# \[SOLVED\] One IP, fistful of domains, pack of subdomains and HAProxy in front of it

**URL:** <https://discourse.haproxy.org/t/solved-one-ip-fistful-of-domains-pack-of-subdomains-and-haproxy-in-front-of-it/3151>\
**Category:** Help!\
**Created:** [October 29, 2018, 2:59pm UTC](https://discourse.haproxy.org/t/solved-one-ip-fistful-of-domains-pack-of-subdomains-and-haproxy-in-front-of-it/3151 "2018-10-29T14:59:12Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![scorry](https://avatars.discourse-cdn.com/v4/letter/s/848f3c/32.png) [@scorry](https://discourse.haproxy.org/u/scorry)\
**Post date:** [October 29, 2018, 2:59pm UTC](https://discourse.haproxy.org/t/solved-one-ip-fistful-of-domains-pack-of-subdomains-and-haproxy-in-front-of-it/3151/1 "2018-10-29T14:59:12Z")

</div>

Good day, friends.

Almost all in the title.  
How to configure my little zoo of, say, containers to work correctly behind one proxy? I have a separate certificate for every subdomain of every domain; I do not plan to use plain HTTP, only HTTPS; I do not plan to terminate SSL on the proxy, so I need SNI.

Where I can find some working example of the config file for my case or at least base to start and to ask question(s) about it? I tried some variants from the various examples I found, but all they did not work as expected.

Thank you in advance.

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [October 30, 2018, 11:33am UTC](https://discourse.haproxy.org/t/solved-one-ip-fistful-of-domains-pack-of-subdomains-and-haproxy-in-front-of-it/3151/2 "2018-10-30T11:33:51Z")

</div>

The front and backend needs to be in TCP mode, you match a TLS session with TCP content rules and then you match the SNI field in it:

```auto
 frontend https-in
    mode tcp
    bind :443
    tcp-request inspect-delay 5s
    tcp-request content accept if { req_ssl_hello_type 1 }
    use_backend backend1 if { req_ssl_sni -i test1.example.org }
    use_backend backend2 if { req_ssl_sni -i test2.example.org }
    use_backend backend3 if { req_ssl_sni -i test3.example.org }

```

Always take care that your certificates don’t overlap with each other, otherwise the browser will reuse existing TLS sessions for what is allowed by the certificate.

---

<div class="post-metadata">

**Author:** ![scorry](https://avatars.discourse-cdn.com/v4/letter/s/848f3c/32.png) [@scorry](https://discourse.haproxy.org/u/scorry)\
**Post date:** [October 30, 2018, 6:00pm UTC](https://discourse.haproxy.org/t/solved-one-ip-fistful-of-domains-pack-of-subdomains-and-haproxy-in-front-of-it/3151/3 "2018-10-30T18:00:30Z")

</div>

Hello!  
Thank you for your response.

I see in `haproxy.log` these repetitive lines (10 per one connection attempt, port number increases):  
`Oct 30 19:39:59 scorry haproxy[18943]: XX.XX.XX.XX:34152 [30/Oct/2018:19:39:59.229] https-in~ https-in/<NOSRV> -1/-1/729 0 SC 1/1/0/0/0 0/0`  
For the sake of clarity, I deleted all the pem files instead of one, but it didn’t change anything.  
And sites are accessible from LAN over HTTPS, so certs/webserver part seems working good.

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [October 30, 2018, 6:07pm UTC](https://discourse.haproxy.org/t/solved-one-ip-fistful-of-domains-pack-of-subdomains-and-haproxy-in-front-of-it/3151/4 "2018-10-30T18:07:00Z")

</div>

That means the server is unreachable. Can you share the config?

---

<div class="post-metadata">

**Author:** ![scorry](https://avatars.discourse-cdn.com/v4/letter/s/848f3c/32.png) [@scorry](https://discourse.haproxy.org/u/scorry)\
**Post date:** [October 30, 2018, 6:21pm UTC](https://discourse.haproxy.org/t/solved-one-ip-fistful-of-domains-pack-of-subdomains-and-haproxy-in-front-of-it/3151/5 "2018-10-30T18:21:24Z")

</div>

Yes, here [it is](https://pastebin.com/WuK4r5NX).

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [October 30, 2018, 6:47pm UTC](https://discourse.haproxy.org/t/solved-one-ip-fistful-of-domains-pack-of-subdomains-and-haproxy-in-front-of-it/3151/6 "2018-10-30T18:47:31Z")

</div>

Ok, from the haproxy instance, try curl against this backend server and provide the output:

```
curl -vk https://192.168.0.55/
```

---

<div class="post-metadata">

**Author:** ![scorry](https://avatars.discourse-cdn.com/v4/letter/s/848f3c/32.png) [@scorry](https://discourse.haproxy.org/u/scorry)\
**Post date:** [October 30, 2018, 6:58pm UTC](https://discourse.haproxy.org/t/solved-one-ip-fistful-of-domains-pack-of-subdomains-and-haproxy-in-front-of-it/3151/7 "2018-10-30T18:58:07Z")

</div>

Yep, [that it](https://pastebin.com/HcZKcMrE).

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [October 30, 2018, 7:06pm UTC](https://discourse.haproxy.org/t/solved-one-ip-fistful-of-domains-pack-of-subdomains-and-haproxy-in-front-of-it/3151/8 "2018-10-30T19:06:25Z")

</div>

Well it looks like haproxy is unable to access while curl can reach those backend servers just fine.

I suggest you run haproxy through `strace -tt` for a short period of time while you reproduce it. That output will show what exactly the systemcall’s return. I assume that there is at the system level intervening, like selinux or something like that.

---

<div class="post-metadata">

**Author:** ![scorry](https://avatars.discourse-cdn.com/v4/letter/s/848f3c/32.png) [@scorry](https://discourse.haproxy.org/u/scorry)\
**Post date:** [October 31, 2018, 9:04am UTC](https://discourse.haproxy.org/t/solved-one-ip-fistful-of-domains-pack-of-subdomains-and-haproxy-in-front-of-it/3151/9 "2018-10-31T09:04:39Z")

</div>

OK, thank you again.

I reproduced it. Command line was:  
`strace -tt haproxy -f /etc/haproxy/haproxy.cfg -d &> haproxy_strace.log`

Result [here](http://cloud.scorry.net/haproxy_strace.log).  
I opened in Firefox one `domain`, https version of it, `subdomain_1`, `https://subdomain_1`, `subdomain_2`, and `https://subdomain_2`.

BTW, http portion of haproxy config works well.

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [October 31, 2018, 10:47am UTC](https://discourse.haproxy.org/t/solved-one-ip-fistful-of-domains-pack-of-subdomains-and-haproxy-in-front-of-it/3151/10 "2018-10-31T10:47:01Z")

</div>

Ok, I found an issue in your configuration that I did not see at first:

You configured the https frontend with TLS termination (`ssl crt /var/lib/haproxy/private/` after the `bind :443`), which means haproxy decrypts TLS here. But you are then passing everything as is to port 443 on your backends, without re-encryption (so you are sending plaintext HTTP to a HTTPS port).

You can either:

- keep terminating TLS on haproxy, but send cleartext traffic to port 80 of your backend servers (just reuse the plaintext backends you already have for http)
- keep terminating TLS on haproxy, but re-encrypt TLS vs your backends (add `ssl` and [ca-file](https://cbonte.github.io/haproxy-dconv/1.8/configuration.html#ca-file%20%28Server%20and%20default-server%20options%29) options to your servers)
- just passthrough TCP port 443 without terminating it (just drop `ssl crt /var/lib/haproxy/private/` from your bind line)

---

<div class="post-metadata">

**Author:** ![scorry](https://avatars.discourse-cdn.com/v4/letter/s/848f3c/32.png) [@scorry](https://discourse.haproxy.org/u/scorry)\
**Post date:** [October 31, 2018, 11:54am UTC](https://discourse.haproxy.org/t/solved-one-ip-fistful-of-domains-pack-of-subdomains-and-haproxy-in-front-of-it/3151/11 "2018-10-31T11:54:08Z")

</div>

Thank you very, VERY much.  
All is working as expected!

---

<div class="post-metadata">

**Author:** ![Wastand](https://avatars.discourse-cdn.com/v4/letter/w/f04885/32.png) [@Wastand](https://discourse.haproxy.org/u/Wastand)\
**Post date:** [November 4, 2018, 12:24pm UTC](https://discourse.haproxy.org/t/solved-one-ip-fistful-of-domains-pack-of-subdomains-and-haproxy-in-front-of-it/3151/12 "2018-11-04T12:24:33Z")

</div>

really glad you guys have found help. wondering if it would work for me as now i can’t do anything since i’m on some meds from [suppsforlife.to](https://suppsforlife.to/). anyway, may i come back with questions in case there’s something that goes wrong? or i might update the good news if it happens. thanks.

---

<div class="post-metadata">

**Author:** ![Wastand](https://avatars.discourse-cdn.com/v4/letter/w/f04885/32.png) [@Wastand](https://discourse.haproxy.org/u/Wastand)\
**Post date:** [November 4, 2018, 12:27pm UTC](https://discourse.haproxy.org/t/solved-one-ip-fistful-of-domains-pack-of-subdomains-and-haproxy-in-front-of-it/3151/13 "2018-11-04T12:27:36Z")

</div>

thanks for sharing. hopefully it will work for me too