send_blocking_response")
3+
4+
local body = txn:get_var("txn.dd.body")
5+
local status_code = txn:get_var("txn.dd.status_code")
6+
local headers = txn:get_var("txn.dd.headers")
7+
8+
local reply = txn:reply()
9+
reply:set_status(status_code)
10+
11+
local LINE_ITER = "[^\r\n]+"
12+
local LINE_KV_STRICT = "^([%w%-]+): (%S.+)$"
13+
for line in headers:gmatch(LINE_ITER) do
14+
local k, v = line:match(LINE_KV_STRICT)
15+
if k then
16+
reply:add_header(k, v)
17+
end
18+
end
19+
20+
reply:set_body(body)
21+
txn:done(reply)
22+
end)

‎contrib/haproxy/stream-processing-offload/cmd/spoa/haproxyconf/frontend-config.cfg‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
frontend main
2+
# bind *:80
3+
4+
# ========== Datadog App & API Protection Configuration ==========
5+
# DO NOT EDIT
6+
# This configuration should be placed at the most top of the file
7+
# to ensure it is executed first.
8+
9+
filter spoe engine datadog-aap-engine config str("$DD_SPOA_SPOA_CONF_FILE")
10+
11+
# Process the Request Headers
12+
http-request set-var(txn.timeout) str("$DD_SPOA_TIMEOUT")
13+
http-request send-spoe-group datadog-aap-engine dd-aap-http-request-headers-msg
14+
http-request set-var(sess.span_id) var(txn.dd.span_id)
15+
http-request set-var(sess.send_request_body) var(txn.dd.request_body)
16+
http-request lua.send_blocking_response if { var(txn.dd.blocked) -m bool }
17+
18+
# Process the Request Body (when needed)
19+
http-request wait-for-body time 1s if { var(sess.send_request_body) -m bool }
20+
http-request send-spoe-group datadog-aap-engine dd-aap-http-request-body-msg if { var(sess.send_request_body) -m bool }
21+
http-request lua.send_blocking_response if { var(sess.send_request_body) -m bool } { var(txn.dd.blocked) -m bool }
22+
23+
# Process the Response Headers
24+
http-response send-spoe-group datadog-aap-engine dd-aap-http-response-headers-msg
25+
http-response set-var(sess.send_response_body) var(txn.dd.request_body)
26+
http-request lua.send_blocking_response if { var(txn.dd.blocked) -m bool }
27+
28+
# Process the Response Body (when needed)
29+
http-response wait-for-body time 1s if { var(sess.send_response_body) -m bool }
30+
http-response send-spoe-group datadog-aap-engine dd-aap-http-response-body-msg if { var(sess.send_response_body) -m bool }
31+
http-request lua.send_blocking_response if { var(sess.send_response_body) -m bool } { var(txn.dd.blocked) -m bool }
32+
# ================= END OF DATADOG CONFIGURATION =================
33+
34+
# ...
35+
# default_backend webserver

‎contrib/haproxy/stream-processing-offload/cmd/spoa/haproxyconf/global-config.cfg‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
global
2+
# ========== Datadog App & API Protection Configuration ==========
3+
# Please edit the values below to match your configuration.
4+
5+
# This lua file needs to be loaded to allow HAProxy to send custom response in case
6+
# of a triggered blocking event. Adapt the path to the file to match your installation.
7+
lua-load /etc/haproxy/lua/datadog_aap_blocking_response.lua
8+
9+
# This is the path to the SPOE configuration file. Please edit the path to match your installation.
10+
setenv DD_SPOA_SPOA_CONF_FILE /usr/local/etc/haproxy/spoe.cfg
11+
12+
# The timeout value should be equal to the bigger backend server timeout where the SPOA Agent is running on.
13+
# Default value is 1 minute.
14+
# Example: If the biggest backend server timeout is 1 minute, set the timeout to 1m.
15+
setenv DD_SPOA_TIMEOUT 1m
16+
17+
# The processing timeout value is used to set the timeout for the SPOA Agent to process the request.
18+
# Please increase this value if you are sending large request or response bodies. Default value is 200ms.
19+
setenv DD_SPOA_PROCESSING_TIMEOUT 200ms
20+
# ================================================================

‎contrib/haproxy/stream-processing-offload/cmd/spoa/haproxyconf/spoe.cfg‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
[datadog-aap-engine]
2+
3+
spoe-agent datadog-aap-agent
4+
option set-on-error spoe_error
5+
option var-prefix dd
6+
7+
timeout hello 100ms
8+
timeout idle "$DD_SPOA_TIMEOUT"
9+
timeout processing "$DD_SPOA_PROCESSING_TIMEOUT"
10+
11+
use-backend spoa-backend
12+
log global
13+
14+
groups dd-aap-http-request-headers-msg
15+
groups dd-aap-http-request-body-msg
16+
groups dd-aap-http-response-headers-msg
17+
groups dd-aap-http-response-body-msg
18+
19+
# Groups defining messages
20+
spoe-group dd-aap-http-request-headers-msg
21+
messages http-request-headers-msg
22+
23+
spoe-group dd-aap-http-request-body-msg
24+
messages http-request-body-msg
25+
26+
spoe-group dd-aap-http-response-headers-msg
27+
messages http-response-headers-msg
28+
29+
spoe-group dd-aap-http-response-body-msg
30+
messages http-response-body-msg
31+
32+
# Messages
33+
spoe-message http-request-headers-msg
34+
args ip=src
35+
args ip_port=src_port
36+
args method=method
37+
args path=pathq
38+
args headers=req.hdrs_bin
39+
args https=ssl_fc
40+
args timeout=var(txn.timeout)
41+
42+
spoe-message http-request-body-msg
43+
args body=req.body
44+
args span_id=var(sess.span_id)
45+
46+
spoe-message http-response-headers-msg
47+
args headers=res.hdrs_bin
48+
args status=status
49+
args span_id=var(sess.span_id)
50+
51+
spoe-message http-response-body-msg
52+
args body=res.body
53+
args span_id=var(sess.span_id)

0 commit comments

Comments
 (0)