Johannes KastlQuestion for the haproxy users:
Does anyone have a working configuration for reverse-proxying HTTPS URLs
- using "mode tcp" (no TLS certificates on the Haproxy) AND
- using the "use_backend" configuration do decide which backend to use based on SNI?
So we have https://foo.example.org and https://bar.example.org, both DNS entries pointing to the haproxy.
use_backend foo if { FOO_CONDITION_GOES_HERE }
use_backend bar if { BAR_CONDITION_GOES_HERE }
default_backend foo
No matter which condition we try, we always fall back to the default backend.
Removing the `default_backend` we get errors for all connection attempts. So clearly the conditions are wrong.
We tried `req_ssl_cni foo.example.org` as the condition inside the curly braces.
We tried `ssl_fc_sni_end foo.example.org`.
We tried `req.ssl_cni foo.example.org`.
We tried with -i and with "-m end".
We tried the complete URL (some.service.foo.example.org) or only the domain.
Any ideas, anyone?
Rad Web Hosting
Andre Courchesne (VisiblAir)
mastodon.raddemo.host