bonjour,
si quelqu’un s’y connait en HAproxy, j’ai systématiquement une erreur 503 avec la configuration suivante (je précise que le certificat est bien reconnu):
global
uid 80
gid 80
chroot /var/haproxy
daemon
stats socket /var/run/haproxy.socket group proxy mode 775 level admin expose-fd listeners
nbproc 1
nbthread 1
hard-stop-after 60s
no strict-limits
tune.ssl.default-dh-param 2048
spread-checks 0
tune.bufsize 16384
tune.lua.maxmem 0
log /var/run/log local0 debug
lua-prepend-path /tmp/haproxy/lua/?.lua
ssl-default-bind-options no-tls-tickets no-tlsv10 no-sslv3 ssl-min-ver TLSv1.2 ssl-max-ver TLSv1.3
ssl-default-bind-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
ssl-default-bind-ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
defaults
log global
option redispatch -1
timeout client 30s
timeout connect 30s
timeout server 30s
retries 3
default-server init-addr last,libc
frontend FE_SRV
http-response set-header Strict-Transport-Security "max-age=15768000"
bind PUBLIC_IP name PUBLIC_IP ssl prefer-client-ciphers ssl-min-ver TLSv1.2 ssl-max-ver TLSv1.3 ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256 ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 ca-file /tmp/haproxy/ssl/6288f4825085d0.42858451.calist verify optional alpn h2,http/1.1 crt-list /tmp/haproxy/ssl/6288f4825085d0.42858451.certlist
mode http
option http-keep-alive
default_backend BE_SRV
option forwardfor
timeout client 30s
stick-table type string len 32 size 50k expire 30m
tcp-request connection track-sc0 src
option httplog
backend BE_SRV
mode http
balance source
stick-table type ip size 50k expire 30m
stick on src
timeout connect 30s
timeout server 30s
http-reuse safe
server RS_SRV LOCAL_IP ssl alpn h2,http/1.1 verify required ca-file /tmp/haproxy/ssl/6288f300576781.75689608.calist resolve-prefer ipv4
listen local_statistics
bind 127.0.0.1:8822
mode http
stats uri /haproxy?stats
stats realm HAProxy\ statistics
stats admin if TRUE
# statistics are DISABLED
Cependant le serveur de backend est un serveur en FQDN du réseau local (LOCAL_IP est juste pour anonymiser)