HAproxy

[TonyMerlin]

Just wondering, will this work with HAproxy?

[itoffshore]

no reason why not - I would configure HAProxy with TLS passthrough (& terminate TLS on NGINX)

HAProxy TLS passthrough allows encrypted traffic to pass through the proxy without decrypting it, meaning the SSL/TLS connection is maintained all the way to the backend server. This setup is useful for load balancing while keeping the traffic secure, but it limits the ability to inspect or modify the traffic.

lts-alpine will be a nice lightweight & stable HAproxy container image

[TonyMerlin]

Excellent, we're already running HAProxy in production with the method you've mentioned, so I went ahead yesterday and installed this on a clone of one of our servers, and upon testing it's working perfectly for blocking user agents. Just having an issue getting it to pass the correct IP address through... so I've added a local IP from another server to the IP blacklist, and I've tried all options in Nginx, i.e.,

set_real_ip_from 127.0.0.1; #and the IP of our proxy

real_ip_header X-Forwarded-For;

In Varnish I added

sub vcl_recv {
if (req.restarts > 0) { set req.hash_always_miss = true; }

if (req.http.X-Forwarded-For) {
            set req.http.X-Forwarded-For = req.http.X-Forwarded-For + ", " + client.ip;
        } else {
            set req.http.X-Forwarded-For = client.ip;
        }

Nothing I'm doing is allowing the correct IP to pass through as yet, but I'll stick with it and update you when I've got a resolution.

[itoffshore]

Have a look at podman quadlets - run containers as a systemd service with health checks. No container daemon to crash & can be turned into pods