safe haproxy reload

safe_reset_haproxy.sh

#!/bin/bash
# This checks which ports haproxy currently is listening on, temporarily drops SYN packets
# to prevent new connections, reloads haproxy, then allows SYNs again.
#
# Based on info from here:
#  * https://github.com/aws/opsworks-cookbooks/pull/40
#  * http://www.mail-archive.com/haproxy@formilux.org/msg06885.html

#set -x

haports=`netstat -antp | grep LISTEN | grep haproxy | awk '{print $4}' | cut -d':' -f2 | sort -un`

for i in $haports; do
  iptables -I INPUT -p tcp --dport $i --syn -j DROP
done

sleep 1
service haproxy reload

for i in $haports; do
  iptables -D INPUT -p tcp --dport $i --syn -j DROP
done