Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Docs: Reverse-Proxy: Added info on backend ssl and fixed spelling mistakes #1377

Merged
merged 1 commit into from
Apr 13, 2024
Merged

Docs: Reverse-Proxy: Added info on backend ssl and fixed spelling mistakes #1377

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
47 changes: 40 additions & 7 deletions docs/configuration/loadbalancing/reverse-proxy.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ Service
.. cfgcmd:: set load-balancing reverse-proxy service <name> ssl
certificate <name>

Set SSL certeficate <name> for service <name>
Set SSL certificate <name> for service <name>


Rules
Expand Down Expand Up @@ -97,8 +97,8 @@ Backend
.. cfgcmd:: set load-balancing reverse-proxy backend <name> balance
<balance>

Load-balancing algorithms to be used for distributind requests among the
vailable servers
Load-balancing algorithms to be used for distributed requests among the
available servers

Balance algorithms:
* ``source-address`` Distributes requests based on the source IP address
Expand Down Expand Up @@ -144,9 +144,12 @@ Backend

Send a Proxy Protocol version 2 header (binary format)

.. cfgcmd:: set load-balancing reverse-proxy backend <name> ssl ca-certificate <ca-certificate>

Configure requests to the backend server to use SSL encryption and
authenticate backend against <ca-certificate>

Gloabal
Global
-------

Global parameters
Expand Down Expand Up @@ -243,12 +246,12 @@ to the backend ``bk-api-02``

Terminate SSL
-------------
The following configuration reverse-proxy terminate SSL.
The following configuration terminates SSL on the router.

The ``http`` service is lestens on port 80 and force redirects from HTTP to
The ``http`` service is listens on port 80 and force redirects from HTTP to
HTTPS.

The ``https`` service listens on port 443 with backend `bk-default` to
The ``https`` service listens on port 443 with backend ``bk-default`` to
handle HTTPS traffic. It uses certificate named ``cert`` for SSL termination.

Rule 10 matches requests with the exact URL path ``/.well-known/xxx``
Expand Down Expand Up @@ -287,3 +290,33 @@ connection limit of 4000 and a minimum TLS version of 1.3.
set load-balancing reverse-proxy global-parameters max-connections '4000'
set load-balancing reverse-proxy global-parameters tls-version-min '1.3'

SSL Bridging
-------------
The following configuration terminates incoming HTTPS traffic on the router, then re-encrypts the traffic and sends
to the backend server via HTTPS. This is useful if encryption is required for both legs, but you do not want to
install publicly trusted certificates on each backend server.

Backend service certificates are checked against the certificate authority specified in the configuration, which
could be an internal CA.

The ``https`` service listens on port 443 with backend ``bk-bridge-ssl`` to
handle HTTPS traffic. It uses certificate named ``cert`` for SSL termination.

The ``bk-bridge-ssl`` backend connects to sr01 server on port 443 via HTTPS and checks backend
server has a valid certificate trusted by CA ``cacert``


.. code-block:: none

set load-balancing reverse-proxy service https backend 'bk-bridge-ssl'
set load-balancing reverse-proxy service https description 'listen on 443 port'
set load-balancing reverse-proxy service https mode 'http'
set load-balancing reverse-proxy service https port '443'
set load-balancing reverse-proxy service https ssl certificate 'cert'

set load-balancing reverse-proxy backend bk-bridge-ssl description 'SSL backend'
set load-balancing reverse-proxy backend bk-bridge-ssl mode 'http'
set load-balancing reverse-proxy backend bk-bridge-ssl ssl ca-certificate 'cacert'
set load-balancing reverse-proxy backend bk-bridge-ssl server sr01 address '192.0.2.23'
set load-balancing reverse-proxy backend bk-bridge-ssl server sr01 port '443'