Implement HAProxy SSL termination with Let's Encrypt certificates for secure load balancing

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# Variables
DOMAIN=""
BACKEND_IPS=""
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

# Usage function
usage() {
    echo "Usage: $0 -d DOMAIN [-b BACKEND_IPS]"
    echo "  -d DOMAIN        Domain name for SSL certificate (e.g., example.com)"
    echo "  -b BACKEND_IPS   Comma-separated backend server IPs (default: 127.0.0.1:8080)"
    echo "Example: $0 -d example.com -b 192.168.1.10:8080,192.168.1.11:8080"
    exit 1
}

# Logging functions
log_info() {
    echo -e "${BLUE}[INFO]${NC} $1"
}

log_success() {
    echo -e "${GREEN}[SUCCESS]${NC} $1"
}

log_warning() {
    echo -e "${YELLOW}[WARNING]${NC} $1"
}

log_error() {
    echo -e "${RED}[ERROR]${NC} $1"
}

# Cleanup function
cleanup() {
    local exit_code=$?
    if [ $exit_code -ne 0 ]; then
        log_error "Installation failed. Cleaning up..."
        systemctl stop haproxy 2>/dev/null || true
        systemctl disable haproxy 2>/dev/null || true
    fi
    exit $exit_code
}

trap cleanup ERR

# Check if running as root
check_root() {
    if [[ $EUID -ne 0 ]]; then
        log_error "This script must be run as root or with sudo"
        exit 1
    fi
}

# Detect distribution
detect_distro() {
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        case "$ID" in
            ubuntu|debian)
                PKG_MGR="apt"
                PKG_UPDATE="apt update"
                PKG_INSTALL="apt install -y"
                PKG_UPGRADE="apt upgrade -y"
                FIREWALL_CMD="ufw"
                ;;
            almalinux|rocky|centos|rhel|ol|fedora)
                PKG_MGR="dnf"
                PKG_UPDATE="dnf check-update || true"
                PKG_INSTALL="dnf install -y"
                PKG_UPGRADE="dnf upgrade -y"
                FIREWALL_CMD="firewall-cmd"
                ;;
            amzn)
                PKG_MGR="yum"
                PKG_UPDATE="yum check-update || true"
                PKG_INSTALL="yum install -y"
                PKG_UPGRADE="yum upgrade -y"
                FIREWALL_CMD="firewall-cmd"
                ;;
            *)
                log_error "Unsupported distribution: $ID"
                exit 1
                ;;
        esac
    else
        log_error "Cannot detect distribution. /etc/os-release not found."
        exit 1
    fi
}

# Configure firewall
configure_firewall() {
    if command -v ufw >/dev/null 2>&1 && [[ "$FIREWALL_CMD" == "ufw" ]]; then
        ufw allow 80/tcp
        ufw allow 443/tcp
        ufw allow 8404/tcp
        ufw --force enable
    elif command -v firewall-cmd >/dev/null 2>&1 && [[ "$FIREWALL_CMD" == "firewall-cmd" ]]; then
        firewall-cmd --permanent --add-port=80/tcp
        firewall-cmd --permanent --add-port=443/tcp
        firewall-cmd --permanent --add-port=8404/tcp
        firewall-cmd --reload
    else
        log_warning "No supported firewall found. Please manually open ports 80, 443, and 8404"
    fi
}

# Generate HAProxy configuration
generate_haproxy_config() {
    local backends=""
    IFS=',' read -ra BACKEND_ARRAY <<< "$BACKEND_IPS"
    local i=1
    for backend in "${BACKEND_ARRAY[@]}"; do
        backends+="    server web$i $backend check\n"
        ((i++))
    done

    cat > /etc/haproxy/haproxy.cfg << EOF
global
    log         127.0.0.1:514 local0
    chroot      /var/lib/haproxy
    stats socket /run/haproxy/admin.sock mode 660 level admin
    stats timeout 30s
    user        haproxy
    group       haproxy
    daemon
    
    # SSL Configuration
    ssl-default-bind-ciphers ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:!aNULL:!SHA1:!AESCCM
    ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets
    ssl-default-server-ciphers ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:!aNULL:!SHA1:!AESCCM
    ssl-default-server-options ssl-min-ver TLSv1.2 no-tls-tickets
    
    # Performance tuning
    tune.ssl.default-dh-param 2048
    tune.bufsize 32768

defaults
    mode                    http
    log                     global
    option                  httplog
    option                  dontlognull
    option                  http-server-close
    option                  forwardfor       except 127.0.0.0/8
    option                  redispatch
    retries                 3
    timeout http-request    10s
    timeout queue           1m
    timeout connect         10s
    timeout client          1m
    timeout server          1m
    timeout http-keep-alive 10s
    timeout check           10s
    maxconn                 3000

frontend stats
    bind *:8404
    stats enable
    stats uri /stats
    stats refresh 30s
    stats admin if TRUE

frontend http_frontend
    bind *:80
    redirect scheme https code 301 if !{ ssl_fc }

frontend https_frontend
    bind *:443 ssl crt /etc/ssl/certs/haproxy/$DOMAIN.pem
    
    # Security headers
    http-response set-header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    http-response set-header X-Frame-Options "SAMEORIGIN"
    http-response set-header X-Content-Type-Options "nosniff"
    http-response set-header X-XSS-Protection "1; mode=block"
    
    default_backend web_servers

backend web_servers
    balance roundrobin
    option httpchk GET /health
$(echo -e "$backends")
EOF
}

# Create certificate renewal script
create_renewal_script() {
    cat > /usr/local/bin/haproxy-ssl-renew << 'EOF'
#!/bin/bash
DOMAIN=$1
certbot renew --pre-hook "systemctl stop haproxy" --post-hook "systemctl start haproxy"
if [ $? -eq 0 ]; then
    cat /etc/letsencrypt/live/$DOMAIN/fullchain.pem /etc/letsencrypt/live/$DOMAIN/privkey.pem > /etc/ssl/certs/haproxy/$DOMAIN.pem
    chown root:haproxy /etc/ssl/certs/haproxy/$DOMAIN.pem
    chmod 640 /etc/ssl/certs/haproxy/$DOMAIN.pem
    systemctl reload haproxy
fi
EOF
    chmod 755 /usr/local/bin/haproxy-ssl-renew
}

# Parse command line arguments
while getopts "d:b:h" opt; do
    case $opt in
        d) DOMAIN="$OPTARG" ;;
        b) BACKEND_IPS="$OPTARG" ;;
        h) usage ;;
        *) usage ;;
    esac
done

# Validate arguments
if [[ -z "$DOMAIN" ]]; then
    log_error "Domain is required"
    usage
fi

if [[ -z "$BACKEND_IPS" ]]; then
    BACKEND_IPS="127.0.0.1:8080"
    log_warning "No backend IPs specified, using default: $BACKEND_IPS"
fi

# Main installation
main() {
    log_info "[1/10] Checking prerequisites..."
    check_root
    detect_distro

    log_info "[2/10] Updating system packages..."
    $PKG_UPDATE
    $PKG_UPGRADE

    log_info "[3/10] Installing HAProxy and Certbot..."
    if [[ "$PKG_MGR" == "apt" ]]; then
        $PKG_INSTALL haproxy certbot socat
    else
        $PKG_INSTALL epel-release
        $PKG_INSTALL haproxy certbot socat
    fi

    log_info "[4/10] Configuring firewall rules..."
    configure_firewall

    log_info "[5/10] Creating SSL certificate directory..."
    mkdir -p /etc/ssl/certs/haproxy
    chown root:haproxy /etc/ssl/certs/haproxy
    chmod 750 /etc/ssl/certs/haproxy

    log_info "[6/10] Stopping HAProxy for certificate generation..."
    systemctl stop haproxy 2>/dev/null || true

    log_info "[7/10] Obtaining Let's Encrypt certificates..."
    certbot certonly --standalone --preferred-challenges http --http-01-port 80 \
        --non-interactive --agree-tos --register-unsafely-without-email \
        -d "$DOMAIN" -d "www.$DOMAIN"

    log_info "[8/10] Creating combined certificate file..."
    cat "/etc/letsencrypt/live/$DOMAIN/fullchain.pem" \
        "/etc/letsencrypt/live/$DOMAIN/privkey.pem" > "/etc/ssl/certs/haproxy/$DOMAIN.pem"
    chmod 640 "/etc/ssl/certs/haproxy/$DOMAIN.pem"
    chown root:haproxy "/etc/ssl/certs/haproxy/$DOMAIN.pem"

    log_info "[9/10] Generating HAProxy configuration..."
    generate_haproxy_config
    
    log_info "Creating certificate renewal script..."
    create_renewal_script

    # Add cron job for certificate renewal
    (crontab -l 2>/dev/null; echo "0 2 * * 0 /usr/local/bin/haproxy-ssl-renew $DOMAIN") | crontab -

    log_info "[10/10] Starting and enabling HAProxy..."
    systemctl enable haproxy
    systemctl start haproxy

    # Verification
    log_info "Verifying installation..."
    sleep 3
    if systemctl is-active --quiet haproxy; then
        log_success "HAProxy is running successfully"
    else
        log_error "HAProxy failed to start"
        exit 1
    fi

    if ss -tlnp | grep -q ":443.*haproxy" && ss -tlnp | grep -q ":80.*haproxy"; then
        log_success "HAProxy is listening on ports 80 and 443"
    else
        log_error "HAProxy is not listening on expected ports"
        exit 1
    fi

    log_success "Installation completed successfully!"
    log_info "HAProxy SSL termination is now configured for domain: $DOMAIN"
    log_info "Backend servers: $BACKEND_IPS"
    log_info "Statistics interface available at: http://$(hostname -I | awk '{print $1}'):8404/stats"
    log_info "Certificate will auto-renew via cron job every Sunday at 2 AM"
}

main "$@"