Question

我的用例是使用HAProxy作为Parse Server上的ssl终止＆amp;解析LiveQuery。我坚持使用haproxy配置，因为它无法正确连接websocket，只有在连接到本地（没有ssl终端）时它才能正常工作。在iOS上测试（反应本机应用程序）。

这是我的haproxy配置

global
    maxconn     50000
    log         127.0.0.1 local0
    user        haproxy
    chroot      /usr/share/haproxy
    pidfile     /run/haproxy.pid
    tune.ssl.default-dh-param 2048
    ssl-default-bind-ciphers ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
    ssl-default-bind-options no-sslv3
    daemon

defaults
    log global
    retries 3
    mode http
    stats enable
    stats uri /stats
    stats realm Haproxy\ Statistics
    stats auth xx:xx
    option forwardfor
    option http-server-close
    option httplog
    option dontlognull

frontend xxx_web
    bind *:443 ssl crt /etc/haproxy/certs/xxx.com.pem
    acl host_api_xxx hdr(host) -i api.xxx.com
    acl is_websocket hdr(Upgrade) -i websocket

    reqadd X-Forwarded-Port:\ 443
    reqadd X-Forwarded-Proto:\ https
    reqadd X-Forwarded-Scheme:\ https
    redirect scheme https if !{ ssl_fc }

    use_backend ws_xxx if is_websocket
    use_backend api_xxx if host_api_xxx

backend ws_xxx
    server ws_xxx 127.0.0.1:7777 check

backend api_xxx
    balance roundrobin
    reqadd X-Forwarded-Port:\ 443
    reqadd X-Forwarded-Proto:\ https
    reqadd X-Forwarded-Scheme:\ https
    server  api_xxx 127.0.0.1:7777 check # ssl verify none

Answer 1

将模式更改为“mode tcp”应该会有所帮助。

HAProxy卡在ssl websocket上（解析实时查询）

1 个答案: