http://cbonte.github.io/haproxy-dconv/

Konfiguration verifizieren

/usr/sbin/haproxy -c -V -f /etc/haproxy/haproxy.cfg

https://haproxy.debian.net/

(Standard Focal hat nur V. 2.0)

Vorteil: keine separaten IP Adressen nötig! Konzept: HAPROXY horcht auf 80 und 443, der Webserver horcht nur auf localhost, z.B: 127.0.0.1:82, 83, 84… HAPROXY erkennt Requests über den Host Header und leitet auf den entsprechenden Port auf localhost um. Zertifikate werden durch haproxy bereitgestellt

frontend default
 bind *:80
 # Add multiple certificates, one for each domain.tld
 bind *:443 ssl crt /etc/ssl/haproxy/devel.netzwissen.de.pem crt /etc/ssl/haproxy/passbolt.netzwissen.de.pem crt /etc/ssl/haproxy/amrae.d$
 mode http
 # global redirect to https
 redirect scheme https code 301 if !{ ssl_fc }

## ACL for each Subdomain to terminate
 acl devel-acl hdr(host) -i devel.netzwissen.de
 acl le-acl path_beg /.well-known/acme-challenge/
 acl passbolt-acl hdr(host) -i passbolt.netzwissen.de
 acl amrae-acl hdr(host) -i amrae.de
 acl gruenerheiner-acl hdr(host) -i gruenerheiner.netzwissen.de
 acl freifunk-esslingen-acl hdr(host) -i freifunk-esslingen.de

## BACKEND: Use Backend Section
 use_backend devel if devel-acl
 use_backend le-backend if le-acl
 use_backend passbolt if passbolt-acl
 use_backend amrae if amrae-acl
 use_backend gruenerheiner if gruenerheiner-acl
 use_backend freifunk-esslingen if freifunk-esslingen-acl

backend passbolt
   mode http
   server passbolt.netzwissen.de 127.0.0.1:83 check
   http-request set-header X-Forwarded-Port %[dst_port]
   http-request add-header X-Forwarded-Proto https if { ssl_fc }

https://serversforhackers.com/c/letsencrypt-with-haproxy

frontend

frontend le-frontend
   bind *:80
   # Test URI to see if its a letsencrypt request
   acl letsencrypt-acl path_beg /.well-known/acme-challenge/
   use_backend le-backend if letsencrypt-acl
   default_backend devel

backend

backend le-backend
    mode http
    server letsencrypt 138.201.52.38:8888

certbot certonly --standalone -d zammad.netzwissen.de --non-interactive --agree-tos --email admin@netzwissen.de --http-01-port=8888

• -standalone - Create a stand-alone web server to listen for the cert authorization HTTP request
• -d [domain] - The domain we're creating a cert for. You can use multiple -d flags for multiple domains for a single certificate. The domain(s) must route to the server we're creating a cert for (DNS must be setup for the domain).
• –non-interactive –agree-tos –email admin@example.com - Make this non-interactive by saying as much, agreeing to the TOS, and informing LetsEncrypt of the email to use to send "YOUR CERT IS EXPIRING" notifications.
• –http-01-port=8888 - The Magic™. This tells the stand-alone server to listen on port 8888. Note that LetsEncrypt will still send the authorization HTTP request over port 80 and haproxy with redirrect requests over port 8888. The flag is http-01 because it expects an HTTP request, NOT an HTTPS request.

cert und key müssen in einer Datei vorliegen:

''cat /etc/letsencrypt/live/demo.scalinglaravel.com/fullchain.pem \
    /etc/letsencrypt/live/demo.scalinglaravel.com/privkey.pem \
    | sudo tee /etc/ssl/demo.scalinglaravel.com/demo.scalinglaravel.com.pem''

Zertifikate werden über –force-renewal einmal pro Monat per cron über ein Shellscrip aktualisiert und neu zusammengebunden

#!/usr/bin/env bash

# Renew the certificate
certbot renew --force-renewal --tls-sni-01-port=8888

# Concatenate new cert files, with less output (avoiding the use tee and its output to stdout)
bash -c "cat /etc/letsencrypt/live/forum.netzwissen.de/fullchain.pem /etc/letsencrypt/live/forum.netzwissen.de/privkey.pem> /etc/ssl/haproxy/forum.netzwissen.de.pem"
bash -c "cat /etc/letsencrypt/live/zammad.netzwissen.de/fullchain.pem /etc/letsencrypt/live/zammad.netzwissen.de/privkey.pem> /etc/ssl/haproxy/zammad.netzwissen.de.pem"

# Reload  HAProxy
service haproxy reload

acl demoredirect hdr_dom(host) -i demofolder.com
acl demoredirect hdr_dom(host) -i www.demofolder.com
http-request redirect location https://briansnelson.com/demofolder/ code 301 if demoredirect