HAProxy split trustedProxy into secondary section
mini explanation on when to use trustedProxy instead of tlsOffload
thermionic committed
Aug 22, 2022 at 07:34 UTC
494c7da0a7347d2077967d9961f4f9f9e7b94aac
1 file changed
+10
-6
docs/Example configs/haproxy-with-sni-sample.cfg
+10
-6
@@ -1,12 +1,10 @@
1
# Uses proxy protocol in HAProxy in combination with SNI to preserve the original host address
2
# Update the config.json to work with HAProxy
3
+# Specify the IP addrehostname that the traffic will come from HAProxy (this might not be the address that is bound to the listener)
4
+# "tlsOffload": "10.1.1.10",
5
#
4
-# Specify the hostname and port that has the public certificate
5
-# "tlsOffload": "https://mc.publicdomain.com:443",
6
-#
7
-# Specify the IP address of the HAProxy instance (this might not be the address that is bound to the listener).
8
-# "TrustedProxy": "10.1.1.10",
9
-
6
+# Specify the HAPRoxy URL with the hostname to get the certificate
7
+# "certUrl": "https://mc.publicdomain.com:443/"
8
9
frontend sni-front
10
bind 10.1.1.10:443
@@ -38,3 +36,9 @@ backend mc-back-HTTPS
36
option http-server-close
37
server mc-01 10.1.1.30:443 check port 443 verify none
38
39
+# In the event that it is required to have TLS between HAProxy and Meshcentral,
40
+# Remove the tls_Offload line and replace with trustedProxy
41
+# Specify the IP addrehostname that the traffic will come from HAProxy (this might not be the address that is bound to the listener)
42
+# "trustedProxy": "10.1.1.10",
43
+# and change the last line of backend mc-back-HTTPS to use HTTPS by adding the ssl keyword
44
+# server mc-01 10.1.1.30:443 check ssl port 443 verify none