We've added a self signed cert to our haproxy server which passes traffic on to our search head cluster. After doing so, I changed the following on web.conf
[settings]
tools.proxy.on = true
tools.proxy.base = https://internalhost.local
Now when trying to visit https://internalhost.local it properly maintains https and redirects to https://internalhost.local/en-US, which then redirects to https://127.0.0.1:8000.
I can't seem to find any configuration value in my web or server settings that calls out 127.0.01 which puts me at a loss for what to adjust.
haproxy works fantastic with Splunk. But you should not need to make any changes to Splunk configs. I've found that routing to a SHC via haproxy, the most important config is to configure sticky sessions on haproxy. The SHC does not seem to react well to round-robin via haproxy (probably because of search artifact replication/destination).
Instead use "balance source"
Take off your Splunk settings and configure haproxy as such (partial example):
listen splunk_search_heads
bind *:443 ssl crt /etc/haproxy/name_of_your_pem_file_here.pem
bind :80
mode tcp
balance source
server shc01 xxx.xxx.xxx.31:8000 weight 1 maxconn 2000 check port 8000 ssl verify none
server shc02 xxx.xxx.xxx.32:8000 weight 1 maxconn 2000 check port 8000 ssl verify none
server shc03 xxx.xxx.xxx.33:8000 weight 1 maxconn 2000 check port 8000 ssl verify none
Worth noting, in haproxy configs not shown in this partial example, I have all traffic redirected to 443, so the bind :80 is still secure.
Did this help resolve your issue? If so, please "accept" the answer so that it may benefit the community.