haproxy http request reponse

Question

I have following configuration in /etc/haproxy/haproxy.cfg

> frontend LB
>         bind *:80
>         reqadd X-Forwarded-Proto:\ http
>         default_backend LB
> 
> frontend LBS
>         bind *:443 ssl crt /etc/ssl/xy.pem
>         reqadd X-Forwarded-Proto:\ https
>         default_backend LB
> 
> backend LB *:80
>         redirect scheme https if !{ ssl_fc }
>         mode http
>         stats enable
>         stats hide-version
>         stats uri /stats
>         stats realm Haproxy\ Statistics
>         stats auth xxxx:yyyyyy         
>         balance roundrobin                      
>         option httpchk
>         option  httpclose
>         option forwardfor
>         cookie LB insert
>         server web1-srv xx.xx.xxx.xxx:80 cookie web1-srv check         
>         server web2-srv xx.xx.xxx.xxx:80 cookie web2-srv check

From log i have impression that https requests are not working

[07/Aug/2018:12:35:01.402] LB LB/ 10/-1/-1/-1/10 302 121 - - LRNN 0/0/0/0/3 0/0 "GET / HTTP/1.1"

Gerard H. Pille · Answer 1 · 2018-08-07T10:24:52.787

1

Your frontend LBS "offloads" the https, and passes a http request to backend LB. Which then redirects to https. As you can see in your log: 302.

BTW, I think you should remove the "*:80" from your backend. The frontend LB is bound to port 80.

edited Aug 07 '18 at 10:24

answered Aug 07 '18 at 10:00

Gerard H. Pille

2,569
1
13
11

you means i should chanage backend LB *:80 to backend LB *:443 my back end server are on 443 – G aulakh Aug 07 '18 at 10:52
No, I said "remove", not "replace". Don't bind the backend. "backend LB *:80" becomes "backend LB". – Gerard H. Pille Aug 07 '18 at 11:01
thanks and server web1-srv xx.xx.xxx.xxx:80 should i change to server web1-srv xx.xx.xxx.xxx:443 because website is configured to 443? – G aulakh Aug 07 '18 at 11:04
No, the frontend took away the SSL. So you talk HTTP to the origin servers. ("mode http"). – Gerard H. Pille Aug 07 '18 at 11:31
I removed following line and there is no more in log redirect scheme https if !{ ssl_fc } – G aulakh Aug 08 '18 at 10:53
What took you so long? Everything OK now? – Gerard H. Pille Aug 08 '18 at 11:19

haproxy http request reponse

1 Answers1