Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HAProxy 1.8.0

mail-archive.com

Post reply on HN
Print view View original

21–24 of 24 posts

Re: HAProxy 1.8.0

#21

Post by ajcornett »

zaarn wrote: post #16

I do hope that HAProxy might support ACME at some point, I'm currently stuck on Traefik which has been breaking some traffic but I rely heavily on dynamically issued LE certs. Otherwise, outside of SSL, HAProxy has been very pleasant in my experience.

We are using https://github.com/janeczku/haproxy-acme-validation-plugin to provide ACME support directly in HAProxy without an extra backend. Example:

    frontend example.com
        bind 192.168.1.100:80
    
        # Redirect ACME domain validations
        acl url_acme_http01 path_beg /.well-known/acme-challenge/
        http-request use-service lua.acme-http01 if METH_GET url_acme_http01
    
        # Redirect all plain HTTP traffic to HTTPS
        redirect scheme https code 301 if !{ ssl_fc }

Re: HAProxy 1.8.0

#22

Post by mschuster91 »

zaarn wrote: post #18
mschuster91 wrote: post #17

Earlier quoted context omitted.

Where's your problem? Spin up a certbot docker container and use this here in haproxy: frontend http_in bind *:80 bind *:443 ssl crt /path/to/letsencrypt/data/mydomain.pem acl path_letsencrypt path_beg /.well-known/acme-challenge use_backend letsencrypt if path_letsencrypt backend letsencrypt mode http server server-letsencrypt MYLOCALIP:8080 For the letsencrypt docker image, I use mesosphere/letsencrypt-dcos with a…

My problem is usually that I rely heavily on traefik being able to very easily issue certificates simply by having a backend with a hostname present. If I, for example, configure my PHP VM to be reachable over "test.example.org" in Traefik, then Traefik will automatically try to issue a certificate for this domain once it detects the config change. On HAProxy this is not as easy as I need to tell both LE and HAP abou…

> On HAProxy this is not as easy as I need to tell both LE and HAP about the new backend.

You only need to tell the certbot container the new domain. The frontend config I gave you actually hits before any host-ACLs which means it will pass all acme-challenge requests on all domains to the certbot container, and certbot will reload haproxy when it's done.

Re: HAProxy 1.8.0

#24

Post by zaarn »

mschuster91 wrote: post #22
zaarn wrote: post #18

Earlier quoted context omitted.

My problem is usually that I rely heavily on traefik being able to very easily issue certificates simply by having a backend with a hostname present. If I, for example, configure my PHP VM to be reachable over "test.example.org" in Traefik, then Traefik will automatically try to issue a certificate for this domain once it detects the config change. On HAProxy this is not as easy as I need to tell both LE and HAP abou…

> On HAProxy this is not as easy as I need to tell both LE and HAP about the new backend. You only need to tell the certbot container the new domain. The frontend config I gave you actually hits before any host-ACLs which means it will pass all acme-challenge requests on all domains to the certbot container, and certbot will reload haproxy when it's done.

No I need to tell both.

HAP still needs to know where to route the traffic to and LE needs to know which domains are available.

Post reply on HN