Two (or more) haproxy servers about haproxy-acme-validation-plugin

[ryansch]

@trompx I'm running multiple haproxy containers in production and using AWS EFS as a backing store for the webroot directory. This way it doesn't matter where I run the certbot container as all of the haproxy containers can see the challenge data.

[itcrowdsource]

Hi @ryansch
I have a similar setup (without Docker) with a shared filesystem for my haproxy servers. But unfortunately the Haproxy servers aren't serving the challenge keys properly. The keys are created on the shared filesystem, but somehow Haproxy can't find these keys. I mounted the shared fileystem as a folder under the root folder of each server (/sharedkey). After that I created a symlink named .well-know in /var/lib/haproxy that points to the /sharedkey folder.

I've also created an issue over here: #16 where you can see the Haproxy log. It seems that Haproxy doesn't recognize this folder properly. Not sure what's causing this. I've managed to enroll certificates without the shared filesystem previously. So probably it has to do something with that.

Could you explain how you configured your Haproxy environment?

[trompx]

Hey @ryansch, thanks for your feedback. I had so much to do that I did not implemented ssl right away, but what you are suggesting just help to be able to not care if the request is coming to one or the other load balancer.
My problem was more how to share the certificates once they have been generated to all load balancers. Guess I will back them up to some cloud storage then download them to all load balancers in a post hook script.