Skip to content

Instantly share code, notes, and snippets.

Created June 13, 2019 20:41
Show Gist options
  • Save haproxytechblog/dc5c3b5e2801d36b79e00f07b2309c14 to your computer and use it in GitHub Desktop.
Save haproxytechblog/dc5c3b5e2801d36b79e00f07b2309c14 to your computer and use it in GitHub Desktop.
HAProxy 2.0 configuration
# This is the ultimate HAProxy 2.0 "Getting Started" config
# It demonstrates many of the features available which are now available
# While you may not need all of these things, this can serve
# as a reference for your own configurations.
# Have questions? Check out our community Slack:
# master-worker required for `program` section
# enable here or start with -Ws
mworker-max-reloads 3
# enable core dumps
user haproxy
group haproxy
log stdout local0
stats socket level admin expose-fd listeners
tune.ssl.default-dh-param 2048
ssl-default-bind-options no-sslv3 no-tls-tickets
ssl-default-server-options no-sslv3 no-tls-tickets
mode http
log global
timeout client 5s
timeout server 5s
timeout connect 5s
option redispatch
option httplog
program dataplane-api
command /usr/sbin/haproxy-dataplaneapi --host --port 5555 --haproxy-bin /usr/sbin/haproxy --config-file /etc/haproxy/haproxy.cfg --reload-cmd "systemctl reload haproxy" --reload-delay 5 --userlist api
program spoa-mirror
command /usr/sbin/spoa-mirror -r0 -u""
peers mypeers
bind :10001 ssl crt /etc/haproxy/certs/
default-server ssl verify none
server PC #local peer. name must match local server name
table src_tracking type string size 10m store http_req_rate(10s),http_req_cnt
resolvers dns
resolve_retries 3
timeout resolve 1s
timeout retry 1s
hold other 30s
hold refused 30s
hold nx 30s
hold timeout 30s
hold valid 10s
hold obsolete 30s
userlist api
user admin password $5$aVnIFECJ$2QYP64eTTXZ1grSjwwdoQxK/AP8kcOflEO1Q5fc.5aA
frontend stats
bind *:8404
# Enable Prometheus Exporter
http-request use-service prometheus-exporter if { path /metrics }
stats enable
stats uri /stats
stats refresh 10s
frontend fe_main
bind :80
bind :443 tfo ssl crt /etc/haproxy/certs/ alpn h2,http/1.1
# Enable log sampling
# One out of 10 requests would be logged to this source
log sample 1:10 local0
# For every 11 requests, log requests 2, 3, and 8-11
log sample 2-3,8-11:11 local0
# Log profiling data
log-format "%ci:%cp [%tr] %ft %b/%s %TR/%Tw/%Tc/%Tr/%Ta %ST %B %CC %CS %tsc %ac/%fc/%bc/%sc/%rc %sq/%bq %hr %hs %{+Q}r cpu_calls:%[cpu_calls] cpu_ns_tot:%[cpu_ns_tot] cpu_ns_avg:%[cpu_ns_avg] lat_ns_tot:%[lat_ns_tot] lat_ns_avg:%[lat_ns_avg]"
# gRPC path matching
acl is_grpc_codename path /CodenameCreator/KeepGettingCodenames
# Dynamic 'do-resolve' trusted hosts
acl dynamic_hosts req.hdr(Host) api.local admin.local
# Activate Traffic Mirror
filter spoe engine traffic-mirror config mirror.cfg
# Redirect if not SSL
http-request redirect scheme https unless { ssl_fc }
# Enable src tracking
http-request track-sc0 src table mypeers/src_tracking
# Enable rate limiting
# Return 429 Too Many Requests if client averages more than
# 10 requests in 10 seconds.
# (duration defined in stick table in peers section)
http-request deny deny_status 429 if { sc_http_req_rate(0) gt 10 }
# Enable local resolving of Host if within dynamic_hosts ACL
# Allows connecting to dynamic IP address specified in Host header
# Useful for DNS split view or split horizon
http-request do-resolve(txn.dstip,dns) hdr(Host),lower if dynamic_hosts
http-request capture var(txn.dstip) len 40 if dynamic_hosts
# return 503 when dynamic_hosts matches but the variable
# txn.dstip is not set which mean DNS resolution error
# otherwise route to be_dynamic
use_backend be_503 if dynamic_hosts !{ var(txn.dstip) -m found }
use_backend be_dynamic if dynamic_hosts
# route to gRPC path
use_backend be_grpc if is_grpc_codename
default_backend be_main
backend be_main
default-server ssl verify none alpn h2 check maxconn 50
# Enable Power of Two Random Choices Algorithm
balance random(2)
# Enable Layer 7 retries
retry-on all-retryable-errors
retries 3
# retrying POST requests can be dangerous
# make sure you understand the implications before removing
http-request disable-l7-retry if METH_POST
server server1 tfo
server server2 tfo
server server3 tfo
server server4 tfo
server server5 tfo
backend be_grpc
default-server ssl verify none alpn h2 check maxconn 50
server grpc1
server grpc2
backend be_dynamic
default-server ssl verify none check maxconn 50
# rule to prevent HAProxy from reconnecting to services
# on the local network (forged DNS name used to scan the network)
http-request deny if { var(txn.dstip) -m ip }
http-request set-dst var(txn.dstip)
server dynamic
backend spoe-traffic-mirror
mode tcp
balance roundrobin
timeout connect 5s
timeout server 1m
server spoa1
server spoa2
backend be_503
# dummy backend used to return 503.
# You can use the 'errorfile' directive to send a nice
# 503 error page to end users.
errorfile 503 /etc/haproxy/errorfiles/503sorry.http
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment