gandalfk7

It looks like unknowingly we followed a very similar route :D

For the git repo I am not using webhooks but wrote a script that checks if the repo has been updated, downloads the new configfile, tests the syntax and if ok copies it and reloads haproxy.

I use certbot in standalone mode, I want to review that approach and integrate it with nginx in the near future.

But yes, in standalone mode proxy-protocol is not working with certbot, I think it's due HTTP01 challenge [0] but I have to look into that with more time at hand.

I am now using these lines in haproxy config to route it to the correct backend (which just won't have "send-proxy" in the server options):

  acl letsenc_example path_beg /.well-known/acme-challenge/ hdr_dom(host) -m end example.org
  use_backend bk_http_letsenc if letsenc_example

thanks for the ideas for improvement!

[0]: https://github.com/cert-manager/cert-manager/issues/466

I did something almost identical and it's working wonders with haproxy and "mode tcp" to pass the ssl connection just reading SNI to the backend without terminating it.

I've used a delegated zone to achieve that, I like your catch-all approach better since it's cleaner, in a future rewrite I might change it.

I am now testing the configuration with proxy-protocol to pass the information on the client IP which otherwise would be lost, it's working but certbot does not like it so it needs a dedicated backend with a rule.

I've also created an Ansible playbook that does the installation for you and retrieves the haproxy config from a git repo so it's always in-sync on the balancer machines: https://blog.gandalfk7.it/posts/20220201_01_diy-balancer-wit...

Yep, I have the first version with 8/128 version but the cpu is the same, I bought it mainly for for being on call with less than 1kg in the bag. For my use case it's one of the best travel machines I had, I use it with dualboot Win10-Ubuntu.

I use it for more than just remote desktop, for work related apps I use: Outlook, Teams, Notes, etc.. All 4 at the same time is too much for the tablet, but one a time is ok, most of times even on battery saving. I try to sync outlook, notes, and other apps as much as I can when I am on external power.

If you buy it thinking it's not a desktop/beefy-laptop/SurfaceProi7 substitute but a valid companion I think it will work well.