starred/rustyip
1
0
Fork 0
mirror of https://github.com/NetworkCats/rustyip.git synced 2026-11-14 00:15:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

perf: optimize HAProxy TLS config for Cloudflare origin connections

Browse Source
This commit is contained in:
NetworkCats
2026-03-02 23:19:06 +08:00
parent 7234dd4765
commit 31d86d8ab2
1 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
haproxy/haproxy.cfg
+5 -4
View File
@@ -1,10 +1,11 @@
global
log stderr local0 err
maxconn 4096
# Performance tuning
tune.ssl.default-dh-param 2048
# TLS configuration optimized for Cloudflare-to-origin connections
ssl-default-bind-curves X25519:prime256v1:secp384r1
ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11
ssl-default-bind-options prefer-client-ciphers ssl-min-ver TLSv1.2 no-tls-tickets
defaults
log global
@@ -18,7 +19,7 @@ defaults
timeout http-keep-alive 5s
frontend https_in
bind *:443 ssl crt /etc/haproxy/certs/origin.pem alpn h2,http/1.1
bind *:443 ssl crt /etc/haproxy/certs/origin.pem alpn h2,http/1.1 strict-sni
# Gzip compression
compression algo gzip