force haproxy to https

Question

I can't get haproxy to force https. It works with http and https. I want it to force port 443. When I try to force it using .htaccess, it says "To many redirects"

Here is my haproxy.cfg:

global 
    log 127.0.0.1 local2 
    maxconn 2048 
    user haproxy 
    group haproxy 
    daemon 
    tune.ssl.default-dh-param 2048 

defaults 
    timeout server 86400000 
    timeout connect 86400000 
    timeout client 86400000 
    timeout queue 1000s 

listen premierdis 
    bind 192.168.1.200:80 
    bind 192.168.1.200:443 ssl crt /root/.ssl/website.com.pem ciphers TLSv1+HIGH:!SSLv2:RC4+MEDIUM:!aNULL:!eNULL:!3DES:@STRENGTH 
    mode http 
    rspirep ^Location:\ http://(.*):80(.*)  Location:\ https://\1:443\2   if  { ssl_fc } 
    stats enable 
    stats uri /haproxy?stats 
    stats realm STATS 
    stats auth user:pass 
    balance source 
    option http-server-close 
    timeout http-keep-alive 3000 
    reqidel ^X-Real-IP: 
    option forwardfor header X-Real-IP 
    reqadd X-Forwarded-Proto:\ https 
    server srvg-webc-11 192.168.1.21:80 check 
    server srvg-webc-12 192.168.1.22:80 check 
    server srvg-webc-13 192.168.1.23:80 check 

Answer 1

If you split out your configuration into one section for HTTP and one section for HTTPS, then you can use redirect scheme in the HTTP section to redirect the client to use HTTPS instead.

global 
    log 127.0.0.1 local2 
    maxconn 2048 
    user haproxy 
    group haproxy 
    daemon 
    tune.ssl.default-dh-param 2048 

defaults 
    timeout server 86400000 
    timeout connect 86400000 
    timeout client 86400000 
    timeout queue 1000s 

listen premierdis-http
    bind 192.168.1.200:80 
    mode http
    redirect scheme https if !{ ssl_fc }

listen premierdis
    bind 192.168.1.200:443 ssl crt /root/.ssl/website.com.pem ciphers TLSv1+HIGH:!SSLv2:RC4+MEDIUM:!aNULL:!eNULL:!3DES:@STRENGTH 
    mode http 
    stats enable 
    stats uri /haproxy?stats 
    stats realm STATS 
    stats auth user:pass 
    balance source 
    option http-server-close 
    timeout http-keep-alive 3000 
    reqidel ^X-Real-IP: 
    option forwardfor header X-Real-IP 
    reqadd X-Forwarded-Proto:\ https 
    server srvg-webc-11 192.168.1.21:80 check 
    server srvg-webc-12 192.168.1.22:80 check 
    server srvg-webc-13 192.168.1.23:80 check 

Hope that helps.