I recently had the need to allow access to an on-premise Azure Devops Server instance over the internet. This had been attempted in the past using apache as the reverse proxy but due to ADS using NTLM Authentication ADS (or TFS as it was at the time) would constantly prompt for credentials without really getting anywhere. After a bit of research it looked like HAProxy might help with this so I decided to spin up a lab environment in Azure to test it out.
Before we start I would heavily suggest you don’t just reverse proxy ADS, ADS provides no 2 factor authentication capabilities so you’re going to be opening yourself up to credential stuffing and a whole host of other attacks by making it publicly accessible. Instead you probably want to be looking at migrating to Azure DevOps.
This tutorial assumes you already have Azure DevOps Server installed and configured.
There isn’t really a great deal to this so the first thing to do is create yourself a HAProxy server, I used Ubuntu 18.04 and then installed HAProxy.
sudo apt-get install haproxy
Now lets open up the HAProxy config file using nano and get to work!
sudo nano /etc/haproxy/haproxy.cfg
Below the defaults we need to add a backend to tell HAProxy where to send our traffic.
backend backend_tfs server static adsip:80 check maxconn 3 mode http balance roundrobin option http-keep-alive option prefer-last-server timeout server 30s timeout connect 4s
Substitute ‘adsip’ with your internal ADS/TFS IP address. Now let’s declare the frontend.
frontend frontend_tfs bind :80 name frontend_tfs mode http option http-keep-alive timeout client 30s default_backend backend_tfs
The options which are doing the magic here are http-keep-alive and prefer-last-server. Save, exit and reload HAProxy and you’re all done!
sudo service haproxy restart
If you want to try this for yourself in Azure here is a resource template which will create vm’s for a domain controller, ads instance and HAProxy. The template also includes a vm for apache in case you want to see what happens when you try and use apache as the reverse proxy.