Question

我正在尝试通过HAProxy服务器访问路由器Web界面。到目前为止，看起来很简单！但是经过一场沉重的搜索聚会之后，我来将命运交到了你手中。

环境：

Haproxy 1.8.8，可以运行到容器中。
Freebox Web门户：https://192.168.1.254。

它应以这种方式在特定路径下工作：

用户将以下网址输入浏览器： https://example.com/freebox
HAProxy配置在端口443上检测到/ freebox路径，然后将其转发到相应的后端。
后端看到/ freebox路径并将其剥离到/，因此url如下所示：https://example.com/
此URL与后端URL（意味着没有特定路径）相匹配，因此它应该可以工作，但不能。

最适合我的

我可以在两侧使用SSL配置。
我可以检测到正确的路径并提供正确的后端
我可以更改检测到的路径并提供相应的后端前端：https://example.com/home->后端：https://192.168.1.2/domoticz

我试图解决的问题：

在请求到达后端之前，我做了几件事：

Frontend www-https
...
    acl path_freebox url_beg /freebox
    http-request set-header         X-Location-Path %[capture.req.uri] if path_freebox
    http-request replace-header     X-Location-Path /freebox / if path_freebox
    http-request redirect location  %[hdr(X-Location-Path)] if path_freebox
    use_backend backend_freebox if path_freebox
...

我已经将/ freebox剥离到了/（仅在conf文件中显示“或” ）：

backend backend_freebox
    reqirep ^([^\ :]*)\ /freebox/(.*)     \1\2
    or
    reqrep ^([^\ ]*\ /)freebox[/]?(.*)    \1\2
    or
    reqirep ^([^\ :]*)\ /freebox/(.*)  \1\ /\2
    or
    reqrep ^([^\ ]*\ /)freebox[/]?(.*)     \1\/\2
    or
    http-request set-path %[path,regsub(^/freebox/?,/)]
    or
    http-request set-uri %[url,regsub(^/freebox,/,)]

    server freebox 192.168.1.254:443 ssl verify none

我先设置标题，然后剥离路径：

    http-request set-header X-Forwarded-Port %[dst_port]
    http-request add-header X-Forwarded-Proto https if { ssl_fc }
    reqirep ^([^\ :]*)\ /freebox/(.*)     \1\2

    server freebox 192.168.1.254:443 ssl verify none

我更改了原点，然后删除了尾随路径：

    http-request set-header Orig-Path /freebox/
    http-request set-header X-Script-Path /freebox/
    http-request set-header Host example.com
    or
    http-request set-header Orig-Path /freebox
    http-request set-header X-Script-Path /freebox
    http-request set-header Host example.com

    reqirep ^([^\ :]*)\ /freebox/(.*)     \1\2
    server freebox 192.168.1.254:443 ssl verify none

这一半有效，我可以使用该方法查看门户的视图，但是由于上面写有“错误”，因此无法使用它。

我的完整HAProxy配置：

global  
    # Logging to rsyslog on localhost local2
    log 127.0.0.1 local2 debug

    # System Security
    #chroot /var/lib/haproxy
    #stats socket /run/haproxy/admin.sock mode 660 level admin
    #stats timeout 30s
    #user haproxy
    #group haproxy

    # Start as daemon
    daemon

    # Default SSL Ciphers
    ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
    ssl-default-bind-options no-sslv3 no-tls-tickets
    ssl-default-server-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
    ssl-default-server-options no-sslv3 no-tls-tickets
    tune.ssl.default-dh-param 2048

defaults
    mode                    tcp
    log                     global
    option                  httplog
    option                  dontlognull
    option          http-server-close
    option          forwardfor       except 127.0.0.0/8
    option                  redispatch
    retries                 3
    timeout http-request    10s
    timeout queue           1m
    timeout connect         10s
    timeout client          1m
    timeout server          1m
    timeout http-keep-alive 10s
    timeout check           10s
    maxconn                 3000
    errorfile 400 /usr/local/etc/haproxy/errors/400.http
    errorfile 403 /usr/local/etc/haproxy/errors/403.http
    errorfile 408 /usr/local/etc/haproxy/errors/408.http
    errorfile 500 /usr/local/etc/haproxy/errors/500.http
    errorfile 502 /usr/local/etc/haproxy/errors/502.http
    errorfile 503 /usr/local/etc/haproxy/errors/503.http
    errorfile 504 /usr/local/etc/haproxy/errors/504.http

frontend www-https
    # Bind this frontend to the port 443 with ssl configuration
    bind *:443 ssl crt /etc/ssl/example.com

    mode http   

    # Full logging to localhost
    log 127.0.0.1 local2
    option httplog

    # Whitelist
    #acl network_allowed src 20.30.40.50 8.9.9.0/27
    #tcp-request connection reject if !network_allowed

    # Pour forwarder l'identité des clients (To be verified)
    reqadd X-Forwarded-Proto:\ http
    reqadd X-Forwarded-Proto:\ https

    # Default Backend
    default_backend backend_trash

    # ACLs to determine the backend defined on the path
    acl path_domoticz url_beg /domoticz/
    use_backend backend_domoticz if path_domoticz

    acl path_gitlab url_beg /gitlab
    use_backend backend_gitlab if path_gitlab

    acl path_pihole url_beg /pihole
    use_backend backend_pihole if path_pihole

    acl path_freebox url_beg /freebox
    use_backend backend_freebox if path_freebox

    #acl path_orbi url_beg /orbi
    #use_backend backend_orbi if path_orbi

# Backend Configuration
backend backend_domoticz
    mode http
    server domoticz 192.168.1.2:443 ssl verify none

backend backend_gitlab
    mode http
    server gitlab 192.168.1.6:443 ssl verify none

backend backend_pihole
    mode http
    reqirep ^([^\ :]*)\ /pihole/(.*)     \1\ /hole/\2
    server hole 192.168.1.8:443 ssl verify none

backend backend_freebox
    mode http
    #option forwardfor
    #http-request set-header X-Forwarded-Port %[dst_port]
    #http-request add-header X-Forwarded-Proto https if { ssl_fc }
    #option httpchk HEAD / HTTP/1.1\r\nHost:localhost
    #reqrep ^([^\ ]*\ /)freebox[/]?(.*)    \1\2
    #reqirep ^([^\ :]*)\ /freebox/(.*)     \1\2
    #http-request set-uri %[url,regsub(^/freebox,/,)]
    #http-request set-path %[path,regsub(^/freebox/?,/)]

    #http-request set-header Orig-Path /freebox/
    #http-request set-header X-Script-Path /freebox/
    #http-request set-header Host starfly.ovh
    #reqirep ^([^\ :]*)\ /freebox/(.*)  \1\ /\2
    #reqrep ^([^\ ]*\ /)freebox[/]?(.*)     \1\/\2

    server freebox 192.168.1.254:443 ssl verify none

#backend backend_orbi
#(Not Working)
    #mode http
        #reqirep ^([^\ :]*)\ /orbi/(.*)     \1\2
        #server orbi 192.168.1.56:443 ssl verify none

backend backend_trash
    mode http
    http-request deny

预期的行为：

我希望我可以保留我的尾随路径/ freebox并仍然访问/上的后端。

我不知道是否有可能，也许你们可以帮我弄清楚吗？

非常感谢！

如何通过/ SOMETHING /路径访问后端资源

0 个答案: