48 votes

By what criteria do you tune timeouts in HA Proxy config?

Foreword I've been tuning HAProxy for a while and done a lot of performance testing on it. From 100 HTTP requests/s to 50 000 HTTP requests/s. The first advice is to enable the statistics page on ...
user5994461's user avatar
  • 3,029
41 votes

Ordering: 1. nginx 2. varnish 3. haproxy 4. webserver?

Foreword Update in 2016. Things are evolving, all servers are getting better, they all support SSL and the web is more amazing than ever. Unless stated, the following is targeted toward ...
user5994461's user avatar
  • 3,029
31 votes

Configure multiple SSL certificates in Haproxy

No need to concat or specify a list of certificates anymore, just specify a folder: frontend public bind *:443 ssl crt /etc/haproxy/ssl/ Note: make sure the folder isn't empty and valid PEM ...
Tim's user avatar
  • 440
27 votes
Accepted

HAProxy ACL multiple OR conditions

The test you appear to be wanting to impose is this: A && !(B || C) ...but that is not logically equivalent to what you've written, which is essentially this... (A && !B) || (A &...
Michael - sqlbot's user avatar
21 votes
Accepted

Is it possible to redirect an https connection before SSL is checked using haproxy?

Redirection is done at the HTTP level, i.e. after the SSL connection was established. Since establishing the SSL connection includes validating the certificate it is not possible to bypass the ...
Steffen Ullrich's user avatar
20 votes
Accepted

Blocking IPs in HAProxy

Thanks to a comment by EEAA, I was able to solve this using fail2ban. There's very little documentation about how to use fail2ban with HAProxy, however - so little in fact that this page is already ...
Grim...'s user avatar
  • 391
18 votes

How do I match a wildcard host in ACL lists in HAproxy?

There are cases where you need to be explicit about this, such as handling redirects for wildcard SSL with multiple levels of subdomains. Matching end (hdr_end or -m end) or substring (hdr_sub or -m ...
gregmac's user avatar
  • 1,609
17 votes
Accepted

What are the Differences between HAProxy and Ngnix in reverse proxy mode?

2019 update: They are both stable and mature products. HAProxy is dedicated to load balancing and is better at that, whereas nginx is a webserver that can act as a load balancer. Both: HTTPS ...
user5994461's user avatar
  • 3,029
17 votes
Accepted

How does HTTPS certificate switching work (like on suche.org)?

I'm quite sure that they're checking the client capabilities and act accordingly, as explained in the thread linked to in the answer of @Jeff. To get an idea how this could look like in detail, have ...
gxx's user avatar
  • 5,651
17 votes
Accepted

Configure HAProxy to include host headers for different backends

I'm not sure if the following will work, and can't test right now, but maybe this is still helpful. (I'll have a look again later with some more time): Solution 1: backend nodes mode http ...
gxx's user avatar
  • 5,651
16 votes

Serve 404 from HAProxy when no acls match

If you would be okay with any of the following response codes: 200, 400, 403, 405, 408, 429, 500, 502, 503, or 504. Then you could do something like this: frontend www ... default_backend no-match ...
rbjorklin's user avatar
  • 161
16 votes

haproxy: how to prepare a server maintenance without kicking app sessions?

If you use socat for communicate with your haproxy configurations, you can put a server in drain state of following way: echo "set server backend/serv state drain" | sudo socat stdio /etc/haproxy/...
Jhonatan Alarcon's user avatar
15 votes
Accepted

HAProxy: multiple frontends, same bind

No, you can't do this and expect sensible behavior. The requests for port 80 will arrive seemingly randomly at one front end or the other. The result of such a configuration is undefined, and ...
Michael - sqlbot's user avatar
13 votes
Accepted

Hostnames in HAProxy configuration file

In haproxy >= 1.7, you should be able to use the init-addr option, specifying none to prevent DNS resolution at startup. From the docs: init-addr {last | libc | none | <ip>},[...]* Indicate ...
Bharat's user avatar
  • 146
12 votes

HA Proxy - roundrobin vs leastconn

It depends on what's the protocol and the use case to balance. For anything where the amount of connections is correlated with the load/usage, it's better to use leastconn. Because of the way networks ...
user5994461's user avatar
  • 3,029
12 votes

Bind to all interfaces for IPv4 and IPv6 in haproxy

The accepted answer does not work for me, at least with haproxy-1.6.11p0 on OpenBSD. Also, TL;DR. Just do: bind 0.0.0.0:80 bind :::80 and it will work: # netstat -an|grep "*.80" tcp 0 ...
foobar's user avatar
  • 121
12 votes
Accepted

Haproxy change part of url

With HAProxy 1.5 : use a temporary header to build a new path from the existing one in the request and then directly perform a redirect # Clean the request and remove any existing header named X-...
Flint's user avatar
  • 307
11 votes

could not bind socket while haproxy restart

On RedHat Linux with enabled SELinux (which should be enabled), just enable the haproxy_connect_any boolean value, which allows haproxy to connect the socket to any port: setsebool -P ...
Adi Barone's user avatar
11 votes

Configure multiple SSL certificates in Haproxy

maybe you could check this too: /etc/ssl/private/crt-list.txt: /etc/ssl/private/mydomain.pem /etc/ssl/private/myotherdomain.pem haproxy.cfg: frontend https-in: bind *:443 ssl crt-list /etc/ssl/...
zx1986's user avatar
  • 211
11 votes
Accepted

HAproxy 1.5 Trusted CAs

I recently hit this issue in 1.5.6 where I was receiving the error message verify is enabled by default but no CA file specified. If you're running on a LAN where you're certain to trust the server's ...
Michael Lapping's user avatar
11 votes

Haproxy not logging requests?

This link explains it perfectly. If you look at the top of /etc/haproxy/haproxy.cfg, you will see something like: global log 127.0.0.1 local2 [...] This means that ...
carla's user avatar
  • 337
11 votes

HAProxy 1.7 Statistics Setup

You're correct about older versions. Binding to a port on the line where the proxy (frontend or listen) declaration begins has not been valid since it was removed in HAProxy 1.5. This is the correct ...
Michael - sqlbot's user avatar
11 votes
Accepted

How to add response headers with HAproxy 1.6 based on request URI?

Try this: http-response set-header Cache-Control no-cache,\ max-age=600 if { capture.req.uri -m beg /api/ } capture.req.uri persists until the response is processed, unlike path, which does not. A ...
Michael - sqlbot's user avatar
10 votes

HAProxy returns Bad Request (Invalid Host) for seemingly no reason

I faced the same issue and took me a while to figure out why this was happening. My environment is formed by 1 HAproxy and 2 nginx as a backend with nodejs as a CGI-like. The root cause is based on ...
Antoniet's user avatar
  • 101
10 votes

How to configure HAProxy for multiple SSL-Certificates

Ensure that you're running HAProxy 1.6 or higher This question is a little old, but I ran into this exact same issue with configurations similar to the OP. HAProxy 1.5 accepts the multiple crt ...
davidzarlengo's user avatar
10 votes
Accepted

Import configuration files in haproxy.cfg

As far as I know HAproxy does not have anything similar to apache's Include & IncludeOptional directives. There is no native support for multiple configuration files other than starting HAproxy ...
HBruijn's user avatar
  • 80.3k
10 votes
Accepted

Send PROXY protocol header from HAProxy

After posting on the HAProxy mailing list ([email protected]) I got the answer that I need to add either send-proxy or send-proxy-v2 to my backend server definitions. My updated config file has ...
Wad's user avatar
  • 241
10 votes

Haproxy TLS configuration

Try: global log 127.0.0.1 local0 debug ssl-default-bind-options no-sslv3 tune.ssl.default-dh-param 2048
Tommiie's user avatar
  • 5,677
9 votes

Haproxy not logging requests?

the logging via unix socket log does not work for me on my rhel 6.7.you can have a try with this conf. haproxy (working on 81) forward http request to httpd (working on 80) /etc/haproxy/haproxy.cfg ...
ncowboy's user avatar
  • 226
9 votes
Accepted

Making HAProxy Pass a Host Name in HTTPCHECK

You might need to escape the space before "example.com", i.e. option httpchk HEAD / HTTP/1.1\r\nHost:\ example.com Note the backslash before "example.com". Alternatively, you might try adding: http-...
Castaglia's user avatar
  • 3,379

Only top scored, non community-wiki answers of a minimum length are eligible