tw199501/haproxy repository overview

nginx1.29.3-docker/
├── Dockerfile                     # Container build configuration
├── docker-compose.yml             # Runtime compose (elf-nginx + haproxy)
├── docker-compose.build.yml       # Build-time compose (build & test images)
├── build-nginx.sh                 # Nginx build script
├── 30-keepalived-install.sh       # Keepalived install script for bare metal / VMs
├── keepalived-install.sh          # Lightweight Keepalived install script
├── docker-entrypoint.sh           # Nginx container entrypoint
├── nginx/                         # Nginx config & data mount root
│   ├── etc/                       # Nginx configuration
│   ├── modules/                   # Dynamic modules
│   ├── logs/                      # Runtime logs
│   ├── cache/                     # Cache files
│   ├── geoip/                     # GeoIP databases
│   └── keepalived/                # Keepalived config (mount only)
├── haproxy/
│   └── haproxy.cfg                # HAProxy frontend config
├── README.md                      # Chinese documentation
├── README.en.md                   # English documentation (this file)
└── todos.md                       # Development task list

version: "3.9"

services:
  elf-nginx:
    container_name: elf-nginx
    build:
      context: .
      dockerfile: Dockerfile        # Build from the Dockerfile in this directory
    image: elf-nginx:latest
    restart: unless-stopped
    volumes:
      - ./nginx/etc:/etc/nginx                      # Persist configuration
      - ./nginx/modules:/usr/lib/nginx/modules      # Dynamic modules
      - ./nginx/logs:/var/log/nginx                 # Persist logs
      - ./nginx/cache:/var/cache/nginx              # Persist cache
      - ./nginx/geoip:/usr/share/GeoIP              # GeoIP databases
      - ./nginx/keepalived:/etc/keepalived          # Keepalived config (mount only)

  haproxy:
    container_name: haproxy
    image: haproxy:2.9
    restart: unless-stopped
    depends_on:
      - elf-nginx
    ports:
      - "80:80"    # HTTP traffic
      - "443:443"  # HTTPS traffic
    volumes:
      - ./haproxy/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro

/etc/nginx/
├── nginx.conf                    # Main configuration
├── modules.conf                  # Dynamic module loading
├── conf.d/                       # Generic config snippets
│   ├── ssl.conf                  # SSL/TLS config
│   ├── cloudflare.conf           # Cloudflare integration
│   └── waf.conf                  # WAF rules
├── sites-available/              # Available site configs
│   └── default.conf              # Default site
├── sites-enabled/                # Enabled site configs
│   └── default.conf -> ../sites-available/default.conf
├── geoip/                        # Geolocation/IP settings
│   ├── cloudflare_v4_realip.conf
│   ├── cloudflare_v6_realip.conf
│   ├── ip_whitelist.conf        # IP whitelist
│   └── ip_blacklist.conf        # IP blacklist
└── scripts/                      # Management scripts
    ├── update_geoip.sh          # GeoIP update script
    └── manage_ip.sh             # IP management tool

# SSL settings
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;

global_defs {
    enable_script_security
    script_user root
}

vrrp_script chk_nginx {
    script "/usr/local/sbin/check_nginx.sh"
    interval 2
    fall 3
    rise 2
}

vrrp_instance VI_51 {
    state MASTER                    # MASTER or BACKUP
    interface eth0                  # Network interface
    virtual_router_id 51            # VRRP group ID
    priority 200                    # Priority (MASTER: 200, BACKUP: 100)
    advert_int 1                    # Advertisement interval (seconds)

    # Unicast configuration
    unicast_src_ip 192.168.25.10    # Local IP
    unicast_peer {
        192.168.25.11               # Peer IP
    }

    authentication {
        auth_type PASS
        auth_pass 23887711          # VRRP authentication password
    }

    track_script {
        chk_nginx                   # Health check script
    }

    virtual_ipaddress {
        192.168.25.250/24 dev eth0  # Virtual IP
    }
}

# systemd timer example
[Timer]
OnCalendar=Wed,Sat 03:00
Persistent=true
RandomizedDelaySec=5min

# From the project root (the folder that contains nginx1.29.3-docker/)
 docker builder prune -f    # Optional: clean up build cache

 cd nginx1.29.3-docker
 docker compose -f docker-compose.build.yml build

# Start elf-nginx + haproxy using the build compose file
 docker compose -f docker-compose.build.yml up -d --build

 docker login
 docker push tw199501/nginx:1.29.3
 docker push tw199501/haproxy:trixie

 # Optionally, use the provided helper scripts:
 # Bash (Git Bash / WSL):
 #   bash nginx1.29.3-docker/push-images.sh
 # Windows PowerShell (from project root):
 #   .\nginx1.29.3-docker\push-images.ps1

sudo mkdir -p /opt/nginx-stack/nginx
sudo mkdir -p /opt/nginx-stack/nginx-ui

docker pull tw199501/nginx:1.29.3
docker pull tw199501/haproxy:trixie

docker compose -f docker-compose.yml up -d
docker compose -f nginx-ui-compose.yml up -d

Traffic path:  Client -> haproxy(80/443) -> elf-nginx:80
Config path:   /opt/nginx-stack/nginx      <-> elf-nginx:/etc/nginx
               /opt/nginx-stack/nginx      <-> nginx-ui:/etc/nginx
               /opt/nginx-stack/nginx-ui   <-> nginx-ui:/etc/nginx-ui

# Primary node (MASTER)
export ROLE=MASTER
export IFACE=eth0
export VRID=51
export VIP_CIDR=192.168.25.250/24
export PEER_IP=192.168.25.11
export PRIORITY=200

# Backup node (BACKUP)
export ROLE=BACKUP
export IFACE=eth0
export VRID=51
export VIP_CIDR=192.168.25.250/24
export PEER_IP=192.168.25.10
export PRIORITY=100

# Run on both nodes
bash 30-keepalived-install.sh

# Check virtual IP binding
ip -4 addr show dev eth0 | grep 192.168.25.250

# Inspect VRRP status
journalctl -u keepalived -e -n 50

# Add IP to whitelist
bash /etc/nginx/scripts/manage_ip.sh allow 192.168.1.100 /etc/nginx/geoip/ip_whitelist.conf

# Remove IP from whitelist
bash /etc/nginx/scripts/manage_ip.sh deny 192.168.1.100 /etc/nginx/geoip/ip_whitelist.conf

# Reload Nginx configuration
nginx -s reload

# Test Nginx configuration
nginx -t

# Restart Nginx service
systemctl restart nginx

# Check Nginx status
systemctl status nginx

# List Nginx processes
ps aux | grep nginx

# Check port usage
netstat -tlnp | grep :80
netstat -tlnp | grep :443

# Tail logs

tail -f /var/log/nginx/access.log
tail -f /var/log/nginx/error.log

# Check container logs
docker-compose logs elf-nginx

# Check port conflicts
netstat -tlnp | grep :80
netstat -tlnp | grep :443

# Test configuration syntax
docker exec elf-nginx nginx -t

# Inspect config file
docker exec elf-nginx cat /etc/nginx/nginx.conf

# Check VRRP status
journalctl -u keepalived --no-pager

# Validate health check script
bash /usr/local/sbin/check_nginx.sh

# File descriptor limits
echo "nginx soft nofile 65535" >> /etc/security/limits.conf
echo "nginx hard nofile 65535" >> /etc/security/limits.conf

# Network tuning
echo "net.core.somaxconn = 65535" >> /etc/sysctl.conf
sysctl -p

worker_processes auto;
worker_connections 4096;
worker_rlimit_nofile 65535;

# Build images using the build compose file (build only)
docker compose -f docker-compose.build.yml build

# Build and start containers (dev use)
docker compose -f docker-compose.build.yml up -d --build

# Start services using the release docker-compose.yml (for consumers of the images)
docker compose up -d

# Stop and remove containers (keep images)
docker compose down

# Show current container status
docker compose ps

# Tail logs for nginx / haproxy
docker compose logs -f elf-nginx
docker compose logs -f haproxy

# Enter nginx container (debugging)
docker exec -it elf-nginx /bin/bash

# Manually trigger GeoIP update script
docker exec elf-nginx /etc/nginx/scripts/update_geoip.sh