Configure HAProxy multi-site SSL termination with SNI for secure load balancing

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# Global variables
HAPROXY_SSL_DIR="/etc/ssl/haproxy"
HAPROXY_CONFIG="/etc/haproxy/haproxy.cfg"
DOMAINS=()
BACKEND_IPS=()
PKG_MGR=""
PKG_INSTALL=""

# Usage message
usage() {
    echo "Usage: $0 -d domain1,domain2,domain3 -b backend_ip1,backend_ip2"
    echo "  -d: Comma-separated list of domains (required)"
    echo "  -b: Comma-separated list of backend server IPs (required)"
    echo "  -h: Show this help message"
    echo ""
    echo "Example: $0 -d example.com,api.example.com,app.example.com -b 10.0.1.10,10.0.1.11"
    exit 1
}

# Logging functions
log_info() {
    echo -e "${BLUE}[INFO]${NC} $1"
}

log_success() {
    echo -e "${GREEN}[SUCCESS]${NC} $1"
}

log_warning() {
    echo -e "${YELLOW}[WARNING]${NC} $1"
}

log_error() {
    echo -e "${RED}[ERROR]${NC} $1"
}

# Cleanup function for rollback
cleanup() {
    if [[ $? -ne 0 ]]; then
        log_error "Installation failed. Rolling back changes..."
        if [[ -f "$HAPROXY_CONFIG.backup" ]]; then
            mv "$HAPROXY_CONFIG.backup" "$HAPROXY_CONFIG"
        fi
        systemctl stop haproxy 2>/dev/null || true
    fi
}

trap cleanup ERR

# Check if running as root or with sudo
check_privileges() {
    if [[ $EUID -ne 0 ]]; then
        log_error "This script must be run as root or with sudo"
        exit 1
    fi
}

# Detect distribution and package manager
detect_distro() {
    if [[ ! -f /etc/os-release ]]; then
        log_error "Cannot detect distribution. /etc/os-release not found."
        exit 1
    fi
    
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            ;;
        almalinux|rocky|centos|rhel|ol)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            ;;
        fedora)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            ;;
        *)
            log_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
    
    log_info "Detected distribution: $ID ($VERSION_ID)"
}

# Parse command line arguments
parse_arguments() {
    while getopts "d:b:h" opt; do
        case $opt in
            d)
                IFS=',' read -ra DOMAINS <<< "$OPTARG"
                ;;
            b)
                IFS=',' read -ra BACKEND_IPS <<< "$OPTARG"
                ;;
            h)
                usage
                ;;
            \?)
                log_error "Invalid option: -$OPTARG"
                usage
                ;;
        esac
    done
    
    if [[ ${#DOMAINS[@]} -eq 0 ]] || [[ ${#BACKEND_IPS[@]} -eq 0 ]]; then
        log_error "Both domains (-d) and backend IPs (-b) are required"
        usage
    fi
}

# Install HAProxy with SSL support
install_haproxy() {
    echo "[1/8] Installing HAProxy..."
    
    if [[ "$PKG_MGR" == "apt" ]]; then
        apt update
        $PKG_INSTALL haproxy ssl-cert
    else
        $PKG_INSTALL haproxy openssl
    fi
    
    # Verify installation
    if ! command -v haproxy &> /dev/null; then
        log_error "HAProxy installation failed"
        exit 1
    fi
    
    log_success "HAProxy installed successfully"
}

# Create SSL certificate directory
create_ssl_directory() {
    echo "[2/8] Creating SSL certificate directory..."
    
    mkdir -p "$HAPROXY_SSL_DIR"
    chmod 750 "$HAPROXY_SSL_DIR"
    
    if getent group haproxy > /dev/null 2>&1; then
        chown root:haproxy "$HAPROXY_SSL_DIR"
    else
        log_warning "haproxy group not found, using root ownership"
        chown root:root "$HAPROXY_SSL_DIR"
    fi
    
    log_success "SSL directory created: $HAPROXY_SSL_DIR"
}

# Generate self-signed certificates for demonstration
generate_demo_certificates() {
    echo "[3/8] Generating demo SSL certificates..."
    
    for domain in "${DOMAINS[@]}"; do
        if [[ ! -f "$HAPROXY_SSL_DIR/$domain.pem" ]]; then
            log_info "Generating self-signed certificate for $domain"
            
            openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
                -keyout "/tmp/$domain.key" \
                -out "/tmp/$domain.crt" \
                -subj "/C=US/ST=State/L=City/O=Organization/CN=$domain" 2>/dev/null
            
            # Combine certificate and key
            cat "/tmp/$domain.crt" "/tmp/$domain.key" > "$HAPROXY_SSL_DIR/$domain.pem"
            
            # Set secure permissions
            chmod 640 "$HAPROXY_SSL_DIR/$domain.pem"
            if getent group haproxy > /dev/null 2>&1; then
                chown root:haproxy "$HAPROXY_SSL_DIR/$domain.pem"
            else
                chown root:root "$HAPROXY_SSL_DIR/$domain.pem"
            fi
            
            # Clean up temporary files
            rm -f "/tmp/$domain.key" "/tmp/$domain.crt"
        fi
    done
    
    log_success "Demo certificates generated"
    log_warning "Replace demo certificates with real ones in production!"
}

# Backup original configuration
backup_configuration() {
    echo "[4/8] Backing up original configuration..."
    
    if [[ -f "$HAPROXY_CONFIG" ]]; then
        cp "$HAPROXY_CONFIG" "$HAPROXY_CONFIG.backup"
        log_success "Configuration backed up to $HAPROXY_CONFIG.backup"
    fi
}

# Generate HAProxy configuration
generate_haproxy_config() {
    echo "[5/8] Generating HAProxy configuration..."
    
    cat > "$HAPROXY_CONFIG" << 'EOF'
global
    daemon
    user haproxy
    group haproxy
    pidfile /var/run/haproxy.pid
    
    # SSL Configuration
    ssl-default-bind-ciphers ECDHE+aRSA+AES256+GCM+SHA384:ECDHE+aRSA+AES128+GCM+SHA256:ECDHE+aRSA+AES256+SHA384:ECDHE+aRSA+AES128+SHA256
    ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets
    ssl-default-server-ciphers ECDHE+aRSA+AES256+GCM+SHA384:ECDHE+aRSA+AES128+GCM+SHA256:ECDHE+aRSA+AES256+SHA384:ECDHE+aRSA+AES128+SHA256
    ssl-default-server-options ssl-min-ver TLSv1.2 no-tls-tickets
    
    # Performance tuning
    tune.ssl.default-dh-param 2048
    tune.bufsize 32768
    
    # Logging
    log 127.0.0.1:514 local0
    chroot /var/lib/haproxy
    stats socket /run/haproxy/admin.sock mode 660 level admin
    stats timeout 30s

defaults
    mode http
    timeout connect 5000ms
    timeout client 50000ms
    timeout server 50000ms
    option httplog
    option dontlognull
    option http-server-close
    option forwardfor
    option redispatch
    retries 3
    
    # Security headers
    http-response set-header X-Frame-Options SAMEORIGIN
    http-response set-header X-Content-Type-Options nosniff
    http-response set-header X-XSS-Protection "1; mode=block"
    http-response set-header Strict-Transport-Security "max-age=31536000; includeSubDomains"

# HTTP Frontend - Redirect to HTTPS
frontend http_frontend
    bind *:80
    mode http
    redirect scheme https

# HTTPS Frontend with SNI
frontend https_frontend
    bind *:443 ssl crt /etc/ssl/haproxy/
    mode http
    
EOF

    # Add SNI routing rules for each domain
    for i in "${!DOMAINS[@]}"; do
        echo "    use_backend backend_$i if { ssl_fc_sni ${DOMAINS[$i]} }" >> "$HAPROXY_CONFIG"
    done
    
    echo "" >> "$HAPROXY_CONFIG"
    
    # Generate backend configurations
    for i in "${!DOMAINS[@]}"; do
        cat >> "$HAPROXY_CONFIG" << EOF
# Backend for ${DOMAINS[$i]}
backend backend_$i
    mode http
    balance roundrobin
    option httpchk GET /
    http-check expect status 200
EOF
        
        for j in "${!BACKEND_IPS[@]}"; do
            echo "    server web$((j+1)) ${BACKEND_IPS[$j]}:80 check" >> "$HAPROXY_CONFIG"
        done
        echo "" >> "$HAPROXY_CONFIG"
    done
    
    # Add stats interface
    cat >> "$HAPROXY_CONFIG" << 'EOF'
# Stats interface
frontend stats
    bind *:8404
    stats enable
    stats uri /stats
    stats refresh 30s
    stats admin if TRUE
EOF
    
    log_success "HAProxy configuration generated"
}

# Configure firewall
configure_firewall() {
    echo "[6/8] Configuring firewall..."
    
    if command -v ufw &> /dev/null && ufw status | grep -q "Status: active"; then
        ufw allow 80/tcp
        ufw allow 443/tcp
        ufw allow 8404/tcp
        log_success "UFW firewall configured"
    elif command -v firewall-cmd &> /dev/null; then
        firewall-cmd --permanent --add-port=80/tcp
        firewall-cmd --permanent --add-port=443/tcp
        firewall-cmd --permanent --add-port=8404/tcp
        firewall-cmd --reload
        log_success "firewalld configured"
    else
        log_warning "No active firewall detected. Manually open ports 80, 443, and 8404"
    fi
}

# Start and enable HAProxy service
start_haproxy_service() {
    echo "[7/8] Starting HAProxy service..."
    
    # Test configuration first
    if ! haproxy -c -f "$HAPROXY_CONFIG"; then
        log_error "HAProxy configuration test failed"
        exit 1
    fi
    
    systemctl enable haproxy
    systemctl restart haproxy
    
    if systemctl is-active --quiet haproxy; then
        log_success "HAProxy service started and enabled"
    else
        log_error "Failed to start HAProxy service"
        exit 1
    fi
}

# Verify installation
verify_installation() {
    echo "[8/8] Verifying installation..."
    
    # Check if HAProxy is running
    if ! systemctl is-active --quiet haproxy; then
        log_error "HAProxy is not running"
        exit 1
    fi
    
    # Check if ports are listening
    if ! ss -tlnp | grep -q ":443"; then
        log_error "HAProxy is not listening on port 443"
        exit 1
    fi
    
    if ! ss -tlnp | grep -q ":80"; then
        log_error "HAProxy is not listening on port 80"
        exit 1
    fi
    
    log_success "Installation verified successfully"
    echo ""
    log_info "HAProxy multi-site SSL termination configured for domains:"
    for domain in "${DOMAINS[@]}"; do
        echo "  - https://$domain"
    done
    echo ""
    log_info "Stats interface available at: http://your-server-ip:8404/stats"
    echo ""
    log_warning "Remember to:"
    log_warning "1. Replace demo SSL certificates with real ones"
    log_warning "2. Update backend server configurations as needed"
    log_warning "3. Configure proper DNS records for your domains"
}

# Main execution
main() {
    check_privileges
    parse_arguments "$@"
    detect_distro
    install_haproxy
    create_ssl_directory
    generate_demo_certificates
    backup_configuration
    generate_haproxy_config
    configure_firewall
    start_haproxy_service
    verify_installation
    
    log_success "HAProxy multi-site SSL termination setup completed!"
}

main "$@"