Getting relayd and httpd to play nice (Secure Connection Failed, 403 forbidden)

[Kjetil Lauritzen]

Hello!

Having some trouble getting relayd and httpd to play nice.

Trying to get relayd to send https://mystaticsite.com to httpd on port 8080, 
and https://myapp.com to my Ruby application server on port 8081.

The Ruby part works fine, but the httpd part gives me `Secure Connection 
Failed` for TLS and `403 forbidden` for non-TLS.

With relayd disabled and `$static_sites` in httpd.conf set to 443, everything 
works fine.

Any advice would be greatly appreciated, thanks!

--

httpd.conf

localhost="lo0"

acme_challenge_port="4001"
https_redirect_port="4002"
static_sites_port="8080"

server "*" {
  listen on $localhost port $acme_challenge
  location "/.well-known/acme-challenge/*" {
    root "/acme"
    request strip 2
  }
}

server "mystaticsite.com" {
  listen on $localhost port $https_redirect_port
  block return 301 "https://mystaticsite.com$DOCUMENT_URI";
}

server "www.mystaticsite.com" {
  listen on $localhost port $https_redirect_port
  block return 301 "https://mystaticsite.com$DOCUMENT_URI";
}

server "mystaticsite.com" {
  listen on * tls port $static_sites_port
  # listen on * tls port 443
  root "/htdocs/mystaticsite"
  tls {
    certificate "/etc/ssl/mystaticsite.crt"
    key "/etc/ssl/private/mystaticsite.key"
  }
}

server "www.mystaticsite.com" {
  listen on * tls port $static_sites_port
  # listen on * tls port 443
  tls {
    certificate "/etc/ssl/mystaticsite.crt"
    key "/etc/ssl/private/mystaticsite.key"
  }
  block return 301 "https://mystaticsite.com$DOCUMENT_URI";
}

--

relayd.conf

localhost="lo0"
ext_ip="em0"

table <acme_challenge_table> { $localhost }
table <https_redirect_table> { $localhost }

acme_challenge_port="4001"
https_redirect_port="4002"

table <static_sites_table> { $localhost }
static_sites_port="8080"

table <myapp_table> { $localhost }
myapp_port="8081"

http protocol "http" {
  pass request quick path "/.well-known/acme-challenge/*" forward to 
<acme_challenge_table>

  pass request header "Host" value "myapp.com" forward to <myapp_table>
  pass request header "Host" value "www.myapp.com" forward to <myapp_table>

  pass request header "Host" value "mystaticsite.com" forward to 
<static_sites_table>
  pass request header "Host" value "www.mystaticsite.com" forward to 
<static_sites_table>
}

http protocol "https" {
  block

  pass request header "Host" value "myapp.com" forward to <myapp_table>
  pass request header "Host" value "www.myapp.com" forward to <myapp_table>
  tls keypair "myapp"

  pass request header "Host" value "mystaticsite.com" forward to 
<static_sites_table>
  pass request header "Host" value "www.mystaticsite.com" forward to 
<static_sites_table>
}

relay "http" {
  listen on $ext_ip port http

  protocol "http"

  forward to <acme_challenge_table> port $acme_challenge_port
  forward to <https_redirect_table> port $https_redirect_port
  forward to <myapp_table> port $myapp_port
  forward to <static_sites_table> port $static_sites_port
}

relay "https" {
  listen on $ext_ip port https tls

  protocol "https"

  forward to <myapp_table> port $myapp_port
  forward with tls to <static_sites_table> port $static_sites_port
}

--K