AMINUL ISLAM SHAMIM

https://serversforhackers.com/c/letsencrypt-with-haproxy

https://tecadmin.net/how-to-setup-haproxy-load-balancing-on-ubuntu-linuxmint/

• root@ecsweb:~# cat /etc/haproxy/haproxy.cfg
• global
• log /dev/log local0
• log /dev/log local1 notice
• chroot /var/lib/haproxy
• stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
• stats timeout 30s
• user haproxy
• group haproxy
• daemon
• # Default SSL material locations
• ca-base /etc/ssl/certs
• crt-base /etc/ssl/private
• # Default ciphers to use on SSL-enabled listening sockets.
• # For more information, see ciphers(1SSL). This list is from:
• # https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
• # An alternative list with additional directives can be obtained from
• # https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=haproxy
• ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS
• ssl-default-bind-options no-sslv3
• defaults
• log global
• mode http
• option httplog
• option dontlognull
• timeout connect 5000
• timeout client 50000
• timeout server 50000
• errorfile 400 /etc/haproxy/errors/400.http
• errorfile 403 /etc/haproxy/errors/403.http
• errorfile 408 /etc/haproxy/errors/408.http
• errorfile 500 /etc/haproxy/errors/500.http
• errorfile 502 /etc/haproxy/errors/502.http
• errorfile 503 /etc/haproxy/errors/503.http
• errorfile 504 /etc/haproxy/errors/504.http
• # If it detects a LetsEncrypt request, is uses the LE backend
• frontend ft_http
• bind :80
• mode http
• default_backend bk_http
• frontend ft_https
• bind :443
• mode tcp
• default_backend bk_https
• # This is our new config that listens on port 443 for SSL connections
• # bind *:443 ssl crt /etc/ssl/ecsweb.bdcom.com.bd/ecsweb.bdcom.com.bd.pem
• # Redirect if HTTPS is *not* used
• redirect scheme https code 301 if !{ ssl_fc }
• # Test URI to see if its a letsencrypt request
• # acl letsencrypt-acl path_beg /.well-known/acme-challenge/
• # use_backend letsencrypt-backend if letsencrypt-acl
• ## default_backend be-scalinglaravel
• ##backend be-scalinglaravel
• ## balance roundrobin
• option forwardfor
• http-request set-header X-Forwarded-Port %[dst_port]
• http-request add-header X-Forwarded-Proto https if { ssl_fc }
• backend bk_http
• mode http
• balance roundrobin
• #stick on src table bk_https
• default-server inter 1s
• server ecs.gov.bd ecs.gov.bd:80 check id 1
• server ecs.bdcom.com.bd ecs.bdcom.com.bd:80 check id 2
• #server ecsww.bdcom.com.bd ecsww.bdcom.com.bd:80 check id 3
• #server dns2.bdcom.com dns2.bdcom.com:80 check id 3
• backend bk_https
• mode tcp
• balance roundrobin
• stick-table type ip size 200k expire 30m
• stick on src
• default-server inter 1s
• # server ecsweb.bdcom.com.bd ecsweb.bdcom.com.bd:443 check ssl verify none
• #server prohostnms.bdcom.net prohostnms.bdcom.net:443 check ssl verify none
• # for 8181 haproxy panel
• listen stats
• bind *:8181
• stats enable
• stats uri /
• stats realm Haproxy\ Statistics
• stats auth admin:bdc0m987
• #backend letsencrypt-backend
• # server letsencrypt 127.0.0.1:8888

Haproxy ACL