7

I am attempting to setup a testing haproxy server that will cover 2 basic areas. Auto redirect to https if the user is using http but only if a specific uri part is not present.

For example, if a user goes to http://www.test.com they would be redirected to https://www.test.com. But if the user goes to https://www.test.com/blog or http://www.test.com/blog they would be redirected to http://www.test.com/blog.

This is my current testing haproxy.cfg. I am running haproxy 1.5-dev17

Any help with this is greatly appreciated.

global
  log 127.0.0.1   local0
  log 127.0.0.1   local1 notice
  maxconn 15000
  user haproxy
  group haproxy

defaults
  log     global
  mode    http
  option  httplog
  option  dontlognull
  option abortonclose
  option  http-server-close
  option redispatch
  retries 3  
  timeout queue 600s
  timeout connect 9s
  timeout client 60s
  timeout server 60s
  balance  roundrobin

# Set up application listeners here.

frontend incoming
  bind *:80 name http

  acl has_blog_uri path /blog /blog/

  redirect scheme https if !has_blog_uri !{ ssl_fc }

  bind *:443 ssl crt /etc/haproxy/test.pem


  use_backend blog_app if has_blog_uri

  default_backend rails_app

backend rails_app
  option httpchk GET /app_health
 # server app1 10.1.1.1:8080 weight 1 check
  server app2 10.1.1.2:8080 weight 1 check

backend blog_app

  option httpchk GET /blog/check.txt
  server blog 10.1.1.3:8080 check
3
  • Your question is missing what exactly is not working. What happens with the configuration you posted, and what doesn't happen?
    – daff
    Feb 23, 2013 at 12:43
  • The issue I am having is, that if I try to force the redirect from https to http when a user is on test.com/blog it leaves me in a redirect loop.
    – rottmanj
    Feb 23, 2013 at 18:04
  • I reworked some of your config in an answer (below), let me know if it works for you. Feb 23, 2013 at 19:36

1 Answer 1

7

Let me suggest a few things:

  • You should separate your insecure and secure config into two separate blocks, this way you can more easily control the ACL and redirect cases.
  • For the redirect try using the format redirect location <absolute_url> if <conditions>
  • For detecting URI paths, try using path_beg -i /blog
  • Finally you're not going to be able to actually redirect people away from an HTTPS connection, this is considered insecure and is not supported.

Here are my suggested modifications to the incoming portion of your config, based on these comments. This should redirect http://www.test.com to https://www.test.com AND will fail when an attempt is made to https://www.test.com/blog (you could put a page there with a link suggestion for the user).

    frontend public
      bind *:80
      acl has_blog_uri path_beg -i /blog
      redirect location https://www.test.com if !has_blog_uri
      use_backend blog_app if has_blog_uri    

    frontend public-ssl
      bind *:443 ssl crt /etc/haproxy/test.pem
      acl has_blog_uri path_beg -i /blog
      use_backend rails_app if !has_blog_uri

Hope this helps.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .