---

4.3.2 TLS termination with HAProxy ¶

HAProxy is another option for serving Telebugs over HTTPS with your own TLS certificate. It can also act as a reverse proxy, similar to Nginx. When prompted to enter your domain during the telebugs setup command, leave it empty and press Enter. This configures Telebugs to run on http://localhost:5555 without TLS, allowing HAProxy to manage the certificate.

1. Install HAProxy:

   apt-get update
   apt-get install haproxy
   

2. Configure HAProxy. Edit the configuration file at /etc/haproxy/haproxy.cfg and add the following lines:

   frontend https_frontend
     bind *:443 ssl crt /path/to/your/certificate.pem
     mode http
     option httplog
     default_backend telebugs_backend
   backend telebugs_backend
     mode http
     server telebugs_server localhost:5555 check
     option http-server-close
     http-request set-header X-Forwarded-Proto https
     http-request set-header X-Forwarded-For %[src]
     http-request set-header X-Forwarded-Host %[req.hdr(Host)]
     http-request set-header X-Real-IP %[src]
   

   Note: The certificate.pem file should contain your TLS certificate and private key concatenated together. If you’re using Let’s Encrypt, you can concatenate them like this:

   cat fullchain.pem privkey.pem > /etc/ssl/private/certificate.pem
   

3. Test the configuration and restart HAProxy:

   haproxy -c -f /etc/haproxy/haproxy.cfg
   systemctl restart haproxy
   

Once completed, HAProxy will handle your custom certificate and securely forward traffic to Telebugs on http://localhost:5555. This setup gives you the flexibility to use your preferred TLS certificates.