0

I know that I can reload haproxy from a shell command (I use service haproxy reload).

I also am using the stats socket to enable and disable servers when doing maintenance on them. I also have worked with the stats webserver, although it's disabled at the moment.

Is it possible to use the stats socket to force a reload, too? (The use case is to let a person without admin privs on the server add a new https certificate to the network folder where I am storing them, and use reload to make sure haproxy sees it.)

My config, sanitized:

global
        log /dev/log    local0
        log /dev/log    local1 notice
        chroot /var/lib/haproxy
        stats socket /run/haproxy/admin.sock mode 660 level admin
        stats socket [email protected]:9999 level admin
        stats timeout 30s
        user haproxy
        group haproxy
        tune.ssl.default-dh-param 2048
        daemon

        # Default SSL material locations
        ca-base /etc/ssl/certs
        crt-base /etc/ssl/private

        # Default ciphers to use on SSL-enabled listening sockets.
        # For more information, see ciphers(1SSL). This list is from:
        #  https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
        # ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
        ssl-default-bind-ciphers ECDHE+aRSA+AES256+GCM+SHA384:ECDHE+aRSA+AES128+GCM+SHA256:ECDHE+aRSA+AES256+SHA384:ECDHE+aRSA+AES128+SHA256:ECDHE+aRSA+RC4+SHA:ECDHE+aRSA+AES256+SHA:ECDHE+aRSA+AES128+SHA:AES256+GCM+SHA384:AES128+GCM+SHA256:AES128+SHA256:AES256+SHA256:DHE+aRSA+AES128+SHA:RC4+SHA:HIGH:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS
        ssl-default-bind-options no-sslv3

defaults
        log     global
        mode    http
        option  httplog
        option  dontlognull
        timeout connect 50000
        timeout client  500000
        timeout server  500000
        errorfile 400 /etc/haproxy/errors/400.http
        errorfile 403 /etc/haproxy/errors/403.http
        errorfile 408 /etc/haproxy/errors/408.http
        errorfile 500 /etc/haproxy/errors/500.http
        errorfile 502 /etc/haproxy/errors/502.http
        errorfile 503 /etc/haproxy/errors/503.http
        errorfile 504 /etc/haproxy/errors/504.http

frontend http-in
        acl host_onedomain hdr(host) -i -m end onedomain.com
        ;;; additional, similar domain acls omitted
        acl ip_172_16_55_96 dst 172.16.55.96

        http-request set-header HTTPS ON if { ssl_fc }

        bind *:80
        bind *:443 ssl crt /media/windowsshare/winserver/ssl/pem/
        use_backend staging if host_staging
        use_backend production if host_production
        default_backend staging

backend staging
        server SERVER1 172.16.55.91:82 maxconn 64
        server SERVER2 172.16.55.92:82 maxconn 64

backend production
        server SERVER1 172.16.55.91:81 maxconn 64
        server SERVER2 172.16.55.92:80 maxconn 64


listen stats *:1936
        stats enable
        stats uri /
        stats hide-version
        stats auth sysadmin:password
        stats admin if TRUE
Improve this question

1 Answer 1

Reset to default
2

In a word, no.

You can't reload the whole process from the socket, and all details about using the admin sockets are listed under section 9.2 Unix Socket commands of the management docs.

Improve this answer
2
  • 1
    This makes sense, considering that "reloading" HAProxy actually starts a new haproxy process which then tells the old process to hand over control of the listening sockets and shut itself down once its existing sessions finish.
    – Michael - sqlbot
    Nov 26, 2015 at 1:48
  • 1
    My final solution was to add a crontab entry that checks the folder's last modified date against /run/haproxy.pid. If the folder is newer, it reloads haproxy. This achieves the effect that I needed.
    – Ross Presser
    Nov 30, 2015 at 21:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .