diff options
| author | Christian Breunig <christian@breunig.cc> | 2025-04-28 22:08:46 +0200 |
|---|---|---|
| committer | Christian Breunig <christian@breunig.cc> | 2025-04-28 22:10:08 +0200 |
| commit | f8b0d74eecabdd16cb0cd6239c8095ed6d2321e3 (patch) | |
| tree | e200a77ba323f8dad89900f3260532c843359c3b /data | |
| parent | 6abf68da33aa71913872730e24396f366c4dc9fa (diff) | |
| download | vyos-1x-f8b0d74eecabdd16cb0cd6239c8095ed6d2321e3.tar.gz vyos-1x-f8b0d74eecabdd16cb0cd6239c8095ed6d2321e3.zip | |
haproxy: T7122: automatically reverse-proxy to certbot
Automatically render HaProxy rules to reverse-proxy ACME challanges when the
requested certificate was issued using ACME.
Diffstat (limited to 'data')
| -rw-r--r-- | data/templates/load-balancing/haproxy.cfg.j2 | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/data/templates/load-balancing/haproxy.cfg.j2 b/data/templates/load-balancing/haproxy.cfg.j2 index 2287cb815..400936474 100644 --- a/data/templates/load-balancing/haproxy.cfg.j2 +++ b/data/templates/load-balancing/haproxy.cfg.j2 @@ -64,9 +64,19 @@ frontend {{ front }}-http {% else %} bind [::]:80 v4v6 {% endif %} - redirect scheme https code 301 if !{ ssl_fc } +{% if front_config.ssl.acme_certificate is vyos_defined %} + acl acme_acl path_beg /.well-known/acme-challenge/ + use_backend certbot_{{ front }}_backend if acme_acl +{% endif %} + redirect scheme https code 301 if !acme_acl +{% endif %} + +{% if front_config.ssl.acme_certificate is vyos_defined %} +backend certbot_{{ front }}_backend + server fe_{{ front }}_acme 127.0.0.1:65080 {% endif %} + frontend {{ front }} {% set ssl_front = [] %} {% if front_config.ssl.certificate is vyos_defined and front_config.ssl.certificate is iterable %} @@ -248,6 +258,5 @@ backend {{ back }} {% if back_config.timeout.server is vyos_defined %} timeout server {{ back_config.timeout.server }}s {% endif %} - {% endfor %} {% endif %} |