[ HAProxy代理 ]

发表评论
73 views

HAProxy代理https（代理性能比nginx好， 但是不能代理静态文件）

合并nginx那种密钥(key + pem > pem)

cat frontend.chenhaifeng.top.key frontend.chenhaifeng.top.pem > /home/chf/HAProxy/certs/frontend.chenhaifeng.top.pem

cat backend.chenhaifeng.top.key backend.chenhaifeng.top.pem > /home/chf/HAProxy/certs/backend.chenhaifeng.top.pem

(base) chf@chf:~/HAProxy$ cat docker-compose.yml 

version: '3.8'

services:
  haproxy:
    image: haproxy:latest
    container_name: my-haproxy
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg
      - ./certs:/usr/local/etc/haproxy/certs
    #restart: always

(base) chf@chf:~/HAProxy$ cat haproxy.cfg 

global
    log stdout format raw local0
    maxconn 4096
    daemon

defaults
    mode http
    timeout connect 5000ms
    timeout client  50000ms
    timeout server  50000ms
    log global
    option httplog
    option dontlognull

# HTTP 强制跳转 HTTPS（前端和后端）
frontend http_front
    bind *:80
    acl is_frontend hdr(host) -i frontend.chenhaifeng.top
    acl is_backend hdr(host) -i backend.chenhaifeng.top
    redirect scheme https code 301 if is_frontend
    redirect scheme https code 301 if is_backend

# 前端 HTTPS 配置
frontend https_frontend
    bind *:443 ssl crt /usr/local/etc/haproxy/certs/frontend.chenhaifeng.top.pem
    default_backend frontend_backend

backend frontend_backend
    server frontend_server 192.168.1.2:80 check

# 后端 HTTPS 配置
frontend https_backend
    bind *:443 ssl crt /usr/local/etc/haproxy/certs/backend.chenhaifeng.top.pem
    default_backend backend_backend

backend backend_backend
    server backend_server 192.168.1.2:8000 check