mirror of
https://github.com/ScuroNeko/mtg.git
synced 2026-08-31 09:04:02 +03:00
FILE / ScuroNeko/mtg
contrib/sni-router/mtg-config.toml
Исходный файл и его история в репозитории.
dolonet
170346bb74
Without this, mtg and Caddy see HAProxy's container IP for every connection, which breaks meaningful logging, abuse handling, and any IP-based blocklist logic. HAProxy sends a PROXY protocol v2 header on its TCP backends; mtg enables proxy-protocol-listener, and Caddy wraps :8443 with a proxy_protocol listener before tls. The :80 path (ACME HTTP-01 passthrough) is unchanged — client IP there is not useful and HAProxy's http mode already adds X-Forwarded-For if anyone wants it. Requested in https://github.com/9seconds/mtg/pull/462 review.
18 lines
511 B
TOML
18 lines
511 B
TOML
# Minimal mtg configuration for the SNI-router setup.
|
|
#
|
|
# 1. Generate a secret: mtg generate-secret --hex example.com
|
|
# 2. Paste it below.
|
|
# 3. Replace example.com with your actual domain everywhere.
|
|
|
|
secret = "PASTE_YOUR_SECRET_HERE"
|
|
bind-to = "0.0.0.0:3128"
|
|
|
|
# HAProxy in front sends PROXY protocol v2 headers so mtg can see the
|
|
# real client IP. Keep this in sync with haproxy.cfg (`send-proxy-v2`).
|
|
proxy-protocol-listener = true
|
|
|
|
[defense.anti-replay]
|
|
enabled = true
|
|
max-size = "1mib"
|
|
error-rate = 0.001
|