Implementation of HAProxy for SSL/TLS Termination and Traffic Distribution

global
    log stdout format raw local0 ## Log to stdout in raw format using local0 facility
    daemon
    maxconn 50000 ## Maximum concurrent connections


defaults
    mode http ## Operate in HTTP mode
    log global ## Use global logging settings
    timeout connect 10s ## Timeout for connection to server
    timeout client 30s ## Timeout for client connections
    timeout server 30s ## Timeout for server connections
    timeout tunnel 1h ## Timeout for tunnel connections (e.g., WebSockets)

frontend fe_main ## Frontend for HTTP traffic
    bind *:80 ## Listen on port 80 for HTTP traffic
    bind *:443 ssl crt /opt/palonet/haproxy/certs/riad.com.bd.pem alpn h2,http/1.1 ## Listen on port 443 for HTTPS traffic with SSL certificate
    
    # 1. Capture the SSL handshake error if it exists
    tune.ssl.capture-buffer-size 128

    # 2. Redirect only if it's actually port 80 or not SSL
    http-request redirect scheme https code 301 unless { ssl_fc }

    # 3. Add SSL info to your log-format to see the TLS version/Cipher
    log-format "%t %ci:%cp [%TR] %ft %b/%s %ST %B \"%r\" SSL_ver:%sslv SSL_cipher:%sslc"
    http-request set-header X-Forwarded-Proto https
    http-request set-header X-Forwarded-Port 443

    default_backend be_traefik_swarm

backend be_traefik_swarm
    balance roundrobin
    # Recommended for modern microservices
    option http-keep-alive 
    default-server inter 2s fall 3 rise 2 send-proxy-v2
    # Ensure Host header is preserved for Traefik routing
    http-request set-header Host %[hdr(host)] 

    # Improved WebSocket Support
    # This checks for the existence of the header more reliably
    http-request set-header Upgrade %[hdr(Upgrade)]
    http-request set-header Connection "upgrade" if { hdr(Upgrade) -i WebSocket }

    # Health check
    option httpchk GET /ping
    http-check expect status 200

    server manager1 192.168.xx.xx:80 check
    server manager2 192.168.xx.xx:80 check
    server manager3 192.168.xx.xx:80 check

listen stats_prometheus
    bind *:8404
    mode http
    stats enable
    stats uri /metrics ## Metrics endpoint
    http-request use-service prometheus-exporter ## Enable Prometheus exporter
    stats auth admin:##########

services:
  haproxy:
    image: haproxy:lts 
    container_name: haproxy-production
    restart: always
    network_mode: host # Use host networking for direct access to host ports
    user: root ## Run as root to allow binding to low-numbered ports
    # THE FIX: Use a shell to run haproxy and pipe output to the NFS log file
    command: /bin/sh -c "haproxy -f /usr/local/etc/haproxy/haproxy.cfg | tee -a /var/log/haproxy/haproxy.log"
    volumes:
      - /opt/palonet/haproxy/config/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro
      - /opt/palonet/haproxy/certs:/opt/palonet/haproxy/certs:ro
      - /opt/palonet/haproxy/errors:/opt/palonet/haproxy/errors:ro
      - /mnt/nfs-share/goaccess/logs/haproxy:/var/log/haproxy
    logging:
      driver: "json-file" ## Use JSON-formatted logging
      options:
        max-size: "50m" ## Maximum size of each log file
        max-file: "3" ## Maximum number of log files to retain

cd /opt/haproxy/
docker-compose -f docker-compose.yml up -d

Yes, HAProxy can be configured to handle both HTTP and HTTPS traffic simultaneously by binding to different ports (e.g., port 80 for HTTP and port 443 for HTTPS) in the frontend configuration.

To update SSL/TLS certificates in HAProxy, you need to replace the existing certificate files in the specified directory (e.g., /opt/palonet/haproxy/certs/) and then reload or restart the HAProxy service to apply the changes.

HAProxy supports various load balancing algorithms, including round-robin, least connections, source IP hash, and more. You can specify the desired algorithm in the backend configuration using the 'balance' directive.

You can monitor HAProxy performance using the built-in statistics page, which can be enabled in the configuration file. Additionally, you can integrate HAProxy with monitoring tools like Prometheus and Grafana for more advanced metrics and visualization.

Yes, HAProxy can be deployed in a Docker Swarm environment. You can create a Docker service for HAProxy and configure it to run in swarm mode, allowing for high availability and scalability.

To handle WebSocket connections with HAProxy, you need to ensure that the appropriate headers (Upgrade and Connection) are set in the frontend configuration. This allows HAProxy to properly manage WebSocket connections and forward them to the backend services.

HAProxy can perform health checks on backend    
services using the 'option httpchk' directive in the backend configuration. You can specify the health check method and expected response to ensure that only healthy backend servers receive traffic.

Some best practices for securing HAProxy include:
- Regularly updating HAProxy to the latest version to benefit from security patches.
- Using strong SSL/TLS configurations and ciphers.
- Implementing access controls and rate limiting to protect against DDoS attacks.
- Monitoring logs for suspicious activity.

To optimize HAProxy performance, consider the following:
- Tuning timeout settings based on your application's needs.
- Enabling keep-alive connections to reduce latency.    
- Using appropriate load balancing algorithms for your traffic patterns.
- Monitoring resource usage and scaling HAProxy instances as needed.

Yes, HAProxy can be configured to handle TCP traffic in addition to HTTP/HTTPS. You can set up TCP frontends and backends in the configuration file to manage TCP connections effectively.