HAproxy — LowEndSpirit

Anyone doing LetsEncrypt with round robin DNS?

WSS — Wed, 08 Apr 2026 22:01:45 +0000

Hi Folks.

I've got this zany idea of getting a backup service running on a NAT box behind HAProxy as well as the front-end with it's own dedicated IPs.

I don't really want to rely on rsync, but I probably will have to to ensure data propagation properly- however, I don't really want to do that for SSL certificates for various reasons. I'm thinking possibly DNS challenge, or being really, really lazy and just letting either box submit it's certbot requests and waiting for the luck of the draw renew them every other day or so.

Thoughts? Implementations on your side?

HAProxy - forward client IP

AlwaysSkint — Sat, 04 Apr 2020 10:35:37 +0000

After @Neoon kindly pointed me in the direction of haproxy, for reverse proxy use, I've nearly got a full setup. I'm struggling with the last piece of the puzzle, even after trying to comprehend the vast options in the documentation.
I'm trying to determine the original client IP. Straight http requests can be interrogated the through x-forward but this isn't much good for system monitoring, for example. Also, a control panel in a VM only sees access coming from the host IP.
Here's a snippet of what I've got, sorry for the formatting (need code tagging):

frontend webmin
bind *:10000
option tcplog
mode tcp
option http-server-close
option forwardfor header X-Client
acl tls req.ssl_hello_type 1
tcp-request inspect-delay 5s
tcp-request content accept if tls

acl host_ks.domain1.com_webmin req.ssl_sni -i ks.domain1.com
use_backend ks.domain1.com_webmin if host_ks.domain1.com_webmin

backend ukc.domain1.com_webmin
server ukc.domain1.com 10.0.0.100:10000
mode tcp

Note: I had to change the host webmin port (not such a bad idea), as I couldn't get haproxy to ignore/pass it though. Below is currently commented out..

( in frontend webmin )
acl host_d3.domain1.com_webmin req.ssl_sni -i d3.domain1.com
use_backend d3.domain1.com_webmin if host_d3.domain1.com_webmin

backend d3.domain1.com_webmin
server d3.domain1.com 178.123.123.90:10000
mode tcp

I have a further VM but left that out, for clarity.
All other aspects appear to be fine, with CSF redirecting various ports and VMs able to access the 'net.

Oh, and thanks again @Neoon

(inceptionhosting) [proxy domains] button missing for NAT VPS in solusvm

oplution — Thu, 28 Nov 2019 15:09:22 +0000

Hi Anthony,

[proxy domains] button missing for NAT VPS in solusvm.
Can you please help to check?

Oplution