Fast HTTPS proxy setup

start.sh

#!/bin/bash

source ../.env

if [[ -z "$HAPROXY_DOMAIN" ]]; then
    echo "ENV HAPROXY_DOMAIN is not set"
    exit 1
fi

if [[ -z "$HAPROXY_PROJECT" ]]; then
    echo "ENV HAPROXY_PROJECT is not set"
    exit 1
fi

if [[ -z "$HAPROXY_BASE" ]]; then
    echo "ENV HAPROXY_BASE is not set"
    exit 1
fi

DOMAIN=$HAPROXY_DOMAIN
PROJECT=$HAPROXY_PROJECT
BASE=$HAPROXY_BASE

function clean {
  rm $DOMAIN.pem haproxy.cfg
}
trap clean EXIT

# Generate root CA
if [[ ! -f "./root.pem" ]]; then
    openssl genrsa -out root.key 2048
    openssl req -x509 -new -nodes -key root.key -sha256 -days 1825 -out root.pem \
        -subj "/C=RU/ST=Moscow/L=Moscow/O=DOCTOOLS/OU=DT/CN=Localhost Authority"

    sudo security add-trusted-cert -d -r trustRoot -k "/Library/Keychains/System.keychain" root.pem

    rm  root.srl
fi

# Generate signed cert for target domain
if [[ ! -f "./$DOMAIN.pem" ]]; then
    openssl genrsa -out $DOMAIN.key 2048
    openssl req -new -key $DOMAIN.key -out $DOMAIN.csr -nodes \
        -subj "/C=RU/ST=Moscow/L=Moscow/O=DOCTOOLS/OU=DT/CN=Localhost Authority"

    cat > "$DOMAIN.ext" <<EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names
[alt_names]
DNS.1 = $DOMAIN
EOF

    openssl x509 -req -in $DOMAIN.csr -CA root.pem -CAkey root.key \
        -CAcreateserial -out $DOMAIN.crt -days 825 -sha256 -extfile $DOMAIN.ext

    cat $DOMAIN.crt $DOMAIN.key > $DOMAIN.pem
    rm  $DOMAIN.csr $DOMAIN.crt $DOMAIN.key $DOMAIN.ext
fi

# Generate HAProxy config (is there other way to use ENV in HAProxy?)
cat > "haproxy.cfg" <<EOF
defaults
    mode    http
    retries 3
    timeout connect  5000
    timeout client  10000
    timeout server  10000
    maxconn 200000

frontend localhost
    bind *:80
    bind *:443 ssl crt $DOMAIN.pem
    mode http
    http-request set-path "%[path,regsub(^/$BASE/,/)]"
    default_backend nodejs

backend nodejs
    mode http
    balance roundrobin
    server nodejs 127.0.0.1:3000

    http-request add-header X-Docs-Proxy-Base $BASE
    http-request add-header X-Docs-Project-Name $PROJECT
EOF

sudo haproxy -f haproxy.cfg