HAProxy - Revision history

Kevin: /* Installation */

2014-11-29T17:34:54Z

Installation

← Older revision		Revision as of 17:34, 29 November 2014
Line 64:		Line 64:
	bind :443 ssl crt /etc/ssl/certs/server_domain.pem no-sslv3		bind :443 ssl crt /etc/ssl/certs/server_domain.pem no-sslv3
	</pre>		</pre>
-	* <code>no-sslv3</code> to disable SSLv3 due to the vulnerability found in SSL protocol 3.0.	+	'''''* <code>no-sslv3</code> to disable SSLv3 due to the vulnerability found in SSL protocol 3.0.'''''

	= Configuration =		= Configuration =

Kevin: /* HAProxy Installation */

2014-11-29T17:31:03Z

HAProxy Installation

← Older revision		Revision as of 17:31, 29 November 2014
Line 62:		Line 62:
	* Modify the <code>/etc/haproxy/haproxy.cfg</code> file		* Modify the <code>/etc/haproxy/haproxy.cfg</code> file
	<pre>		<pre>
-	bind :443 ssl crt /etc/ssl/certs/server_domain.pem	+	bind :443 ssl crt /etc/ssl/certs/server_domain.pem no-sslv3
	</pre>		</pre>
		+	* <code>no-sslv3</code> to disable SSLv3 due to the vulnerability found in SSL protocol 3.0.

	= Configuration =		= Configuration =

Kevin: /* Log */

2013-08-10T13:53:49Z

Log

← Older revision		Revision as of 13:53, 10 August 2013
Line 224:		Line 224:
	/var/log/haproxy*.log		/var/log/haproxy*.log
	{		{
-	rotate 4	+	rotate 1000
	weekly		weekly
	missingok		missingok
Line 230:		Line 230:
	compress		compress
	delaycompress		delaycompress
		+	size 20M
	sharedscripts		sharedscripts
	postrotate		postrotate
Line 240:		Line 241:
	$ restart rsyslog		$ restart rsyslog
	</pre>		</pre>
-

	= HATop =		= HATop =

Kevin at 19:18, 7 August 2013

2013-08-07T19:18:10Z

← Older revision		Revision as of 19:18, 7 August 2013
Line 239:		Line 239:
	<pre>		<pre>
	$ restart rsyslog		$ restart rsyslog
		+	</pre>
		+
		+
		+	= HATop =
		+	== Installation ==
		+	<pre>
		+	$ apt-get install hatop
		+	</pre>
		+
		+	== Usage ==
		+	<pre>
		+	$ hatop -s /var/run/haproxy/haproxy.sock
		+	</pre>
		+	Or set alias
		+	<pre>
		+	alias hamonitor='hatop -s /var/run/haproxy/haproxy.sock'
	</pre>		</pre>

Kevin at 19:09, 7 August 2013

2013-08-07T19:09:30Z

← Older revision		Revision as of 19:09, 7 August 2013
Line 200:		Line 200:
	## } fifth.domain.com ##		## } fifth.domain.com ##

		+	</pre>
		+
		+	== Log ==
		+	HAProxy uses syslog instead of writing it directly into a file.
		+
		+	So change the configuration fine of the default syslog daemon that is rsyslogd.
		+	* Edit <code>/etc/rsyslog.conf</code>
		+	<pre>
		+	$ModLoad imudp
		+	$UDPServerAddress 127.0.0.1
		+	$UDPServerRun 514
		+	</pre>
		+
		+	* Also Edit <code>/etc/rsyslog.d/49-haproxy.conf</code>
		+	<pre>
		+	local0.* -/var/log/haproxy_0.log
		+	local1.* -/var/log/haproxy_1.log
		+	& ~
		+	</pre>
		+
		+	* Edit <code>/etc/logrotate.d/haproxy</code>
		+	<pre>
		+	/var/log/haproxy*.log
		+	{
		+	rotate 4
		+	weekly
		+	missingok
		+	notifempty
		+	compress
		+	delaycompress
		+	sharedscripts
		+	postrotate
		+	reload rsyslog >/dev/null 2>&1 \|\| true
		+	endscript
		+	}
		+	</pre>
		+
		+	<pre>
		+	$ restart rsyslog
	</pre>		</pre>

Kevin at 16:17, 22 July 2013

2013-07-22T16:17:13Z

← Older revision		Revision as of 16:17, 22 July 2013
Line 68:		Line 68:
	== haproxy.cfg ==		== haproxy.cfg ==
	* Example of <code>/etc/haproxy/haproxy.cfg</code>		* Example of <code>/etc/haproxy/haproxy.cfg</code>
		+
		+	<pre>
		+	global
		+	log 127.0.0.1 local0
		+	log 127.0.0.1 local1 notice
		+	#log loghost local0 info
		+	maxconn 4096
		+	#chroot /usr/share/haproxy
		+	user haproxy
		+	group haproxy
		+	daemon
		+	#debug
		+	#quiet
		+	stats socket /var/run/haproxy/haproxy.sock mode 0600 level admin
		+
		+	defaults
		+	log global
		+	mode http
		+	option httplog
		+	option dontlognull
		+	retries 3
		+	option redispatch
		+	maxconn 2000
		+	contimeout 5000
		+	clitimeout 50000
		+	srvtimeout 50000
		+
		+	## first.domain.com { ##
		+
		+	# frontend public
		+	frontend http_first
		+	# HTTP
		+	bind 192.168.0.222:80
		+
		+	# Redirect all HTTP traffic to HTTPS
		+	redirect scheme https if !{ ssl_fc }
		+
		+	frontend https_first
		+
		+	bind 192.168.0.222:443 ssl crt /location/to/ssl/first.pem
		+
		+	default_backend main_backend_https
		+
		+	backend main_backend_https
		+	mode http
		+
		+	# Tell the backend that this is a secure connection,
		+	# even though it's getting plain HTTP.
		+	reqadd X-Forwarded-Proto:\ https
		+
		+	# Check by hitting a page intended for this use.
		+	# option httpchk GET /isrunning
		+	option httpchk
		+	timeout check 500ms
		+	# Wait 500ms between checks.
		+
		+	option forwardfor header X-Real-IP
		+	option http-server-close
		+
		+	balance roundrobin
		+	cookie JSESSIONID prefix
		+
		+	server app_backend1 192.168.0.301:80 check port 80 cookie app_backend1
		+	server app_backend2 192.168.0.302:80 check port 80 cookie app_backend2
		+
		+	## } first.domain.com ##
		+
		+
		+	## second.domain.com { ##
		+
		+	frontend http_second
		+
		+	bind 192.168.0.202:80
		+
		+	redirect scheme https if !{ ssl_fc }
		+
		+	frontend https_second
		+
		+	bind 192.168.0.202:443 ssl crt /location/to/ssl/second.pem
		+
		+	default_backend main_backend_https
		+
		+	## } second.domain.com ##
		+
		+
		+	## third.domain.com { ##
		+
		+	frontend http_third
		+
		+	bind 192.168.0.203:80
		+	redirect scheme https if !{ ssl_fc }
		+
		+	frontend https_third
		+
		+	bind 192.168.0.203:443 ssl crt /location/to/ssl/third.pem
		+
		+	default_backend main_backend_https
		+
		+	## } third.domain.com ##
		+
		+
		+	## fourth.domain.com { ##
		+
		+	frontend http_fourth
		+
		+	bind 192.168.0.204:80
		+	redirect scheme https if !{ ssl_fc }
		+
		+	frontend https_fourth
		+
		+	bind 192.168.0.204:443 ssl crt /location/to/ssl/fourth.pem
		+
		+	default_backend main_backend_https
		+
		+	## } fourth.domain.com ##
		+
		+
		+	## fifth.domain.com { ##
		+
		+	frontend http_fifth
		+
		+	bind 192.168.0.205:80
		+	redirect scheme https if !{ ssl_fc }
		+
		+	frontend https_fifth
		+
		+	bind 192.168.0.205:443 ssl crt /location/to/ssl/fifth.pem
		+
		+	default_backend main_backend_https
		+
		+	## } fifth.domain.com ##
		+
		+	</pre>

Kevin at 12:19, 22 July 2013

2013-07-22T12:19:53Z

← Older revision		Revision as of 12:19, 22 July 2013
Line 64:		Line 64:
	bind :443 ssl crt /etc/ssl/certs/server_domain.pem		bind :443 ssl crt /etc/ssl/certs/server_domain.pem
	</pre>		</pre>
		+
		+	= Configuration =
		+	== haproxy.cfg ==
		+	* Example of <code>/etc/haproxy/haproxy.cfg</code>

Kevin at 04:35, 29 June 2013

2013-06-29T04:35:57Z

← Older revision		Revision as of 04:35, 29 June 2013
Line 34:		Line 34:
	== HAProxy Installation ==		== HAProxy Installation ==
	* Download HAProxy,		* Download HAProxy,
-	e.g.)	+	e.g.)
	<pre>		<pre>
	$ wget http://haproxy.1wt.eu/download/1.5/src/devel/haproxy-1.5-dev19.tar.gz		$ wget http://haproxy.1wt.eu/download/1.5/src/devel/haproxy-1.5-dev19.tar.gz

Kevin: Created page with "Category:Network = Installation =

 $ apt-get install make

* for gcc

 $ apt-get install build-essential

* If the following error occurs,

 # Ins..."

2013-06-29T04:12:10Z

Created page with "Category:Network = Installation = <pre> $ apt-get install make </pre> * for gcc <pre> $ apt-get install build-essential </pre> * If the following error occurs, <pre> # Ins..."

New page

[[Category:Network]]
= Installation =
<pre>
$ apt-get install make
</pre>
* for gcc
<pre>
$ apt-get install build-essential
</pre>

* If the following error occurs,
<pre>
# Install libpcre3-dev if you get "include/common/regex.h:28:18: fatal error: pcre.h: No such file or directory"
</pre>
* install
<pre>
$ apt-get install libpcre3-dev
</pre>

* If the following error occurs,
<pre>
# libssl-dev if you get "include/types/server.h:29:25: fatal error: openssl/ssl.h: No such file or directory"
</pre>
* install
<pre>
$ apt-get install libssl-dev
</pre>

* HAProxy website:
<pre>
http://haproxy.1wt.eu/
</pre>

== HAProxy Installation ==
* Download HAProxy,
e.g.)
<pre>
$ wget http://haproxy.1wt.eu/download/1.5/src/devel/haproxy-1.5-dev19.tar.gz
</pre>
* Install
<pre>
$ tar -zxvf haproxy-1.5-dev19.tar.gz
$ cd haproxy-1.5-dev19
$ make TARGET=linux2628 USE_PCRE=1 USE_OPENSSL=1 USE_ZLIB=1
$ make install
</pre>

* Clean all for recompilation
<pre>
$ make TARGET=linux2628 USE_PCRE=1 USE_OPENSSL=1 USE_ZLIB=1 clean all
</pre>

* Add haproxy user
<pre>
$ useradd -m haproxy -s /bin/false
</pre>

* For SSL support
<pre>
$ cat server_domain-crt-bundle.crt server_domain.key > server_domain.pem
</pre>
* Modify the <code>/etc/haproxy/haproxy.cfg</code> file
<pre>
bind :443 ssl crt /etc/ssl/certs/server_domain.pem
</pre>