OpenBSD relayd SSL reverse proxy for 3 web servers

Question

I run virtual servers behind a firewall on three different machines (each machine servers different domains, it is NOT A CLUSTER). To renew Let's Encrypt certificates automatically I need the proxy to send requests to three different servers based on domain names.

                        +--------+      +-------------+                      
                        |        +----->| domain1.com | 
                        |        |      +-------------+
                        |        |      +-------------+
domain1,2,3.com-->443-->| proxy  +----->| domain2.com |
                        |        |      +-------------+
                        |        |      +-------------+ 
                        |        +----->| domain3.com |
                        +--------+      +-------------+ 

The proxy is relayd on OpenBSD. I followed this guide (exactly the same situation) to set up regular web services with HTTP: https://serverfault.com/questions/856807/openbsd-how-to-use-relayd-and-httpd-for-redirecting-subdomain-requests

But it seems different for SSL with HTTPS. It seems like I have to install the SSL certificates both at the proxy and at the web server serving the domain.

1. Can anyone suggest a propper syntax for that?
2. Can I serve ports 80 and 443 at the same time for the same machines? Thank you.

Answer 1

Usually in such frontends, you install the SSL traffic in the frontend, and forward to the backend the normal HTTP traffic without encryption.

          https                           http
       Internet -------->  relayd reverse proxy  ------->  internal LAN web server
                 port 443                        port 80

As in, in man relayd:

The following configuration would add a relay to forward secure HTTPS connections to a pool of HTTP webservers using the loadbalance mode (TLS acceleration and layer 7 load balancing). The HTTP protocol definition will add two HTTP headers containing address information of the client and the server, set the “Keep-Alive” header value to the configured session timeout, and include the “sessid” variable in the hash to calculate the target host:

http protocol "https" {
match header set "X-Forwarded-For" \
value "$REMOTE_ADDR"
match header set "X-Forwarded-By" \
value "$SERVER_ADDR:$SERVER_PORT"
match header set "Keep-Alive" value "$TIMEOUT"

match query hash "sessid"
match hash "sessid"

pass
block path "/cgi-bin/index.cgi" value "command="

tls { no tlsv1.0, ciphers "HIGH" }
}

relay "tlsaccel" {
listen on www.example.com port 443 tls
protocol "https"
forward to port 8080 mode loadbalance check tcp
}

If the ssl or tls key is present, it tries to find the files according to the IP address the vhost is associated to. As for the X.509 certificates, relayd will try to find them in /etc/ssl/private for the private key, and /etc/ssl for the certificate(s) public key(s).

From Relayd proxy

If the ssl keyword is present, like in our line "listen on $relayd_addr port $relayd_port ssl", the relay will accept connections using the encrypted SSL protocol. The relay will look up a private key in /etc/ssl/private/address.key and a public certificate in /etc/ssl/address.crt, where address is the specified IP address of the relay to listen on.

So, the name of the files must be the same as the address relayd is listening on. In our example relayd.conf, we are listening on "relayd_addr=127.0.0.1" so our files MUST be named 127.0.0.1.key, 127.0.0.1.csr and 127.0.0.1.crt.

For serving the port 80, you just add the usual syntax as an HTTP proxy to the above configuration. They can both coexist at the same time.