Skip to content

Instantly share code, notes, and snippets.

@phuysmans
Created March 27, 2018 07:57
Show Gist options
  • Save phuysmans/3d2fea2e74351c4980243e6613557e28 to your computer and use it in GitHub Desktop.
Save phuysmans/3d2fea2e74351c4980243e6613557e28 to your computer and use it in GitHub Desktop.
haproxy mixed mode ssl termination passthrough
global
log 127.0.0.1 local0 debug
chroot /var/lib/haproxy
stats socket /var/lib/haproxy/admin.sock level admin
pidfile /var/lib/haproxy/pid
stats timeout 30s
daemon
tune.ssl.default-dh-param 2048
ssl-server-verify none
crt-base /etc/ssl/certs/
defaults
log global
option tcplog
option http-server-close
timeout connect 5000
timeout client 50000
timeout server 50000
frontend stats
bind *:9999
mode http
stats enable
stats refresh 30s
stats show-node
stats auth admin:admin
stats show-desc Super Awesome Stats Page! YAY!
stats uri /haproxy?stats
frontend http_front
bind *:80
default_backend http_back
mode http
# Placeholder with funny page. Do we need to redirect to pt 443?
frontend https_Main
bind *:443
mode tcp
mode tcp
tcp-request inspect-delay 5s
tcp-request content accept if { req_ssl_hello_type 1 }
use_backend %[req.ssl_sni,lower,map_dom(/etc/haproxy/sni2backend.map,nonSNIhttps_back)]
# Check the mapping for sni headers. If SNI info not fount, go to nonSNIhttps_back->nonSNIhttps_front
frontend nonSNIhttps_front
bind 127.0.0.1:9443 ssl crt test01.pem crt test02.pem
mode http
option forwardfor
use_backend %[req.hdr(host),lower,map_dom(/etc/haproxy/domain2backend.map,http_back)]
# This is the fallback to look for certs. If the domain is not found in the main FrontEnd, look here
backend nonSNIhttps_back
mode tcp
server nonSNIhttps_front 127.0.0.1:9443 check check-ssl
backend http_back
mode http
server localhost 127.0.0.1:9998 check
backend test01
mode http
server test01 172.20.0.141:80 check
backend test02
mode http
server test02 172.20.0.142:80 check
backend dev42
mode tcp
server dev42 172.20.0.42:443 check
@thenightfighter
Copy link

Could you please provid samples of /etc/haproxy/domain2backend.map and /etc/haproxy/sni2backend.map

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment