HAProxy configuration snippet on using SNI
SNI enables multiple HTTPS sites
thermionic committed
Aug 16, 2022 at 21:58 UTC
7295747e8ae3929f0216be90a22453c75da5ecd6
1 file changed
+40
docs/Example configs/haproxy-with-sni-sample.cfg
new
+40
@@ -0,0 +1,40 @@
1
+# Uses proxy protocol in HAProxy in combination with SNI to preserve the original host address
2
+# Update the config.json to work with HAProxy
3
+#
4
+# Specify the hostname and port that has the public certificate
5
+# "tlsOffload": "https://mc.publicdomain.com:443",
6
+#
7
+# Specify the IP address of the HAProxy instance (this might not be the address that is bound to the listener).
8
+# "TrustedProxy": "10.1.1.10",
9
+
10
+
11
+frontend sni-front
12
+ bind 10.1.1.10:443
13
+ mode tcp
14
+ tcp-request inspect-delay 5s
15
+ tcp-request content accept if { req_ssl_hello_type 1 }
16
+ default_backend sni-back
17
+
18
+backend sni-back
19
+ mode tcp
20
+ acl gitlab-sni req_ssl_sni -i gitlab.publicdomain.com
21
+ acl mc-sni req_ssl_sni -i mc.publicdomain.com
22
+ use-server gitlabSNI if gitlab-sni
23
+ use-server mc-SNI if mc-sni
24
+ server mc-SNI 10.1.1.10:1443 send-proxy-v2-ssl-cn
25
+
26
+frontend mc-front-HTTPS
27
+ mode http
28
+ option forwardfor
29
+ bind 10.1.1.10:1443 ssl crt /etc/haproxy/vm.publicdomain.net.pem accept-proxy
30
+ http-request set-header X-Forwarded-Proto https
31
+ option tcpka
32
+ default_backend mc-back-HTTP
33
+
34
+backend mc-back-HTTPS
35
+ mode http
36
+ option forwardfor
37
+ http-request add-header X-Forwarded-Host %[req.hdr(Host)]
38
+ option http-server-close
39
+ server mc-01 10.1.1.30:443 check port 443 verify none
40
+