25 lines
10 KiB
JSON
25 lines
10 KiB
JSON
{
|
||
"schema_version": 1,
|
||
"saved_at": "2026-08-07T10:55:05.2846127Z",
|
||
"content_sha256": "c8f00a2d47a151322414129853effc176b62542eae17cc5a55d1c2950541d333",
|
||
"result": {
|
||
"title": "HAProxy Configuration | linux-server-admin.com",
|
||
"url": "https://wiki.linux-server-admin.com/software/webserver/haproxy/configuration",
|
||
"snippet": "¶ Detailed Configuration Examples ¶ Basic HTTP Load Balancer ... ¶ HTTPS Load Balancer with SSL Termination ... ¶ Advanced Configuration with Rate Limiting and Security ... ¶ Monitoring and Metrics Configuration ¶ Statistics Page Configuration ... ¶ Prometheus Integration For Prometheus monitoring, HAProxy can expose metrics at /metrics ...",
|
||
"content": "HAProxy Configuration | linux-server-admin.com\n\n¶ HAProxy Configuration\n\n¶ Configuration File\n\nDefault file: /etc/haproxy/haproxy.cfg\n\nValidation: Always validate configuration before applying: haproxy -c -f /etc/haproxy/haproxy.cfg\n\nSyntax highlighting: Many editors support HAProxy configuration syntax highlighting\n\n¶ Configuration Sections\n\n¶ Global Section\n\nContains process-wide settings:\n\nProcess management and security\n\nPerformance tuning parameters\n\nDebugging options\n\nSSL/TLS default settings\n\n¶ Defaults Section\n\nSets default parameters for all subsequent proxies:\n\nMode (http, tcp, health)\n\nTimeouts\n\nLogging options\n\nRetries and redispatch settings\n\n¶ Frontend Section\n\nDefines how HAProxy receives traffic:\n\nIP addresses and ports to bind to\n\nSSL/TLS settings\n\nACLs and request processing rules\n\n¶ Backend Section\n\nDefines backend servers:\n\nLoad balancing algorithm\n\nServer definitions with health checks\n\nConnection pooling settings\n\n¶ Listen Section\n\nCombines frontend and backend in a single section\n\n¶ Minimal Example\n\nglobal\nlog /dev/log local0\nmaxconn 4000\nuser haproxy\ngroup haproxy\n\ndefaults\nmode http\nlog global\noption httplog\noption dontlognull\ntimeout connect 5s\ntimeout client 30s\ntimeout server 30s\nretries 3\n\nfrontend http_front\nbind *:80\ndefault_backend web_servers\n\nbackend web_servers\nbalance random(2) # Default algorithm in HAProxy 3.3+\nserver web1 127.0.0.1:8080 check\nserver web2 127.0.0.1:8081 check\n\n¶ Advanced Configuration Options\n\n¶ SSL/TLS Termination\n\nfrontend https_front\nbind *:443 ssl crt /path/to/certificate.pem\nmode http\ndefault_backend web_servers\n\n¶ Health Checks\n\nbackend web_servers\noption httpchk GET /health\nserver web1 10.0.0.10:80 check\nserver web2 10.0.0.11:80 check inter 2000 rise 2 fall 3\n\n¶ ACLs and Content Switching\n\nfrontend http_front\nbind *:80\n\nacl path_api path_beg /api\nacl path_static path_beg /static /images /css /js\n\nuse_backend api_servers if path_api\nuse_backend static_servers if path_static\ndefault_backend app_servers\n\n¶ Rate Limiting\n\n# Define stick table\nstick-table type ip size 1m expire 5m store gpc0,http_req_rate(10s)\n\nfrontend http_front\nbind *:80\n\n# Track requests and limit rate\nhttp-request track-sc0 src\nhttp-request deny if { sc0_http_req_rate gt 10 }\n\n¶ Reload HAProxy\n\n# Graceful reload (preserves existing connections)\nsudo systemctl reload haproxy\n\n# Or using the binary directly\nsudo haproxy -f /etc/haproxy/haproxy.cfg -sf $(pidof haproxy)\n\n¶ Configuration Best Practices\n\nValidation : Always validate configuration before applying changes\n\nBackup : Keep backups of working configurations\n\nTesting : Test configuration changes in a staging environment first\n\nDocumentation : Comment important configuration sections\n\nModularity : Consider using include statements for large configurations\n\nSecurity : Regularly audit configurations for security best practices\n\n¶ Detailed Configuration Examples\n\n¶ Basic HTTP Load Balancer\n\nglobal\nlog /dev/log local0\nmaxconn 4000\nuser haproxy\ngroup haproxy\ndaemon\nstats socket /var/run/haproxy/admin.sock mode 660 level admin\nstats timeout 30s\n\ndefaults\nmode http\nlog global\noption httplog\noption dontlognull\ntimeout connect 5s\ntimeout client 30s\ntimeout server 30s\nretries 3\noption redispatch\nmaxconn 4000\n\nfrontend http_front\nbind *:80\nmode http\ndefault_backend http_back\n\nbackend http_back\nbalance roundrobin\noption httpchk GET /health\nserver web1 192.168.1.10:80 check\nserver web2 192.168.1.11:80 check\nserver web3 192.168.1.12:80 check backup\n\n¶ HTTPS Load Balancer with SSL Termination\n\nglobal\nlog /dev/log local0\nmaxconn 4000\nuser haproxy\ngroup haproxy\nssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384\nssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256\nssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets\n\ndefaults\nmode http\nlog global\noption httplog\noption dontlognull\ntimeout connect 5s\ntimeout client 30s\ntimeout server 30s\nretries 3\n\nfrontend https_front\nbind *:443 ssl crt /etc/ssl/private/cert.pem alpn h2,http/1.1\nmode http\nhttp-request redirect scheme https if !{ ssl_fc }\ndefault_backend https_back\n\nbackend https_back\nbalance random(2)\noption httpchk GET /health\nhttp-request set-header X-Forwarded-Proto https\nserver web1 192.168.1.10:80 check\nserver web2 192.168.1.11:80 check\n\n¶ Advanced Configuration with Rate Limiting and Security\n\nglobal\nlog /dev/log local0\nmaxconn 4000\nuser haproxy\ngroup haproxy\nstats socket /var/run/haproxy/admin.sock mode 660 level admin\n\ndefaults\nmode http\nlog global\noption httplog\noption dontlognull\noption forwardfor\ntimeout connect 5s\ntimeout client 30s\ntimeout server 30s\nretries 3\n\n# Rate limiting table\nstick-table type ip size 1m expire 5m store gpc0,http_req_rate(10s)\n\nfrontend secured_http\nbind *:80\nmode http\n\n# Block clients exceeding 10 requests per 10 seconds\nhttp-request track-sc0 src\nhttp-request deny if { sc0_http_req_rate gt 10 }\n\n# ACLs for security\nacl invalid_url url_reg -i ^.*\\.exe$\nacl bad_request hdr_sub(user-agent) -i -f /etc/haproxy/bad_agents.txt\nhttp-request deny if invalid_url bad_request\n\ndefault_backend secured_back\n\nbackend secured_back\nbalance random(2)\noption httpchk GET /health\nserver web1 192.168.1.10:80 check inter 2000 rise 2 fall 3\nserver web2 192.168.1.11:80 check inter 2000 rise 2 fall 3\n\n¶ Monitoring and Metrics Configuration\n\n¶ Statistics Page Configuration\n\n# Enable statistics page\nlisten stats\nbind *:8404 ssl crt /path/to/cert.pem\nmode http\nstats enable\nstats uri /stats\nstats refresh 30s\nstats show-legends\nstats hide-version\n# Secure access with ACLs\nacl allowed_network src 192.168.1.0/24\nhttp-request allow if allowed_network\nhttp-request deny\n\n¶ Prometheus Integration\n\nFor Prometheus monitoring, HAProxy can expose metrics at /metrics endpoint:\n\n# Add to frontend or listen section\nfrontend monitoring\nbind *:9000\nmode http\nstats enable\nstats uri /metrics\nstats realm HAProxy\\ Statistics\nstats auth admin:change_this_password\n\n¶ Structured Logging for Monitoring\n\nConfigure structured logging for better analysis:\n\ndefaults\nlog-format '{\"timestamp\":\"%T\", \"client_ip\":\"%ci\", \"frontend_name\":\"%ft\", \"backend_name\":\"%b\", \"server_name\":\"%s\", \"time_wait_req\":%Tw, \"time_connect\":%Tc, \"time_queue\":%Tq, \"time_server\":%Ts, \"bytes_read\":%B, \"status_code\":%ST, \"term_state\":\"%ts\", \"actconn\":%ac, \"feconn\":%fc, \"beconn\":%bc, \"srvconn\":%sc, \"retries\":%rc, \"srv_queue\":%sq, \"backend_queue\":%bq}'\n\n¶ Key Metrics to Monitor\n\nConnections : Current connections, connection rate\n\nRequests : Request rate, response time, HTTP status codes\n\nServers : Health status, response time, queue length\n\nBackends : Queue depth, session rate, bytes in/out\n\nErrors : HTTP errors, connection failures, retries\n\n¶ High Availability Configurations\n\nHAProxy can be deployed in highly available configurations using several approaches:\n\n¶ Active-Passive with VRRP\n\nUsing Keepalived with VRRP (Virtual Router Redundancy Protocol) to ensure automatic failover:\n\nMultiple HAProxy instances run in active-passive mode\n\nA floating IP is shared between instances\n\nIf the primary instance fails, the secondary takes over automatically\n\nMinimal downtime during failover\n\nExample Keepalived configuration:\n\nvrrp_instance VI_1 {\nstate MASTER\ninterface eth0\nvirtual_router_id 51\npriority 110\nadvert_int 1\nauthentication {\nauth_type PASS\nauth_pass 1111\nvirtual_ipaddress {\n192.168.1.100/24\nnotify_master \"/bin/kill -USR1 `cat /var/run/haproxy.pid`\"\n\n¶ Active-Active Clustering\n\nDeploying multiple HAProxy instances in active-active mode:\n\nTraffic distributed across multiple load balancers\n\nHigher capacity and redundancy\n\nCan be combined with DNS round-robin or cloud load balancers\n\nRequires careful session persistence handling\n\n¶ Kubernetes/Docker Deployments\n\nRunning HAProxy in containerized environments:\n\nLeverages orchestration platform’s built-in HA features\n\nAutomatic scaling and self-healing capabilities\n\nService mesh integration for advanced traffic management\n\nCloud-native deployment patterns\n\n¶ State Synchronization\n\nFor maintaining session persistence across HAProxy instances:\n\nPeers configuration for sharing stick table information\n\nConsistent session routing across cluster nodes\n\nSynchronized health check status\n\nExample peers configuration:\n\npeers mycluster\npeer haproxy1 192.168.1.10:1024\npeer haproxy2 192.168.1.11:1024\n\nThen reference the peers in your backend:\n\nbackend my_backend\nbalance roundrobin\nserver server1 192.168.1.20:80 check\nserver server2 192.168.1.21:80 check\ncookie SERVERID insert indirect nocache\nstick-table type ip size 200k peers mycluster\nstick on src\n\n¶ Security Hardening \u0026 Compliance\n\nRunning HAProxy in regulated environments? We assist with:\n\n🔐 TLS/SSL configuration\n\n🔑 Authentication and authorization setup\n\n📋 Audit logging and compliance reporting\n\n🛡️ Security hardening benchmarks (CIS, STIG)\n\nSecure your deployment: office@linux-server-admin.com | Contact Page",
|
||
"content_type": "text/html",
|
||
"query": "Concrete configuration examples for Rate Limits, Security Headers, and Server-side Authorization in HAProxy",
|
||
"language": "en-US",
|
||
"round": 1,
|
||
"fetched": true,
|
||
"relevant": true,
|
||
"relevance": 0.62,
|
||
"source_quality": "unknown",
|
||
"source_quality_score": 0.52,
|
||
"covered_gap_ids": [
|
||
"G1"
|
||
],
|
||
"assessment_reason": "Volltextmaterial für die Artikelsynthese gesammelt; die fachliche Belegprüfung erfolgt anschließend am generierten Artikel."
|
||
}
|
||
}
|