<p>I use haproxy as a load balancer pod, the requests received by the pod is from a NLB . The request received by the hsproxy pod is sent to a nginx webserver pod which serves traffic . This configuration works on both http and https . My idea is to have a redirect for web-dev.xxxx.com.The ssl certificate is at the NLB</p>
<pre><code>{
    apiVersion: &quot;v1&quot;,
    kind: &quot;ConfigMap&quot;,
    metadata: {
        name: &quot;haproxy-config&quot;,
        namespace: &quot;xxxx&quot;,
    },
    data: {
&quot;haproxy.cfg&quot;:
&quot;# This configuration use acl's to distinguish between url's passwd and then route
# them to the right backend servers. For the backend servers to handle it correctly, you
# need to setup virtual hosting there as well, on whatever you use, tomcat, nginx, apache, etc.
# For this to work with SSL, put pound before HAproxy and use a configuration file similar to
# https://gist.github.com/1984822 to get it working

global
    log stdout format raw local0
    maxconn 4096
    stats socket /var/run/haproxy.sock mode 660 level admin
    pidfile /var/run/haproxy.pid

defaults
    log global
    mode http
    option httplog
    option dontlognull
    option forwardfor except 127.0.0.1
    retries 3
    option redispatch
    maxconn 2000
    timeout connect 5000
    timeout client 50000
    timeout server 50000

# status page.
listen stats
    bind :8000
    mode http
    stats enable
    stats hide-version
    stats uri /stats

frontend http-in
    bind *:80 accept-proxy

    # http-request set-header X-Client-IP %[src]

    # Capturing specific request headers
    capture request header x-wap-msisdn len 64
    capture request header x-wap-imsi len 64
    capture request header Host len 64
    capture request header User-Agent len 64

    #### Setup virtual host routing
    # haproxy-dev.xxxx.com
    acl is_haproxy_stats hdr_end(host) -i haproxy-dev.xxxx.com
    use_backend haproxy-stats if is_haproxy_stats

    # ACL for api-dev.xxxx.com
    acl is_api hdr_end(host) -i api-dev.xxxx.com
    http-request set-header X-Forwarded-Proto https if is_api
    use_backend api if is_api

    # ACL for he.web-dev.xxxx.com
    acl is_he_web hdr_beg(host) -i he.web-dev.xxxx.com

    # ACL for he-dev.xxxx.com
    acl is_he hdr_beg(host) -i he-dev.xxxx.com

    # ACL for path begins with /projects
    acl is_products_uri path -i -m beg /products

    # ACL redirect for he.web-dev.xxxx.com/projects
    http-request redirect location https://web-dev.xxxx.com/products/?msisdn=%[req.hdr(x-wap-msisdn)] code 301 if is_he_web is_products_uri

    # ACL redirect for he-dev.xxxx.com/products
    http-request redirect location https://web-dev.xxxx.com/products/?msisdn=%[req.hdr(x-wap-msisdn)] code 301 if is_he is_products_uri

    # ACL redirect for he-dev.xxxx.com
    http-request redirect location https://web-dev.xxxx.com?msisdn=%[req.hdr(x-wap-msisdn)] code 301 if is_he

    # ACL redirect for he.web-dev.xxxx.com
    http-request redirect location https://web-dev.xxxx.com?msisdn=%[req.hdr(x-wap-msisdn)] code 301 if is_he_web

    # ACL for web-dev.xxxx.com
    acl is_web hdr_beg(host) -i web-dev.xxxx.com
    redirect scheme https if { hdr(Host) -i web-dev.xxxx.com } !{ ssl_fc }
    use_backend web if is_web

    default_backend api

 frontend web-dev.xxxx.com-https
    bind *:9000 accept-proxy

    # HSTS
    http-request set-header X-Forwarded-For %[src]
    http-request set-header X-Forwarded-Proto https

    default_backend web   

    backend haproxy-stats
      balance roundrobin
      option redispatch
      option httpchk GET /stats HTTP/1.1
      option httpclose
      option forwardfor
      server haproxy haproxy-stats.x:8000 check inter 10s

    backend api
      balance roundrobin
      option redispatch
      option httpchk GET /ping/rails?haproxy HTTP/1.0\\r\\nUser-agent:\\ HAProxy
      option httpclose
      option forwardfor
      server foo-rails foo-rails.xxxx:80 check inter 10s

    backend web
      balance roundrobin
      option redispatch
      cookie SERVERID insert nocache indirect
      option httpchk GET /nginx_status HTTP/1.0
      option httpclose
      option forwardfor
      http-response set-header X-XSS-Protection 1
      http-response set-header X-Frame-Options DENY
      http-response set-header X-Content-Type-Options nosniff
      http-response set-header Strict-Transport-Security max-age=31536000;includeSubDomains;preload
      server foo foo.xxxx:80 check inter 10s
&quot;,
   }
}

</code></pre>
<p>The</p>

Arun Karoth
<p>Your problem seems to be here.</p>
<pre><code>redirect scheme https if { hdr(Host) -i web-dev.xxxx.com } !{ ssl_fc }
</code></pre>
<p>Traffic is coming in to HAProxy on port 80 so <code>ssl_fc</code> will never match.</p>
