Haproxy Https和Vhost

Question

我是Haproxy世界的新手，几个小时后，我已经成功地在https模式下使用证书。但现在我有了一个新问题，似乎是由于目标服务器上的Vhost造成的。

我读到你需要创建一个指向vhost的规则，当它通过域而不是加载web时，服务器的默认页面会出现，因为它加载的是IP而不是域。

你能给我举个例子吗？

    frontend www-https
    bind www.dominio.dev:443 ssl crt /etc/letsencrypt/live/sddd.net/1.pem
    mode http
    stats enable
    stats auth  cda:cda
    balance roundrobin

    option http-server-close
    option forwardfor
    http-request add-header X-Forwarded-Proto https
    http-request add-header X-Forwarded-Port 443
    http-response add-header Strict-Transport-Security max-age=15768000

    acl letsencrypt-acl path_beg /.well-known/acme-challenge/
  # use_backend letsencrypt-backend if letsencrypt-acl
    http-request redirect scheme https unless { ssl_fc }
    default_backend www-backend


backend www-backend
   redirect scheme https if !{ ssl_fc }
   #http-request redirect scheme https if http
   server www-1 www1.dominio.dev:443 ssl verify none
   server www-2 www2.dominio.dev:443 ssl verify none maxconn 5000
   server www-3 www3.dominio.dev:443 ssl verify none

Answer 1

首先，haproxy配置中的"bind“指令应该是您的haproxy服务器ip地址。

首先创建前端httpd、前端https和后端and。

如果在后台和www1.dominio.dev、www2.dominio.dev、www3.dominio.dev服务器上有从http到https的重定向，请禁用它，使其侦听端口80。Haproxy会将http重定向到https

下面是一个示例：

frontend http
    bind haproxy_ip_address:80
    http-request add-header X-Forwarded-Proto http
    use_backend www-backend if { hdr(host) -i dominio.dev }

frontend https
    bind haproxy_ip_address:443 ssl crt /etc/letsencrypt/live/sddd.net/1.pem
    http-request add-header X-Forwarded-Proto https
    http-response replace-header  ^Server.* Server Microsoft-IIS/7.5
    http-response replace-header ^Set-Cookie:\ (.*) Set-Cookie \1;\ Secure if secure
    http-request add-header Strict-Transport-Security max-age=31536000;\ includeSubDomains;\ preload
    option http-server-close
    option http-keep-alive

    use_backend www-backend if { hdr(host) -i dominio.dev }
    use_backend www-backend if { req_ssl_sni -i dominio.dev }

backend www-backend
    mode http
    balance roundrobin
    option accept-invalid-http-response
    retries 3
    redirect scheme https if !{ ssl_fc }
    option forwardfor
    server www-1 www1.dominio.dev:80 ssl verify none
    server www-2 www2.dominio.dev:80 ssl verify none maxconn 5000
    server www-3 www3.dominio.dev:80 ssl verify none

另外，请检查配置是否有效："haproxy -c -V -f /etc/haproxy/haproxy.cfg“