Lab: SSL termination and ACL routing with correction

What you will learn in this TP

• Terminate TLS and force HTTPS
• Route with ACLs
• Reload without downtime

HTTPS and ACLs #

What you will learn in this section

• Terminate TLS and force HTTPS
• Route with ACLs
• Reload without downtime

Context. A site must move to HTTPS, redirect legacy HTTP and separate API traffic from the rest, while restricting access to an admin interface. HAProxy terminates TLS and applies ACLs to route and filter.

Prerequisites: Previous lab, OpenSSL  ·  Estimated time: 45 min

A self-signed certificate and routing rules.

1. 1. Generate a certificate

   Why? HAProxy expects a PEM file with certificate and key: generating it yourself makes the lab self-contained, with no external authority.

   Create the PEM file HAProxy expects.
   See the correction

   mkdir -p certs
   openssl req -x509 -newkey rsa:2048 -nodes -days 30 -keyout certs/k.key -out certs/c.crt -subj '/CN=app.localhost'
   cat certs/c.crt certs/k.key > certs/app.pem

2. 2. HTTPS frontend and redirect

   Why? TLS termination offloads encryption from servers and centralises certificates; redirect and HSTS enforce secure use.

   Listen on 443, redirect 80 to HTTPS and add HSTS.
   See the correction

   frontend fe
     bind *:80
     bind *:443 ssl crt /usr/local/etc/haproxy/certs/app.pem alpn h2,http/1.1
     http-request redirect scheme https unless { ssl_fc }
     http-response set-header Strict-Transport-Security "max-age=31536000"
     acl is_api path_beg /api
     acl is_admin hdr(host) -i admin.localhost
     acl lan src 127.0.0.1 172.16.0.0/12
     http-request deny if is_admin !lan
     use_backend api if is_api
     default_backend web
   backend api
     server api1 api:80 check
   backend web
     server web1 web:80 check

3. 3. Test the routing

   Why? Testing each path and the certificate checks the ACLs route correctly and the client sees what you expect.

   Call / and /api and check the certificate.
   See the correction

   curl -sk https://localhost/ | head -3
   curl -sk https://localhost/api | head -3
   curl -sI http://localhost | grep -i location
   openssl s_client -connect localhost:443 -servername app.localhost </dev/null 2>/dev/null | openssl x509 -noout -subject -dates

4. 4. Validate and reload without downtime

   Why? Validating before reloading and using a reload signal avoids interrupting ongoing connections.

   Change a rule then reload cleanly.
   See the correction

   docker exec lb haproxy -c -f /usr/local/etc/haproxy/haproxy.cfg
   docker kill -s HUP lb      # rechargement sans coupure

Difficulty level : ●●●○○ (3/5)