HAProxy Frontends and Backends

Pattern-level inventory of the lab HAProxy frontends, SNI matches, and backends — public IPs and host addresses redacted.

The lab runs a single HAProxy edge VM (Ubuntu 24.04, HAProxy 2.8.16) with roughly 40 frontend / backend / listen blocks in /etc/haproxy/haproxy.cfg. The model is three-tier: a public Internet edge, a private lab-network edge (same hostnames), and a loopback SNI-passthrough plane that re-decrypts TLS with the *.apps.sub.comptech-lab.com wildcard cert before reaching VM backends. This table is the pattern-level surface — exact bind IPs and backend addresses are redacted; full custody lives in opp-full-plat/connection-details/.

HAProxy is platform-VM-only. OpenShift cluster APIs and *.apps.<cluster>.* routes do not transit this HAProxy — they bind to dedicated public IPs.

Frontends (binds)

Backends (by category)

VM-side TLS passthrough (SNI on :443, host-header on loopback)

WSO2 hostnames (separate ACL group)

Legacy RKE2-hosted services (may be partially decommissioned)

Self / utility / fallback

Add-a-new-host pattern (five spots)

When adding a <svc>.apps.sub.comptech-lab.com host, mirror the existing entries in these five places:

1. SNI ACL in public-apps-https (and DR variant).
2. use_backend rule keyed on the SNI ACL.
3. Public-apps-http redirect ACL (so HTTP -> HTTPS works).
4. vm-tls deny-unless ACL (so the loopback re-decrypt only accepts known hosts).
5. New backend block targeting the VM IP and port.

For *.mon.* hosts the cert pair on 127.0.0.1:8443 selects the right wildcard by SNI; the cert side is one-and-done after wildcard-mon.pem was first issued.

Internal only

Specific public IPs (primary + DR), bind addresses, backend IPs, and the dated haproxy.cfg.bak.* change ledger are kept in opp-full-plat/connection-details/ and on the haproxy VM.

Last regenerated from reference_haproxy_vm.md, reference_lab_infrastructure.md (*.mon.* pattern), connection-details/nexus.md (registry split).