2

I'm not sure if I understand how to haproxy works exactly. I have system which is composed of few servers with communication based on http. I want to use haproxy as load balancer and something like https server at the same time. It should work following: user write address and haproxy decide - if it is http then it redirect it to https, if it https it connect with the system via http. I mean that only client with haproxy should have https connection, but haproxy with system should have http. Here's the image with described architecture:

enter image description here

I wrote haproxy configuration file and only what I get is redirecting from http to https and show first site - rest is dead, because all communications look like:

client --(https)--> haproxy --(https)-->system

instead of

client --(https)--> haproxy --(http)-->system

Is it possible to create it with haproxy?

Below is my haproxy configuration file:

global
    pidfile /var/run/haproxy.pid
    log 127.0.0.1 local2 debug
    maxconn 2048
    tune.ssl.default-dh-param 2048
    ca-base /etc/ssl/certs
    crt-base /etc/ssl/private

defaults
    mode        http
    option forwardfor
    option http-server-close
    log global
    option      httplog
    option dontlognull
    option forwardfor
    option http-server-close
    option redispatch
    option tcp-smart-accept 
    option tcp-smart-connect
    timeout http-request 10s
    timeout queue 1m
    timeout connect 5s
    timeout client 2m
    timeout server 2m
    timeout http-keep-alive 10s
    timeout check 5s
    retries 3
    compression algo gzip
    compression type text/html text/html;charset=utf-8 text/plain text/css text/javascript application/x-javascript application/javascript application/ecmascript application/rss+xml application/atomsvc+xml application/atom+xml application/atom+xml;type=entry application/atom+xml;type=feed application/cmisquery+xml application/cmisallowableactions+xml application/cmisatom+xml application/cmistree+xml application/cmisacl+xml application/msword application/vnd.ms-excel application/vnd.ms-powerpoint

frontend https-in
    bind *:80
    redirect scheme https if !{ ssl_fc }
    bind *:443 ssl crt /etc/ssl/private/cert.pem
    capture request header X-Forwarded-For len 64
    capture request header User-agent len 256
    capture request header Cookie len 64
    capture request header Accept-Language len 64
    rspadd Strict-Transport-Security:\ max-age=15768000
    option contstats
    default_backend share-https

backend share-https
    option httpchk GET /share
    balance roundrobin
    cookie JSESSIONID prefix
    server main srv1:9080 cookie main check inter 5000 weight 4
    server secondary srv2:9080 cookie secondary check inter 5000 weight 1
6
  • Your config looks right to me. What do you mean by ...and show first site...? Have you confirmed that the servers in share-https are up?
    – GregL
    Oct 6, 2015 at 16:15
  • Yes, servers are up. I mean that I can see only first page (login) which does not use redirecting in system (between differents servers), but when I try log in (what need redirection between services on servers) it fails. I checked it without https in haproxy and it works so I conclude that there is a problem.
    – Eleid
    Oct 6, 2015 at 16:36
  • Can you post a curl trace of a login attempt?
    – GregL
    Oct 6, 2015 at 17:19
  • This is full curl trace. As you can see it is https request. I would like to connect with haproxy via https, but haproxy should connect with service via http.
    – Eleid
    Oct 7, 2015 at 6:33
  • Ok, I found the problem. It wasn't haproxy.cfg, but CSRFPolicy on the server side. Working solution is here
    – Eleid
    Oct 7, 2015 at 8:11

1 Answer 1

0

The problem was because the System I described was Alfresco - app called "share" has CSRFPolicy which blocked https. According to this solution:

  1. Copy the "CSRFPolicy" default config from:

TOMCAT_HOME/webapps/share/WEB-INF/classes/alfresco/share-security-config.xml

to:

TOMCAT_HOME/shared/classes/alfresco/web-extension/share-config-custom.xml

  1. Add the attribute replace="true":

<config evaluator="string-compare" condition="CSRFPolicy" replace="true">

  1. Update the properties referer and origin with FQDN (https) of the Apache VirtualHost

<referer>https://HAProxyAddress/.*</referer> <origin>https://HAProxyAddress</origin>

And that's all. It works for me.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .