0

I have an haproxy setup, with a several of haproxy servers that route to a cluster of application servers. I'd like haproxy to do all the ssl termination.

Right now https requests are forwarded to application servers as https. So what I'd like is:

user <-https-> Haproxy <-http-> Application
user <-http->  Haproxy <-http-> Application

I've seen some configurations that are all about using haproxy to force user to upgrade scheme to https and then the whole system is over https. This is not what I'm looking for - I want to keep application servers in http at all times.

Rafael Baptista
  • 123
  • 1
  • 6

1 Answers1

1

I think I found the answer:

defaults
        option  forwardfor
        option  http-server-close


frontend www-http
        bind :80
        reqadd X-Forwarded-Proto:\ http
        default_backend my-backend

frontend www-https
        bind :443 ssl crt /etc/haproxy/ssl/oroboro.com.pem
        reqadd X-Forwarded-Proto:\ https
        default_backend my-backend

Add those two options in defaults. forwardfor adds the X-Forwarded-For headers.

Then create two frontends, one bound to http and another to https, that is what the bind lines do. On the https frontend we put the parameters for ssl decryption. After that haproxy will forward requests over http.

The X-Forwarded-Proto header is so your application server can know what protocol users are using in case you want to generate the page differently for non-https users ( e.g. not render certain content )

Rafael Baptista
  • 123
  • 1
  • 6
  • The most common use case for `X-Forwarded-Proto` is to redirect non https to https requests. I suppose that could be considered to fall under the category as "generate the page differently". – erik258 Jan 04 '17 at 01:03
  • 1
    @DanFarrell I disagree with that assessment. The purpose of `X-Forwarded-Proto` is to tell a downstream server that an upstream connection is using http or https -- for whatever reason. Doing redirects based on the presence of `http` is simply a common subset of that capability. – Michael - sqlbot Jan 04 '17 at 03:42