haproxy

What it does

How to write it

haproxy -c -f /etc/haproxy/haproxy.cfg
systemctl {reload|status} haproxy

Main parts

Config sections

global

Process settings: logging, user, max connections, TLS defaults.

defaults

Default timeouts and mode for the sections below.

frontend NAME

Listen address and port, rules (ACLs) that choose a backend.

backend NAME

The servers, the balance algorithm, health checks.

listen NAME

Frontend and backend in one section (stats page, simple TCP).

Most used

Nothing matches this filter.

$ run as a normal user# run as root (or with sudo)

1. 1Check the config and reload

   #haproxy -c -f /etc/haproxy/haproxy.cfg
   Configuration file is valid
   #systemctl reload haproxy

2. 2Balance HTTP over three web servers

   #cat /etc/haproxy/haproxy.cfg
   frontend web
       bind :80
       default_backend app
   backend app
       balance roundrobin
       option httpchk GET /health
       server web1 10.30.1.11:8080 check
       server web2 10.30.1.12:8080 check
       server web3 10.30.1.13:8080 check backup

3. 3End TLS and redirect HTTP to HTTPS

   #cat /etc/haproxy/conf.d/tls.cfg
   frontend https
       bind :443 ssl crt /etc/haproxy/certs/shop.pem alpn h2,http/1.1
       bind :80
       http-request redirect scheme https unless { ssl_fc }
       http-response set-header Strict-Transport-Security "max-age=31536000"
       default_backend app

4. 4Route by host name

   #cat /etc/haproxy/conf.d/routes.cfg
   frontend web
       bind :80
       acl is_api hdr(host) -i api.example.com
       use_backend api if is_api
       default_backend app

5. 5Load-balance the Kubernetes API (TCP)

   #cat /etc/haproxy/conf.d/k8s.cfg
   frontend k8s-api
       bind :6443
       mode tcp
       default_backend k8s-cp
   backend k8s-cp
       mode tcp
       balance roundrobin
       option tcp-check
       server cp1 192.168.122.11:6443 check
       server cp2 192.168.122.12:6443 check
       server cp3 192.168.122.13:6443 check

6. 6Turn on the statistics page

   #cat /etc/haproxy/conf.d/stats.cfg
   listen stats
       bind 127.0.0.1:8404
       stats enable
       stats uri /stats
       stats refresh 10s
   $curl -s http://127.0.0.1:8404/stats | head

7. 7Limit requests per client

   #cat /etc/haproxy/conf.d/ratelimit.cfg
   frontend web
       stick-table type ip size 100k expire 30s store http_req_rate(10s)
       http-request track-sc0 src
       http-request deny deny_status 429 if { sc_http_req_rate(0) gt 50 }

8. 8Drain a server for maintenance through the runtime API

   #echo "set server app/web1 state drain" | socat stdio /run/haproxy/admin.sock
   #echo "show servers state" | socat stdio /run/haproxy/admin.sock

9. 9Allow HAProxy to connect to any port with SELinux

   #setsebool -P haproxy_connect_any on

10. 10Read the logs

    #journalctl -u haproxy -n 50

Nothing matches this filter.

Files

/etc/haproxy/haproxy.cfg

Main configuration.

/etc/haproxy/conf.d/

Extra config files (RHEL loads them with the service).

/run/haproxy/admin.sock

Runtime API socket (if configured).

Exit codes