This haproxy config terminates ssl for 2 sites (foo and bar) and load balances both sites to their own backend cluster. It also redirects http requests to https.

That works fine. Only, if the backend is down, it gets into a redirect loop for both sites. Eg: https://foo.example.com -> https://foo.example.com.

If I remove the redirect. It serves the sites over http and https and when the backends are down, it serves the 503 page as I would expect.

I want to redirect http to https. So, why is there a redirect loop?

    log   local0 debug
    maxconn 1024
    chroot /var/haproxy
    uid 604
    gid 604
    pidfile /var/run/haproxy.pid

    log     global
    mode    http
    option  httplog
    option  dontlognull
    option  http-server-close
    option  redispatch
    retries 3
    maxconn 2000
    errorfile 503 /etc/haproxy/503.http

frontend http
    bind *:80
    redirect scheme https code 301 if !{ ssl_fc }

frontend https
    bind *:443 ssl crt /etc/ssl/example.com.pem

    option forwardfor
    reqadd X-Forwarded-Proto:\ https
    http-response set-header Strict-Transport-Security "max-age=31536000;"

    acl project_foo hdr(host) -i foo.example.com
    acl project_bar hdr(host) -i bar.example.com

    use_backend cluster_foo if project_foo
    use_backend cluster_bar if project_bar

backend cluster_foo
    server foo-1 foo-1.example.com:80 check

backend cluster_bar
    server bar-1 bar-1.example.com:80 check


  • I suspect you are editing your configuration for posting this question, without realizing that an edit you are making changes the behavior. The config you have shown would always return 503 on http (non-https) requests if you remove the redirect, and the test if !{ ssl_fc } serves no purpose on an http front-end. There's nothing visible here to explain a redirect of an https request under any condition, let alone a redirect loop. – Michael - sqlbot Feb 11 '18 at 19:27

We at MageHost.pro do it like this:

frontend fr_http_https
    bind      ##VHOSTIP##:80
    bind      ##VHOSTIP##:443  ssl  crt  /path/to/bundle.pem
    redirect  code 301  prefix https://%[hdr(host)]  if !{ ssl_fc }
    # rest of frontend stuff

This may solve your problem.


haproxy and nginx were on the same server while testing. foo-1.example.com listens on port 80 on a dedicated IP but haproxy listens on *:80

making haproxy listen on a dedicated IP fixed this. So, the config above is just fine. I took the time to re-test everything because I did stip down the config to have a reasonable reproducible setup

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.