6

I'm trying to make a proxy for 3 web servers (running on the same machine as the proxy). A have successfully configured relayd to redirect a request to correct port by their host header, but I cannot set custom certificate and private key file base on the request host header so all domains get same key and certification pair saved in /etc/ssl/IP_ADDRESS.crt and /etc/ssl/private/IP_ADDRESS.key. Do you have any ideas on how to accomplish this?

My /etc/realyd.conf:

domain1="bar.com"
port1="3000"
domain2="foo.com"
port2="8000"
challengeport="3001"

table <challenge> { 127.0.0.1 }
table <table1> { 127.0.0.1 }
table <table2> {127.0.0.1 }

http protocol filter_challenge {
pass request path "/.well-known/acme-challenge/*" forward to <challenge>

tcp { nodelay, sack }
}

http protocol resolve_domains {
pass request quick header "Host" value $domain1 forward to <table1>
pass request quick header "Host" value $domain2 forward to <table2>

tcp { nodelay, sack }
}


relay "http_bar" {
    listen on $domain1 port 80

    protocol resolve_domains
    protocol filter_challenge

    forward to <table1> check tcp port $port1
    forward to <table2> check tcp port $port2
    forward to <challenge> check tcp port $challengeport
}

relay "https_bar" {
    listen on $domain1 port 443 tls

    protocol resolve_domains

    forward to <table1> check tcp port $port1
    forward to <table2> check tcp port $port2
}

2 Answers 2

4

As of OpenBSD 6.6, relayd now supports SNI. Check the man page for the "tls keypair" option.

You can specify this option multiple times to cover as many domains as you want:

http protocol "reverse_proxy_tls" {
  block
  pass request header "Host" value "www1.example.com" forward to <httpd_www1>
  pass request header "Host" value "www2.example.com" forward to <httpd_www2>
  pass request header "Host" value "www3.example.com" forward to <httpd_www3>
  tls { no tlsv1.0, ciphers "HIGH" }
  tls keypair "www1.example.com"
  tls keypair "www2.example.com"
  tls keypair "www3.example.com"
}

relay "https" {
  listen on $external_ip port 443 tls
  protocol "reverse_proxy_tls"
  forward to <httpd_www1> port 8080
  forward to <httpd_www2> port 8080
  forward to <httpd_www3> port 8080
}
-1

relayd doesn't support SNI yet. Go with haproxy.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .