Haproxy

From Bitpost wiki
Revision as of 02:06, 9 December 2019 by M (talk | contribs)

Most important: continuously check ssllabs

Most important: continuously check to ensure ssllabs gives A+ rating for all sites.

It's important to get a current cipher configuration right.

Config

For working code to get an A+, work on the config, here:

 🌵 m@bitpost  [~/development/scripts/gentoo/bitpost/root] emacs haproxy.cfg 

It contains a list of all my sites that are currently live.

After changing it, restart it:

sudo /etc/init.d/haproxy restart

2019-12-08 It was updated to use a new config format to prevent ssl less than TLS1.2. It was also updated with an attempt to redirect www.* to *, but we need updated certificates with multiple names. certbot script was updated to add them, but it has not recreated certs yet. Check back in February at the latest!

Intro

SSL