HAProxy 终止时无法重定向到 HTTPS答案

【问题标题】：HAProxy unable to redirect to HTTPS when terminatingHAProxy 终止时无法重定向到 HTTPS
【发布时间】：2018-02-28 01:48:50
【问题描述】：

我想为两台服务器设置 HAProxy - 一台带有直通，另一台带有终止。在没有 HAProxy 经验的情况下，我能够做到这一点，但我无法为终止的 HTTPS 重定向 - 我得到 502。这是配置：

#Upgrades the passthrough and check for Let's Encrypt
frontend http_front
    bind :80
    option forwardfor
    acl host_s1 hdr(host) -i s1.example.com
    acl path_le path_beg -i /.well-known/acme-challenge/
    redirect scheme https code 301 if host_s1 !path_le
    use_backend acmetool if path_le
    default_backend http-back

#Handles the passthrough and loopsback to itself for other domains
frontend passthrough
    mode tcp
    bind :443
    tcp-request inspect-delay 5s
    tcp-request content accept if { req_ssl_hello_type 1 }
    use_backend service1 if { req_ssl_sni -i s1.example.com }
    default_backend https-back

#Loopback to handle the termination domains
frontend https-front
    bind 127.0.0.1:8443 ssl crt s2.example.com.pem
    option forwardfor
    reqdel X-Forwarded-Proto
    reqadd X-Forwarded-Proto:\ https if { ssl_fc }
    use_backend service2 if { req_ssl_sni -i s2.example.com }
    default_backend service2

#returns for second pass from HTTP
backend http-back
    server https-front 127.0.0.1:8443

#returns for second pass from HTTPS
backend https-back
    mode tcp
    server https-front 127.0.0.1:8443

backend service1
    mode tcp
    server service1 127.0.0.1:8888

backend service2
    #redirect scheme https code 301 if !{ ssl_fc }
    server server2 server2:80

backend acmetool
    server acmetool 127.0.0.1:81

不确定我是否需要https-front 中的那些reqdel/reqadd。或者，如果我必须在第二次通过 HTTPS 时再次执行 tcp-request。

取消注释后端的重定向也无济于事。

【问题讨论】：

标签： reverse-proxy haproxy

【解决方案1】：

我可以通过一些help from the HAProxy community 来解决这个问题。

以下是更新名称的最终设置，以更好地反映每个设置背后的逻辑：

#Upgrades to HTTPS unless it's Let's Encrypt
frontend http
    bind :80
    option forwardfor
    redirect scheme https code 301 if !{ path_beg -i /.well-known/acme-challenge/ }
    default_backend acmetool

#Handles the passthrough and loopsback for termination
frontend passthrough
    mode tcp
    bind :443
    tcp-request inspect-delay 5s
    tcp-request content accept if { req_ssl_hello_type 1 }
    use_backend service1 if { req_ssl_sni -i s1.example.com }
    default_backend loopback

#Handles the termination domains on second pass
frontend termination
    bind 127.0.0.1:8443 ssl crt s2.example.com.pem
    option forwardfor
    reqdel X-Forwarded-Proto
    reqadd X-Forwarded-Proto:\ https if { ssl_fc }
    use_backend service2 if { ssl_fc_sni -i s2.example.com }
    default_backend service2

#Loopback for second pass
backend loopback
    mode tcp
    server https-front 127.0.0.1:8443

backend service1
    mode tcp
    server service1 127.0.0.1:8888

backend service2
    server server2 server2:80

backend acmetool
    server acmetool 127.0.0.1:81

【讨论】：