From d1fd1e37eb575a0df982d300f13657c7b7e47d8c Mon Sep 17 00:00:00 2001 From: Tamal Saha Date: Thu, 14 Sep 2023 12:20:49 -0700 Subject: [PATCH] Add option to customize ssl ciphers Signed-off-by: Tamal Saha --- templates/global.cfg | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/templates/global.cfg b/templates/global.cfg index b2e5260..a1cce77 100644 --- a/templates/global.cfg +++ b/templates/global.cfg @@ -8,7 +8,11 @@ global log stdout format raw daemon # send everything to stdout log stderr format raw daemon notice # send important events to stderr tune.ssl.default-dh-param 2048 + {{ with .SSLCiphers }} + ssl-default-bind-ciphers {{ . }} + {{ else }} ssl-default-bind-ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK + {{ end }} # https://github.com/haproxytech/haproxy-lua-http lua-prepend-path /usr/share/haproxy/?/http.lua lua-load /usr/share/haproxy/auth-request.lua # https://github.com/TimWolla/haproxy-auth-request