Differences

This shows you the differences between two versions of the page.

--- решение_haproxy [2024/01/02 14:19]
val
+++ решение_haproxy [2025/01/14 14:50] (current)
val
@@ Line 3: / Line 3: @@
   * [[https://www.leaderssl.ru/articles/354-vypolnyaem-ssl-terminatsiyu-s-pomoschyu-haproxy-dlya-ubuntu-14-04|Выполняем SSL-терминацию с помощью HAProxy для Ubuntu 14.04]]
   * [[https://www.haproxy.com/documentation/haproxy-configuration-tutorials/http-rewrites/|HAProxy config tutorials HTTP rewrites]]
+  * [[https://serverfault.com/questions/560978/configure-multiple-ssl-certificates-in-haproxy|Configure multiple SSL certificates in Haproxy]]
+  * [[https://youtu.be/oIczkkD-hOU|Видео урок: Доступ к приложениям в Bare-Metal Kubernetes]]
 <code>
@@ Line 8: / Line 10: @@
 gate# cat wild.crt wild.key > /etc/ssl/private/wild.crtkey
+gate# ###cat gowebd.crt gowebd.key > /etc/ssl/private/gowebd.crtkey
+gate# ###cat keycloak.crt keycloak.key > /etc/ssl/private/keycloak.crtkey
 gate# cat /etc/haproxy/haproxy.cfg
 </code><code>
 ...
-frontend kubernetes-ingress
+frontend ft-gate
-    mode                 http
+    mode http
-    bind                 *:80
-    bind                 *:443 ssl crt /etc/ssl/private/gate.crtkey
-    option               tcplog
-    default_backend      kubernetes-ingress
-backend kubernetes-ingress
+    bind *:80
+    redirect scheme https code 301 if !{ ssl_fc }
-    http-request set-header X-Forwarded-Proto https if { ssl_fc } # For Proto
+    bind *:443 ssl crt /etc/ssl/private/wild.crtkey
-    http-request set-header X-Forwarded-Host %[req.hdr(Host)]
+#    bind *:443 ssl crt /etc/ssl/private/gowebd.crtkey crt /etc/ssl/private/keycloak.crtkey
-    http-request set-header X-Forwarded-Port %[dst_port]
-#    http-request add-header X-Real-Ip %[src] # Custom header with src IP
+    default_backend      bk-kube-ingress
-#    option forwardfor # X-forwarded-for
+#    use_backend bk-kube-ingress if { ssl_fc_sni keycloak.corp13.un }
-#    http-request set-uri https://%[req.hdr(Host)]%[path]?%[query] if { ssl_fc }
+#    use_backend bk-node-ingress if { ssl_fc_sni gowebd.corp13.un }
+    option               tcplog
+backend bk-kube-ingress
+#    http-request set-header X-Forwarded-Proto https if { ssl_fc }
+#    http-request set-header X-Forwarded-Host %[req.hdr(Host)]
+#    http-request set-header X-Forwarded-Port %[dst_port]
+##    http-request add-header X-Real-Ip %[src] # Custom header with src IP
+##    option forwardfor # X-forwarded-for
+##    http-request set-uri https://%[req.hdr(Host)]%[path]?%[query] if { ssl_fc }
     mode        http
@@ Line 35: / Line 47: @@
     server  kube2 kube2:80 check
     server  kube3 kube3:80 check
+#backend bk-node-ingress
+#    mode        http
+#    balance     roundrobin
+#    server  node2 node2:80 check
+#    server  node3 node3:80 check
 </code><code>
 # haproxy -f /etc/haproxy/haproxy.cfg -c
@@ Line 41: / Line 59: @@
 # service haproxy restart
+# tail -f /var/log/haproxy.log
 # journalctl -f | grep proxy
+# ###haproxy -f /etc/haproxy/haproxy.cfg -d
+# echo "show stat" | socat stdio /run/haproxy/admin.sock | cut -d ',' -f 1,2,18
-haproxy# curl http://localhost:80/ -H "Host: webd.corpX.un"
+haproxy# curl https://localhost/ -H "Host: gowebd.corpX.un" -k
 </code>

Методические материалы Лохтурова Вячеслава

User Tools

Site Tools

Differences

Page Tools