47
votes
Accepted
HAProxy to terminate SSL also send SSL to backend server
There's nothing special to do in haproxy.cfg. You simply configure whatever URL rewrites and header manipulations you want within your HAProxy frontend and then redirect traffic to your SSL backend. ...
- 1,602
46
votes
By what criteria do you tune timeouts in HA Proxy config?
Foreword
I've been tuning HAProxy for a while and done a lot of performance testing on it. From 100 HTTP requests/s to 50 000 HTTP requests/s.
The first advice is to enable the statistics page on ...
- 2,859
41
votes
Ordering: 1. nginx 2. varnish 3. haproxy 4. webserver?
Foreword
Update in 2016. Things are evolving, all servers are getting better, they all support SSL and the web is more amazing than ever.
Unless stated, the following is targeted toward ...
- 2,859
32
votes
Accepted
Bind to all interfaces for IPv4 and IPv6 in haproxy
To listen on the same port for IPv6 and IPv4, use this:
bind :::80 v4v6
Admittedly, this was an intuitive guess that appears to have been correct... but rather than just post a "lucky" guess as the ...
- 22.4k
31
votes
HAProxy graceful reload with zero packet loss
Yelp shared a more sophisticated approach based on meticulous testing. The blog article is a deep dive, and well worth the time investment to fully appreciate it.
True Zero Downtime HAProxy Reloads
...
- 433
27
votes
Force HAProxy to lookup DNS for backend server
With the recent release of HAProxy 1.6 there is a solution to your problem. You can now define resolvers and associate these to your backend. IP resolution will then be done at runtime.
resolvers dns
...
- 457
26
votes
Logging entire POST body with HAProxy?
Apparently since version 1.6.0 (October 2015) you can now. There is a new directive:
option http-buffer-request
That you include in the front-end or back-end to give HAProxy access to the body. ...
- 361
26
votes
Configure multiple SSL certificates in Haproxy
No need to concat or specify a list of certificates anymore, just specify a folder:
frontend public
bind *:443 ssl crt /etc/haproxy/ssl/
Note: make sure the folder isn't empty and valid PEM ...
- 390
26
votes
Accepted
HAProxy ACL multiple OR conditions
The test you appear to be wanting to impose is this:
A && !(B || C)
...but that is not logically equivalent to what you've written, which is essentially this...
(A && !B) || (A &...
- 22.4k
25
votes
HAProxy logging to syslog
Very tricky. :-) And here is the trick answer:
Notice the file in /etc/rsyslog.d It says to log haproxy into /var/log/haproxy.log But this will not take effect without restarting rsyslog:
service ...
- 361
21
votes
Accepted
Is it possible to redirect an https connection before SSL is checked using haproxy?
Redirection is done at the HTTP level, i.e. after the SSL connection was established. Since establishing the SSL connection includes validating the certificate it is not possible to bypass the ...
- 12.6k
17
votes
How do I match a wildcard host in ACL lists in HAproxy?
I feel that hdr_sub is better for your needs. I was using hdr_end for a while but it runs into the following problem:
requests with port 80 usually get the port stripped so the host header looks like ...
- 171
17
votes
Accepted
How does HTTPS certificate switching work (like on suche.org)?
I'm quite sure that they're checking the client capabilities and act accordingly, as explained in the thread linked to in the answer of @Jeff.
To get an idea how this could look like in detail, have ...
- 5,541
17
votes
Accepted
Blocking IPs in HAProxy
Thanks to a comment by EEAA, I was able to solve this using fail2ban.
There's very little documentation about how to use fail2ban with HAProxy, however - so little in fact that this page is already ...
- 351
16
votes
How do I match a wildcard host in ACL lists in HAproxy?
There are cases where you need to be explicit about this, such as handling redirects for wildcard SSL with multiple levels of subdomains.
Matching end (hdr_end or -m end) or substring (hdr_sub or -m ...
- 1,529
16
votes
Accepted
What are the Differences between HAProxy and Ngnix in reverse proxy mode?
2019 update:
They are both stable and mature products. HAProxy is dedicated to load balancing and is better at that, whereas nginx is a webserver that can act as a load balancer.
Both:
HTTPS ...
- 2,859
16
votes
Accepted
HAProxy: Redirect Root Site Root to Subsite
nlu is almost there, but the is_root ACL is a little bit off.
Using path_beg will lead to any and all paths being matched, when really you only want to redirect requests with an empty path.
Try ...
- 9,270
16
votes
Is it possible to use multiple load balancers to redirect traffic to my application servers?
Using round robin DNS is not that great for high availability - if one server goes offline, clients will still try to connect to it and wait for a timeout.
There are other ways to achieve this.
1) ...
- 17.5k
16
votes
haproxy: how to prepare a server maintenance without kicking app sessions?
If you use socat for communicate with your haproxy configurations, you can put a server in drain state of following way:
echo "set server backend/serv state drain" | sudo socat stdio /etc/haproxy/...
- 293
15
votes
Serve 404 from HAProxy when no acls match
If you would be okay with any of the following response codes: 200, 400, 403, 405, 408, 429, 500, 502, 503, or 504.
Then you could do something like this:
frontend www
...
default_backend no-match
...
- 151
15
votes
Accepted
Load Balancing DNS Servers: UDP / TCP
Don't load balance your DNS.
It's an incredibly light protocol - you'd need an enormous amount of traffic to need more than one box (in which case you'll just be bottlenecking on your load balancer ...
- 114k
15
votes
Accepted
HAProxy - how to append client ip in X-Client-IP and X-Forwarded-For headers?
You can try setting up custom header, like this:
http-request set-header X-Client-IP %[src]
Or, you can even copy it from X-Forwarded-For header, I think syntax would go something like:
http-...
- 5,257
15
votes
Accepted
Configure HAProxy to include host headers for different backends
I'm not sure if the following will work, and can't test right now, but maybe this is still helpful. (I'll have a look again later with some more time):
Solution 1:
backend nodes
mode http
...
- 5,541
14
votes
How to keep haproxy log messages out of /var/log/syslog
The use of & ~ was deprecated in v7 of rsyslogd, and you're encouraged to use & stop instead. You can read more about it in this section of the v7compatibility page.
omruleset and discard (~...
- 7,515
14
votes
nginx access logs ignore certain requests
You can now do this
http://nginx.org/en/docs/http/ngx_http_log_module.html
The if parameter (1.7.0) enables conditional logging. A request will not be logged if the condition evaluates to “0” or ...
- 918
14
votes
Accepted
HAProxy: multiple frontends, same bind
No, you can't do this and expect sensible behavior.
The requests for port 80 will arrive seemingly randomly at one front end or the other. The result of such a configuration is undefined, and ...
- 22.4k
13
votes
Accepted
Hostnames in HAProxy configuration file
In haproxy >= 1.7, you should be able to use the init-addr option, specifying none to prevent DNS resolution at startup.
From the docs:
init-addr {last | libc | none | <ip>},[...]*
Indicate ...
- 146
13
votes
Accepted
HAProxy with SNI and different SSL Settings
I found a solution to this problem, that doesn't require additional servers or services.
I'm not entirely sure if this doesn't spawn new problems though. For me it seems to work right now.
The way I ...
- 645
12
votes
HAProxy logging to syslog
The default haproxy.conf file provides clear instructions under the Global settings - global. Here i am copy pasting it for you -
#---------------------------------------------------------------------...
- 9,176
12
votes
Accepted
Haproxy setup with subdomain setup
With TCP mode, HAProxy won't decode the HTTP request, so your acl lines won't do anything and the frontend will never be able to match a backend, as shown by the logs you entered: mytraffic/<NOSRV&...
- 9,270
Only top scored, non community-wiki answers of a minimum length are eligible