HAProxy Rocky Hostname-basiertes Routing auf zwei Backends

HAProxy: Hostname-basiertes Routing auf zwei Backends

Voraussetzungen

• HAProxy installiert
• Zertifikatsdatei: /etc/haproxy/certs/haproxy.pem
• Listener: 192.168.178.6
• Backend 1: 192.168.178.7 (für haproxy1.it213.int)
• Backend 2: 192.168.178.8 (für haproxy2.it213.int)

Firewall

• firewall-cmd --add-service=http --permanent
• firewall-cmd --add-service=https --permanent
• firewall-cmd --reload

HAProxy-Konfiguration

global
    log /dev/log local0
    log /dev/log local1 notice
    chroot /var/lib/haproxy
    stats timeout 30s
    user haproxy
    group haproxy
    daemon

defaults
    log     global
    mode    http
    option  httplog
    option  dontlognull
    timeout connect 5s
    timeout client  50s
    timeout server  50s

frontend fe_https
    bind 192.168.178.6:443 ssl crt /etc/haproxy/certs/haproxy.pem
    http-response set-header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

    acl host_haproxy1 hdr(host) -i haproxy1.it213.int
    acl host_haproxy2 hdr(host) -i haproxy2.it213.int

    use_backend be_srv1 if host_haproxy1
    use_backend be_srv2 if host_haproxy2

    default_backend be_srv1

frontend fe_http
    bind 192.168.178.6:80
    redirect scheme https code 301 if !{ ssl_fc }

backend be_srv1
    server srv1 192.168.178.7:443 ssl verify none

backend be_srv2
    server srv2 192.168.178.8:443 ssl verify none

Check Check

• haproxy -c -f /etc/haproxy/haproxy.cfg

Dienst neu starten

• systemctl restart haproxy
• systemctl status haproxy

Test

• curl -I http://haproxy1.it213.int/
• curl -I http://haproxy2.it213.int/
• curl -I https://haproxy1.it213.int/
• curl -I https://haproxy2.it213.int/