Magento and Varnish with SSL Support using HAProxy

For Safe and Secure online transactions SSL is mandatory. Now if we are planning to use Varnish with our Magento then this something cannot be achieved using Varnish alone because it cannot handle HTTPS traffic.

In our another article Install & Configure Varnish to Use with Magento 2 we showed how to configure Varnish as frontend and Apache as backend with Magento. But that is configured to handle only HTTP traffic.

To use Varnish with SSL support we need to introduce TLS termination in front of Varnish.

There are many options for TLS Termination, but we are using HAProxy in this guide.

See the following image for better understanding

Before we proceed for HAProxy installation and configuration we would recommend you to install and configure Varnish with Magento using our Install & Configure Varnish to Use with Magento 2 guide.

We assume that you have installed Varnish on Magento Server, and it is also configured with Magento.

Let us now proceed with HAProxy installation. In order to support HTTP/2 we would be needing HAProxy version equals or greater than 1.8.

Install HAProxy

sudo apt install haproxy

Check HAProxy Version

haproxy -V

It should be greater than 1.8.

Enable HTTPS by installing Free SSL Certificates from Let’s Encrypt.

You can also use these certificates for production

sudo apt update
sudo apt install software-properties-common
sudo add-apt-repository universe
sudo add-apt-repository ppa:certbot/certbot
sudo apt update
sudo apt install certbot
sudo certbot certonly --webroot -w /var/www/html/domain.com -d domain.com

You will now see a Congratulations Message and most likely your Certificate and Chain will be saved in /etc/letsencrypt/live/domain.com

Combine Chain + Key file to use with HAProxy

sudo cat /etc/letsencrypt/live/domain.com/fullchain.pem /etc/letsencrypt/live/domain.com/privkey.pem > /etc/ssl/private/domain.com.pem

In another article where we setup Varnish to listen on Port 80 and Apache was listening on 443 will now be replaced with HAProxy.

We will be using HAProxy to listen on Port 80 & 443 and backend will be pointed on 8888 where our Varnish would be listening

Configure HAProxy

sudo nano /etc/haproxy/haproxy.cfg

Now let’s add Frontend and Backend Sections at the very end of the file.

frontend www-http
   bind :80 alpn h2,http/1.1
   #http-request set-header "SSL-OFFLOADED" "1"
   reqadd X-Forwarded-Proto:\ http
   #X-Forwarded-Proto: http
   default_backend varnish-backend
   
frontend www-https
   bind :443 ssl crt /etc/ssl/private/domain.com.pem alpn h2,http/1.1
   #http-request set-header "SSL-OFFLOADED" "1"
   reqadd X-Forwarded-Proto:\ https
   #X-Forwarded-Proto: https
   default_backend varnish-backend

backend varnish-backend
   #redirect scheme https if !{ ssl_fc }
   server varnish :8888 check

Varnish & Apache Ports

Let’s make sure we have our Varnish listening on Port 8888 and Mod SSL is disable for Apache.

If you have followed our other article Install & Configure Varnish to Use with Magento 2 then you can open the following file:

sudo nano /etc/systemd/system/varnish.service.d/override.conf

and change port 80 to 8888

ExecStart=/usr/sbin/varnishd -j unix,user=vcache -F -a :8888 -T localhost:6082 -f /etc/varnish/default.vcl -S /etc/varnish/secret -s malloc,512M

Disable SSL

sudo a2dismod ssl

Restart Varnish, Apache & Haproxy

sudo systemctl daemon-reload
sudo service varnish restart
sudo service apache2 restart
sudo service haproxy restart

Configure Magento to Purge Varnish

As we have changed the port of Varnish so we need to configure Magento again to Purge Varnish

sudo php bin/magento setup:config:set --http-cache-hosts=Your-Server-IP:8888

Now lets confirm the ports

sudo netstat -tulpn

We should be having our Varnish listening on 8888, Apache on 8080 & Haproxy on 80 & 443

Make sure we have port 8888 open within our AWS Security Group.

You can now open Magento and configure it to use Secure URLs.