HAProxy

haproxy.cfg example, which includes L5 and L6 SNI routing

global                                                                                                                                                          
    log /dev/log    local0                                                                                                                                  
    log /dev/log    local1 notice                                                                                                                           
    chroot /var/lib/haproxy                                                                                                                                 
    stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners                                                                           
    stats timeout 30s                                                                                                                                       
    user haproxy                                                                                                                                            
    group haproxy                                                                                                                                           
    daemon                                                                                                                                                  
                                                                                                                                                                
    # Default SSL material locations                                                                                                                        
    ca-base /etc/ssl/certs                                                                                                                                  
    crt-base /etc/ssl/private                                                                                                                               
                                                                                                                                                                
    # See: https://ssl-config.mozilla.org/#server=haproxy&server-version=2.0.3&config=intermediate                                                          
    ssl-default-bind-ciphersuites TLS_CHACHA20_POLY1305_SHA256                                                                                                  
    ssl-default-bind-options force-tlsv13                                                                                                                       
    tune.ssl.default-dh-param 2048                                                                                                                              
                                                                                                                                                                
defaults                                                                                                                                                        
    log     global                                                                                                                                          
    mode    http
    option  tcplog
    option  dontlognull
    timeout connect 1m
    timeout client  1h
    timeout server  1h
    errorfile 400 /etc/haproxy/errors/400.http
    errorfile 403 /etc/haproxy/errors/403.http
    errorfile 408 /etc/haproxy/errors/408.http
    errorfile 500 /etc/haproxy/errors/500.http
    errorfile 502 /etc/haproxy/errors/502.http
    errorfile 503 /etc/haproxy/errors/503.http
    errorfile 504 /etc/haproxy/errors/504.http

frontend http
    bind *:80
    mode http
    redirect scheme https code 301 if !{ ssl_fc }
    
frontend https
    mode tcp
    bind *:443 ssl alpn h2 strict-sni crt /etc/haproxy/brokensysadmin.haproxy
 
    tcp-request inspect-delay 5s
    tcp-request content accept if { req_ssl_hello_type 1 }

    use_backend lxc0 if { ssl_fc_sni sub0.brokensysadmin.ca }
    
    use_backend lxc1 if { ssl_fc_sni sub1.brokensysadmin.ca }

frontend lxc_api
    mode tcp
    bind {{ public_ip }}:8443 # it allows LCX API to use it's default port on localhost

    tcp-request inspect-delay 5s
    tcp-request content accept if { req_ssl_hello_type 1 }

    use_backend lxc_api if { req.ssl_sni sub_api.brokensysadmin.ca }

backend lxc0
    mode tcp
    server lxc0 10.238.243.184:22

backend lxc1
    mode tcp
    server lxc1 10.238.243.48:22

backend lxc_api
    mode tcp
    server lxc_api 127.0.0.1:8443

References

• L5 ACL (v2.2)

• L6 ACL (v2.2)