Tag Info

Hot answers tagged

2

Yes, the server response is returned through the same communication channel, plain HTTP (webserver -> haproxy) and HTTPS (haproxy -> client).


1

Can't do wildcards AFAIK, but you can just match the tail of the address, which should do the same thing: acl match_tail_example hdr_end(host) -i .demo.site.net


1

HaProxy dynamically links in the openssl libraries. You can find this by running # ldd `which haproxy` | grep ssl libssl.so.10 => /usr/lib64/libssl.so.10 (0x0000003ea3c00000) So when you upgrade openssl you just need to restart haproxy.


1

I have been dealing with a similar issue at work recently. I found these pretty helpful: http://grokconstructor.appspot.com/do/match#result https://grokdebug.herokuapp.com/ I ended up with a generic pattern line like this: pattern => "%{IP:client_ip}:%{INT:client_port} \[%{HAPROXYDATE:accept_date}\] %{NOTSPACE:frontend_name} ...


1

This is usually accomplished by combining HAproxy with keepalived. HAproxy handles the load balancing, keepalived handles the HA failover. To clarify, only one HAproxy instance is active at a time, but if the primary node fails, the other takes over.


1

Am I correct in assuming that SNI is essentially globally supported now? Essentially, yes - though you'll likely run into some edge case users who will complain about brokenness if SNI is required. If you have the capability to tell those people "use a browser from this decade, please" for your service, then you're set. Are there scenarios that I ...


1

Am I correct in assuming that SNI is essentially globally supported now? If you consider browsers - yes. If you have to deal with other kind of applications - not really: Python 3 has support, but Python 2.7. got only support with the just released version 2.7.9 Android has limited support. The HTTPUrlConnection had support for a long time, but the ...


1

I figured it out. Not sure how I missed this, but the variable is "dst". So the resulting config would look like this: frontend localhost bind *:80 bind *:443 ssl crt /etc/ssl/ssl.pem mode http default_backend nodes option forwardfor backend nodes mode http balance roundrobin http-request add-header X-FrontEnd-IP %[dst] ...



Only top voted, non community-wiki answers of a minimum length are eligible