Hot answers tagged

2

You can use haproxy to load balance SSL connections to multiple backend servers, so the backend servers terminate SSL instead of haproxy. The only trick is to enable Proxy Protocol on both haproxy and your backend servers, so the user's real IP address is preserved. For example, if you have two nginx app servers 10.0.0.11 and 10.0.0.12 and one haproxy load ...


2

See the SC-- in the log entry? This is a problem with your back-end server, or a network issue between HAProxy and the back-end... not on the front side, and not related to the IP address of the connecting client. From "Session state at disconnect" in the docs: SC The [back-end] server or an equipment between it and haproxy explicitly refused ...


1

The nbsrv(<back-end>) internal state fetch can be used to evaluate whether the MySQL Server is alive, just as you are using it now to count available servers in the main group. The simplest solution is to create a dummy back-end with no servers. backend dead-end Then, in the front-end config, set the following before any other use_backend ...


1

From my understanding of what you're asking, you have control over all the steps of this process and want to bring up new versions of a containerized application which sit behind HAProxy without interrupting client connections to the old applications, but preventing new connections. This seems like a good use of the HAProxy disable server command. You ...


1

You can modify the health check settings using this (for exemple): option httpchk HEAD /alive.html It's a simple html file (in the default vhost for apache if you use apache) using by haproxy for checking the health of a node. If you want to set a node at the down state when you add it, just move out this file.


1

tldr; It doesn't. Use NGinX. Meanwhile I got an answer from the Haproxy mailing list. Thanks, Holger Just for the reply. (Meta: I wasn't even sure the mailing list is still functional because I got errors back when posting to the list.) If I had read the documentation carefully perhaps this sentence wouldn't have slipped my attention: This option ...


1

There is no difference in haproxy configuration. If you're having problems with being behind a firewall, then the issue is likely with your firewall. Specifically in your case, I bet it's a problem with either your NAT rules or your firewall doesn't allow internal users to access resources via the external IP.


1

The normal way to handle multi-site fail over is to have a pair of load balancers on site A in a master/slave fail over config. Then put an identical pair on the remote site. If ALL the backend servers on site A fail then use the public VIP on site B as the fallback (high latencey of course across the WAN)... But back this up with a proper DNS based load ...


1

Not sure which version you're running, but, just as a note: AFAIK, the block directive is deprecated. Using this, gives you: The 'block' directive is now deprecated in favor of 'http-request deny' which uses the exact same syntax. The rules are translated but support might disappear in a future version. It still works, but it might get removed in the ...


1

don't use the wrong tool haproxy is a wonderful tool. It does not provide caching. A quick scan of the fine docs can verify this. Unless you want to patch haproxy you need to use a tool that does what you're looking to do. don't create impossible problems By asking for haproxy to do something that it doesn't and excluding the tool that seems to do what ...


1

There are several approaches to scenarios involving multiple web/app servers/load balancers. You can read about some of them in the Official Let's Encrypt Integration Guide for larger environments. There are some neat ways of doing it, like: redirecting all validation requests to a single validation host/host pool doing all certificate management off-line ...



Only top voted, non community-wiki answers of a minimum length are eligible