We have a lot of devices that cannot use SNI and we want to be able to proxy a lot of HTTP/HTTPS servers. I was thinking we could setup a HAProxy for each URL to connect to initially, and then load balance it off to a generic HAProxy server. Would this work? I mean, just use the front end servers to do the HTTP/HTTPS initial connection per URL and then pass the request off to a generic haproxy server?
Yes, although haproxy would almost be overkill for this. You could even bind an
stunnel with the appropriate certificate to each IP address and make those connect to your central HAproxy.
There's not even need to have more than one HAproxy.
listen ssl-domain1 bind public-ip-1:443 # <- ssl config here -> server haproxy localhost:6000 listen ssl-domain2 bind public-ip-2:443 # <- ssl config here -> server haproxy localhost:6000 ... # more ssl listeners frontend http-proxy bind localhost:6000 acl application1 hdr_beg(host) -i domain1 acl application1 hdr_beg(host) -i domain1.2 acl application2 hdr_beg(host) -i domain2 # ... use_backend application1 if application1 # ...
Not especially pretty, but would get the job done, I believe.