How to enable HTTPS

[astrogerard]

For those who are interested (if any) in protecting SIP with HAproxy here is my config. I also have made my own node-red dashboard to control SIP from a simple interface. That's why you see the /ui redirect.

Code:

global
       log /dev/log    local0
       log /dev/log    local1 notice
       chroot /var/lib/haproxy
       stats socket /run/haproxy/admin.sock mode 660 level admin
       stats timeout 30s
       user haproxy
       group haproxy
       daemon

       # Default SSL material locations
       ca-base /etc/ssl/certs
       crt-base /etc/ssl/letsencrypt

       # Default ciphers to use on SSL-enabled listening sockets.
       # For more information, see ciphers(1SSL). This list is from:
       #  https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
       ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
       ssl-default-bind-options no-sslv3

defaults
       log     global
       mode    http
       option  httplog
       option  dontlognull
       timeout connect 5000
       timeout client  50000
       timeout server  50000
       errorfile 400 /etc/haproxy/errors/400.http
       errorfile 403 /etc/haproxy/errors/403.http
       errorfile 408 /etc/haproxy/errors/408.http
       errorfile 500 /etc/haproxy/errors/500.http
       errorfile 502 /etc/haproxy/errors/502.http
       errorfile 503 /etc/haproxy/errors/503.http
       errorfile 504 /etc/haproxy/errors/504.http

frontend public
       bind :::80 v4v6
       bind :::443 v4v6 ssl crt /etc/ssl/letsencrypt/mycert.pem
       option forwardfor except 127.0.0.1
       redirect scheme https code 301 if !{ ssl_fc }
       use_backend nodered if { path_beg /ui }
       default_backend sip

backend sip
       acl needs_scheme req.hdr_cnt(X-Scheme) eq 0

       reqrep ^([^\ :]*)\ /(.*) \1\ /\2
       reqadd X-Scheme:\ https if needs_scheme { ssl_fc }
       reqadd X-Scheme:\ http if needs_scheme !{ ssl_fc }
       option forwardfor
       server sip1 127.0.0.1:5000
       errorfile 503 /etc/haproxy/errors/503-no-sip.http

backend nodered
       #reqrep ^([^\ :]*)\ /nodered/(.*)     \1\ /\2
       server nodered1  127.0.0.1:1880
       errorfile 503 /etc/haproxy/errors/503-no-nodered.http