Dynamic use_backend?

Configuration Samples
1

How can i get the ACL and USE_BACKEND below to a dynamic one (or two) liner(s) ?
the domain in ACL - has the info needed for the backend statement imho. (either by its own name or its value)

and - yes - I NEED to use ssl_fc_sni since traffic is a mix of websockets and normal http that needs to be offloaded coming in on same ip/port (in both cases)

mode http
log global
option dontlognull
option log-separate-errors
option httplog
option http-server-close
option forwardfor
acl https ssl_fc
http-request set-header X-Forwarded-Proto http if !https
http-request set-header X-Forwarded-Proto https if https
timeout client 30000
tcp-request inspect-delay 5s
acl cust1 ssl_fc_sni -i cust1.abc.com
acl cust2 ssl_fc_sni -i cust2.abc.com
acl cust3 ssl_fc_sni -i cust2.abc.com
acl cust4 ssl_fc_sni -i cust2.abc.com
acl cust5 ssl_fc_sni -i cust5.abc.com
use_backend bkr_cust1.abc.com_ipvANY if cust1
use_backend bkr_cust2.abc.com_ipvANY if cust2
use_backend bkr_cust3.abc.com_ipvANY if cust3
use_backend bkr_cust4.abc.com_ipvANY if cust4
use_backend bkr_cust5.abc.com_ipvANY if cust5

2

Create a map file /etc/haproxy/backends.map with below content

cust1.abc.com bkr_cust2.abc.com_ipvANY
cust2.abc.com bkr_cust2.abc.com_ipvANY

and in frontend, use this

use_backend %[req.hdr(host),host_only,lower,map_dom(/etc/haproxy/backends.map)]

1 Like
3

Unfortunatly i need to check domain with SSL_FC_SNI, (IOT things that uses websockets)

SSL_FC_SNI is only 100% reliable way I have found out so far.

4

You may still use @mario.almeida mapping suggestion, any fetch that converts to string may actually be used

Something like this:
use_backend %[ssl_fc_sni,lower,map_dom(/etc/haproxy/backends.map)]

5

I wish i could, but SSL_FC_SNI does not seem to work for that, works fine with hostname and other things…