Need help with a HTTP and HTTPS Proxy Config for multiple backend servers

Help!
1

Hi guys,

I’m a bit stuck with my HAProxy config. It works perfectly fine for HTTPS and nicely redirects the traffic and although it redirects HTTP traffic as well, I see following error in my logs before it does and I assume that this is the reason why my backend servers Let’sEncrypt certificate renewals fail (I need to run them with a DNS challenge to get them to renew)

Error: webservice80 webservice80/ 0/-1/-1/-1/0 301 172 - - LR-- 2/1/0/0/0 0/0 "GET /.well-known/acme-challenge

Setup:

Here is my config:

frontend webservice80
  bind 0.0.0.0:80 name http                                  #alctl: listener http configuration.
  mode http                                                  #alctl: load balancing algorythm
  log global                                                 #alctl: log activation
  option httplog                                             #alctl: log format
  timeout client 25s                                         #alctl: client inactivity timeout
  maxconn 1000                                               #alctl: connections maximum
  redirect scheme https code 301 if !{ ssl_fc }

frontend webservice443
  bind 0.0.0.0:443                                           #alctl: listener https configuration.
  mode tcp                                                   #alctl: load balancing algorythm
  log global                                                 #alctl: log activation
  option tcplog                                              #alctl: log format
  timeout client 25s                                         #alctl: client inactivity timeout
  maxconn 1000                                               #alctl: connections maximum
 
acl tls req.ssl_hello_type 1

tcp-request inspect-delay 5s
tcp-request content accept if tls

acl is_game req.ssl_sni -i game.example.com
acl is_cloud req.ssl_sni -i cloud.example.com
acl is_stats req.ssl_sni -i stats.example.com

use_backend cloud_cluster if is_cloud
use_backend game_cluster if is_game
use_backend stats_cluster if is_stats

backend cloud_cluster
 mode tcp
 option ssl-hello-chk
 server is_cloud 192.168.0.2:443

backend game_cluster
 mode tcp
 option ssl-hello-chk
 server is_game 192.168.0.3:443

backend stats_cluster
 mode tcp
 option ssl-hello-chk
 server is_stats 192.168.0.4:443

Any help is highly apprechiated !! Thanks a ton !

2

Managed to solve it myself. Not sure if that is the most elegant way of doing this but it works:

######## HAProxy with SSL Passthorugh and HTTP for certbot
defaults
	log global
	mode http
	option httplog
	option dontlognull
	timeout connect 5000
	timeout client 50000
	timeout server 50000

frontend main_http
	bind *:80
	mode http

    acl cloud hdr(host) -i cloud.example.com
    acl game hdr(host) -i game.example.com
    acl stats hdr(host) -i stats.example.com

    use_backend cloud_http if cloud
    use_backend game_http if game
    use_backend stats_http if stats

    backend cloud_http
            mode http
            option log-health-checks
  		balance roundrobin
            option httpchk HEAD / HTTP/1.0
            server cloud-01 192.168.0.2:80 check

    backend game_http
            mode http
            option log-health-checks
  		balance roundrobin
            option httpchk HEAD / HTTP/1.0
            server game-01 192.168.0.3:80 check

    backend stats_http
            mode http
            option log-health-checks
  		balance roundrobin
            option httpchk HEAD / HTTP/1.0
            server stats-01 192.168.0.4:80 check

frontend main_https
	bind *:443
	mode tcp
        option tcplog
	tcp-request inspect-delay 5s
	tcp-request content accept if { req_ssl_hello_type 1 }

    acl cloud.ssl req_ssl_sni -i cloud.example.com
	acl game.ssl req_ssl_sni -i game.example.com
	acl stats.ssl req_ssl_sni -i stats.example.com
    

    use_backend cloud_ssl if cloud.ssl
	use_backend game_ssl if game.ssl
	use_backend stats_ssl if stats.ssl


    backend cloud_ssl
            mode tcp
            option log-health-checks
  		balance roundrobin
            option ssl-hello-chk
            server cloud_ssl-01 192.168.0.2:443 check

    backend game_ssl
            mode tcp
            option log-health-checks
  		balance roundrobin
            option ssl-hello-chk
            server game_ssl-01 192.168.0.3:443 check
			
	backend stats_ssl
	    mode tcp
            option log-health-checks
  		balance roundrobin
            option ssl-hello-chk
            server stats_ssl-01 192.168.0.4:443 check