Skip to content

Commit cb43999

Browse files
committed
doc/mgr/dashboard: Fix HAProxy TLS example
With `ssl` set on the `server` option, HAProxy strips the TLS protocol for all clients. You would need to connect to it with `http://<ip>:443`. To have an active health check, which uses SSL, but does not strip it for clients, you'd need to add: - `check` to enable active health checks. - `check-ssl` to instruct the health check to use TLS - `verify none` to skip verification on the health check requests from HAProxy - _REMOVE_ `ssl` to stop stripping TLS The active health checks are required to not route any requests to the inactive managers. These would redirect to any unusable IP from the active mgr. --- Alternatively you could add another certificate in the frontend and then re-encrypt the traffic. But this would require tracking the certs also in HAProxy. Signed-off-by: Benedikt Heine <bebe@bebehei.de>
1 parent 226cba1 commit cb43999

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

doc/mgr/dashboard.rst

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1296,9 +1296,9 @@ redirection on standby nodes.
12961296
mode tcp
12971297
option httpchk GET /
12981298
http-check expect status 200
1299-
server x <HOST>:<PORT> ssl check verify none
1300-
server y <HOST>:<PORT> ssl check verify none
1301-
server z <HOST>:<PORT> ssl check verify none
1299+
server x <HOST>:<PORT> check check-ssl verify none
1300+
server y <HOST>:<PORT> check check-ssl verify none
1301+
server z <HOST>:<PORT> check check-ssl verify none
13021302

13031303
.. _dashboard-auditing:
13041304

0 commit comments

Comments
 (0)