我不知道,如果我明白如何haproxy完全正常工作。 我有一些系统是由less量服务器组成的,基于http通信。 我想同时使用haproxy作为负载平衡器和类似https服务器的东西。 它应该工作如下:用户写地址和haproxy决定 – 如果它是http然后redirect到https,如果它通过HTTP连接到系统https。 我的意思是只有客户端与haproxy应该有HTTPS连接,但与系统haproxy应该有HTTP。 这里是所描述的架构的图像:
我写了haproxyconfiguration文件,只有我得到的是从httpredirect到https并显示第一个站点 – rest是死的,因为所有通信看起来像:
客户端 – (https) – > haproxy – (https) – >系统
代替
客户端 – (https) – > haproxy – (http) – >系统
是否有可能用haproxy创build它?
以下是我的haproxyconfiguration文件:
global pidfile /var/run/haproxy.pid log 127.0.0.1 local2 debug maxconn 2048 tune.ssl.default-dh-param 2048 ca-base /etc/ssl/certs crt-base /etc/ssl/private defaults mode http option forwardfor option http-server-close log global option httplog option dontlognull option forwardfor option http-server-close option redispatch option tcp-smart-accept option tcp-smart-connect timeout http-request 10s timeout queue 1m timeout connect 5s timeout client 2m timeout server 2m timeout http-keep-alive 10s timeout check 5s retries 3 compression algo gzip compression type text/html text/html;charset=utf-8 text/plain text/css text/javascript application/x-javascript application/javascript application/ecmascript application/rss+xml application/atomsvc+xml application/atom+xml application/atom+xml;type=entry application/atom+xml;type=feed application/cmisquery+xml application/cmisallowableactions+xml application/cmisatom+xml application/cmistree+xml application/cmisacl+xml application/msword application/vnd.ms-excel application/vnd.ms-powerpoint frontend https-in bind *:80 redirect scheme https if !{ ssl_fc } bind *:443 ssl crt /etc/ssl/private/cert.pem capture request header X-Forwarded-For len 64 capture request header User-agent len 256 capture request header Cookie len 64 capture request header Accept-Language len 64 rspadd Strict-Transport-Security:\ max-age=15768000 option contstats default_backend share-https backend share-https option httpchk GET /share balance roundrobin cookie JSESSIONID prefix server main srv1:9080 cookie main check inter 5000 weight 4 server secondary srv2:9080 cookie secondary check inter 5000 weight 1
问题是因为我描述的系统是Alfresco – 名为“share”的应用程序有阻止https的CSRFPolicy。 根据这个解决scheme :
TOMCAT_HOME/webapps/share/WEB-INF/classes/alfresco/share-security-config.xml
至:
TOMCAT_HOME/shared/classes/alfresco/web-extension/share-config-custom.xml
<config evaluator="string-compare" condition="CSRFPolicy" replace="true">
<referer>https://HAProxyAddress/.*</referer> <origin>https://HAProxyAddress</origin>
就这样。 这个对我有用。