diff --git a/docs/docs/guides/reverse_proxy.md b/docs/docs/guides/reverse_proxy.md index bf33bcc278..0e27f99214 100644 --- a/docs/docs/guides/reverse_proxy.md +++ b/docs/docs/guides/reverse_proxy.md @@ -45,6 +45,8 @@ There are many solutions available to implement reverse proxies and the communit - [Nginx](#nginx-reverse-proxy) - [Traefik](#traefik-reverse-proxy) - [Caddy](#caddy-reverse-proxy) +- [HAProxy](#haproxy) +- [OPNSense HAProxy Add-on](#opnsense-haproxy-add-on) ## Apache2 Reverse Proxy @@ -218,3 +220,68 @@ frigate.YOUR_DOMAIN.TLD { } ``` + +## HAProxy + +This example is for a pure haproxy installation on a dedicated host. It assumes you have already combined the certificate parts in de cert file. + +The frontend config: +```# Public Service: SSLSecured (Frigate) +frontend SSLSecured + bind XXX.XXX.XXX.XXX:443 ssl crt /etc/haproxy/certs/frigate.cert + mode http + option http-keep-alive + default_backend NVR + + # CONDITION: NVR + acl acl_frigate hdr(host) -i nvr.example.video + + # RULE: NVR + use_backend NVR if acl_frigate +``` + +The backend config: +```# Backend Pool: NVR (Frigate) +backend NVR + mode http + balance source + # stickiness + stick-table type ipv4 size 50k expire 30m + stick on src + http-reuse safe + server Frigate XXX.XXX.XXX.XXX:8971 +``` +The above config is created for a Layer 7 proxy (application layer, in this case http), if streaming the camera feeds are a little spotty or somewhat unstable, you can try to change the *mode* from http to tcp in both the frontend and backend config, which sets up a Layer 4 proxy (proxy by protocol). Make sure you change hdr(host) to req.ssl_sni in the frontend Condition to make the host based condition work on tcp traffic. + +## OPNSense HAProxy add-on + +This guide is for the OPNSense firewall add-on *os-haproxy* and is configured and tested on version 5.1 of the add-on on OPNSense 26.7. +The guide starts where you are already done setting up the system, *have a certificate added to the certificate store* and *installed the plugin/add-on*. + +Step by step plan: +1. Go to Services -> HAProxy, click on Settings; +2. Add a Real Server under *Real Servers*; +3. Fill in the fields *Name or Prefix* and *Description*; +4. set *Type* to **static**; +5. fill in the frigate IP in the *FQDN or IP* field; +6. under *Common Options* fill *Port* with the port number for your Frigate (e.g. 8971) and +7. Click **Save** to store this configuration. +8. Under *Virtual Services* open *Backend Pools*; +9. Add a *Backend Pool*; +10. Fill in the fields *Name or Prefix* and *Description* but use something else then what you used under *Real Servers* otherwise if and when rules and conditions are needed it gets really confusing really fast, the use of them is out of the scope of this guide for a basic functioning haproxy add-on; +11. set *Mode* to **HTTP (Layer 7)**; +12. set *Balancing Algorithm* to **Source-IP Hash**; +13. set *Servers* by choosing the *Real Servers* instance you added in step 2->6; +14. Click **Save** to store this configuration. +15. Under *Virtual Services* open *Public Services*; +16. Add a *Public Service*; +17. Fill in the fields *Name or Prefix* and *Description* but use something else then what you used under *Real Servers* otherwise if and when rules and conditions are needed it gets really confusing really fast, the use of them is out of the scope of this guide for a basic functioning haproxy add-on; +18. Fill in the external address the haproxy instance will be listening on in *Listen Addresses*; +19. set *Type* to **HTTP/HTTPS (SSL offloading)** +20. set *Default Backend Pool* to the option carrying *the name you used in step 9*; +21. check *Enable SSL Offloading*; +22. Under *SSL Offloading* you set *Default certificate* to the certificate you added before you started following this guide; +23. Click **Save** to store this configuration. +24. Click **Apply** to reload the haproxy config on the service running. + +**NOTE: This will forward _ALL_ requests on port 443 to your frigate instance.** If that is not what you want or have more then one website alive behind the haproxy you will need to create a *Condition* to trigger when the right URL is used and a *Rules* rule to use the right backend under *Rules & Checks* when the condition is met. This is a useful hint for those who need it, though it is out of the scope of this guide.