eea/eea.docker.haproxy

HAProxy Docker image with docker links and reload support

HAProxy Docker image

This image is generic, thus you can obviously re-use it within your non-related EEA projects.

• Debian: Buster
• HAProxy: 1.8
• Expose: 5000

Supported tags and respective Dockerfile links

• :latest Dockerfile - Debian: Buster, HAProxy: 1.8

Stable and immutable tags

• :1.8-1.8 Dockerfile - HAProxy: 1.8.31 Release: 1.8
• :1.8-1.7 Dockerfile - HAProxy: 1.8.30 Release: 1.7
• :1.8-1.6 Dockerfile - HAProxy: 1.8.29 Release: 1.6
• :1.8-1.5 Dockerfile - HAProxy: 1.8.22 Release: 1.5

See older versions

Changes

• CHANGELOG.md

Base docker image

• hub.docker.com

Source code

• github.com

Installation

1. Install Docker
2. Install Docker Compose.

Usage

Run with Docker Compose

Here is a basic example of a docker-compose.yml file using the eeacms/haproxy docker image:

version: "2"
services:
  haproxy:
    image: eeacms/haproxy
    depends_on:
    - webapp
    ports:
    - "80:5000"
    - "1936:1936"
    environment:
      BACKENDS: "webapp"
      DNS_ENABLED: "true"
      LOG_LEVEL: "info"

  webapp:
    image: eeacms/hello

The application can be scaled to use more server instances, with docker-compose scale:

$ docker-compose up -d --scale webapp=4

The results can be checked in a browser, navigating to http://localhost. By refresing the page multiple times it is noticeable that the IP of the server that served the page changes, as HAProxy switches between them. The stats page can be accessed at http://localhost:1936 where you have to log in using the STATS_AUTH authentication details (default admin:admin).

Note that it may take up to one minute until backends are plugged-in due to the minimum possible DNS_TTL.

Run with backends specified as environment variable

$ docker run --env BACKENDS="192.168.1.5:80 192.168.1.6:80" eeacms/haproxy

Using the BACKENDS variable is a way to quick-start the container. The servers are written as server_ip:server_listening_port, separated by spaces (and enclosed in quotes, to avoid issues). The contents of the variable are evaluated in a python script that writes the HAProxy configuration file automatically.

If there are multiple DNS records for one or more of your BACKENDS (e.g. when deployed using rancher-compose), you can use DNS_ENABLED environment variable. This way, haproxy will load-balance all of your backends instead of only the first entry found:

$ docker run --link=webapp -e BACKENDS="webapp" -e DNS_ENABLED=true eeacms/haproxy

Use a custom configuration file mounted as a volume

$ docker run -v conf.d/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg eeacms/haproxy:latest

If you edit haproxy.cfg you can reload it without having to restart the container:

$ docker exec <name-of-your-container> reload

Extend the image with a custom haproxy.cfg file

Additionally, you can supply your own static haproxy.cfg file by extending the image

FROM eeacms/haproxy:latest
COPY conf.d/haproxy.cfg /usr/local/etc/haproxy/haproxy.cfg

RUN apt-get install...

and then run

$ docker build -t your-image-name:your-image-tag path/to/Dockerfile

Supported environment variables

As HAProxy has close to no purpose by itself, this image should be used in combination with others (for example with Docker Compose).

HAProxy can be configured by modifying the following env variables, either when running the container or in a docker-compose.yml file.

• STATS_PORT The port to bind statistics to - default 1936
• STATS_AUTH The authentication details (written as user:password for the statistics page - default admin:admin
• FRONTEND_NAME The label of the frontend - default http-frontend
• FRONTEND_PORT The port to bind the frontend to - default 5000
• FRONTEND_MODE Frontend mode - default http or BACKENDS_MODE if declared
• PROXY_PROTOCOL_ENABLED The option to enable or disable accepting proxy protocol (true stands for enabled, false or anything else for disabled) - default false
• COOKIES_ENABLED The option to enable or disable cookie-based sessions (true stands for enabled, false or anything else for disabled) - default false
• COOKIES_NAME Will be added on cookie declaration - default SRV_ID
• COOKIES_PARAMS Will be added on cookie declaration - example indirect nocache maxidle 30m maxlife 8h or maxlife 24h - documentation https://cbonte.github.io/haproxy-dconv/1.8/configuration.html#4-cookie
• BACKEND_NAME The label of the backend - default http-backend
• BACKENDS The list of server_ip:server_listening_port to be load-balanced by HAProxy, separated by space - by default it is not set
• BACKENDS_PORT Port to use when auto-discovering backends, or when BACKENDS are specified without port - by default 80
• BACKENDS_MODE Backends mode - default http or FRONTEND_MODE if declared
• BALANCE The algorithm used for load-balancing - default roundrobin
• SERVICE_NAMES An optional prefix for services to be included when discovering services separated by space. - by default it is not set
• LOGGING Override logging ip address:port - default is udp 127.0.0.1:514 inside container
• LOG_LEVEL Set haproxy log level, default is notice ( only send important events ). Can be: emerg,alert,crit,err,warning,notice,info,debug
• DNS_ENABLED DNS lookup provided BACKENDS. Use this option when your backends are resolved by an internal/external DNS service (e.g. Docker 1.11+, Rancher)
• DNS_TTL DNS lookup backends every DNS_TTL minutes. Default 1 minute.
• TIMEOUT_CONNECT the maximum time to wait for a connection attempt to a VPS to succeed. Default 5000 ms
• TIMEOUT_CLIENT timeouts apply when the client is expected to acknowledge or send data during the TCP process. Default 50000 ms
• TIMEOUT_SERVER timeouts apply when the server is expected to acknowledge or send data during the TCP process. Default 50000 ms
• HTTPCHK The HTTP method and uri used to check on the servers health - default HEAD /
• HTTPCHK_HOST Host Header override on http Health Check - default localhost
• INTER parameter sets the interval between two consecutive health checks. If not specified, the default value is 2s
• FAST_INTER parameter sets the interval between two consecutive health checks when the server is any of the transition state (read above): UP - transitionally DOWN or DOWN - transitionally UP. If not set, then INTER is used.
• DOWN_INTER parameter sets the interval between two consecutive health checks when the server is in the DOWN state. If not set, then INTER is used.
• RISE number of consecutive valid health checks before considering the server as UP. Default value is 2
• FALL number of consecutive invalid health checks before considering the server as DOWN. Default value is 3

Logging

By default the logs from haproxy are present in the docker log, by using the rsyslog inside the container (UDP port 514). No access logs are present by default, but this can be changed by setting the log level.

You can change the logging level by providing the LOG_LEVEL environment variable:

docker run -e LOG_LEVEL=info  ... eeacms/haproxy

You can override the log output by providing the LOGGING environment variable:

docker run -e LOGGING=logs.example.com:5005 ... eeacms/haproxy

Now make sure that logs.example.com listen on UDP port 5005

Copyright and license

The Initial Owner of the Original Code is European Environment Agency (EEA). All Rights Reserved.

The Original Code is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

Funding

European Environment Agency (EU)

eea.docker.haproxy's Issues

Feature request: Customize config templates

I noticed you can pass haproxy.cfg into /tmp/haproxy.cfg and it's used as the input template for generating the final haproxy.cfg. This is nice, but unfortunately you're limited in what you can do since the frontend and backend sections are generated based on templates stored directly in the python script.

It would be nice if these templates were moved somewhere else, e.g /tmp/haproxy.d/frontend.cfg, so that I could pass in my own template with customizations.

How to specify to eeacms/haproxy a different web app port?

If the web application uses a port different than 80 (for example 8080), How you can specify to eeacms/haproxy to listen 8080 in all webapp Services that will be scaled using for example docker-compose scale webapp:3?

haproxy:
  restart: always
  image: eeacms/haproxy
  links:
  - webapp
  ports:
  - "80:80"
  - "1936:1936"

webapp:
  restart: always
  image: tomcat/myapp 
  ports:
  -"8080"

Unable to set the mode as "tcp"

Hi,
I do not see an environment variable to set the mode as "tcp" to follow the below link to work on haproxy with ssl. Can you please enable us if possible?

https://serverfault.com/questions/236496/haproxy-not-passing-ssl-traffic-in-tcp-mode-unknown-protocol

Servers are not configured in haproxy if version 2 of compose file is used

hi i am using the version 2 of compose file
version: '2'
services:
haproxy:
image: eeacms/haproxy:latest
links:

• web
  ports:
• "80:5000"
• "1936:1936"
  web:
  build: .
  #container_name: laravel_container
  volumes:
• .:/var/www/html/app
  links:
• mysql
  mysql:
  image: mysql:latest
  container_name: mysql_laravel
  ports:
• "3306:3306"
  environment:
  MYSQL_ROOT_PASSWORD: abcd
  MYSQL_PASSWORD: abcd
  MYSQL_DATABASE: laravel_db

After running docker-compose up -d
haproxy.cfg is configured as

global
log 127.0.0.1 local0
log 127.0.0.1 local1 notice
pidfile /etc/haproxy/haproxy.pid
daemon

Default SSL material locations

ca-base /etc/ssl/certs
crt-base /etc/ssl/private

Default ciphers to use on SSL-enabled listening sockets.

For more information, see ciphers(1SSL). This list is from:

https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/

ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
ssl-default-bind-options no-sslv3
defaults
log global
mode http
option httplog
option dontlognull
timeout connect 5000
timeout client 50000
timeout server 50000
errorfile 400 /etc/haproxy/errors/400.http
errorfile 403 /etc/haproxy/errors/403.http
errorfile 408 /etc/haproxy/errors/408.http
errorfile 500 /etc/haproxy/errors/500.http
errorfile 502 /etc/haproxy/errors/502.http
errorfile 503 /etc/haproxy/errors/503.http
errorfile 504 /etc/haproxy/errors/504.http
listen stats
bind *:1936
stats enable
stats uri /
stats hide-version
stats auth admin:admin
frontend http-frontend
bind *:5000
mode http
default_backend http-backend
backend http-backend
mode http
balance roundrobin
option forwardfor
http-request set-header X-Forwarded-Port %[dst_port]
http-request add-header X-Forwarded-Proto https if { ssl_fc }
option httpchk HEAD / HTTP/1.1\r\nHost:localhost
cookie SRV_ID prefix

listen default
bind *:4242

but no sever ip and port is listed to forward incoming connection. however when i use legacy format of compose file this is working perfectly.
how to fix this issue?

thanks for your time

syslog service cannot be started: [Errno 13] Permission denied: '/dev/log'

$ docker run --env BACKENDS="127.0.0.1:8000 localhost:8000" eeacms/haproxy

syslog service cannot be started: [Errno 13] Permission denied: '/dev/log'
command service cannot be started: [Errno 13] Permission denied
Setting up watches.
Watches established.

Cannot open configuration file/directory /usr/local/etc/haproxy/haproxy.cfg : No such file or directory

Hi There

I have just pulled the latest tag from docker. When I run it I am now getting the following in the logs:

Cannot open configuration file/directory /usr/local/etc/haproxy/haproxy.cfg : No such file or directory

haproxy_cms_service:
image: eeacms/haproxy:1.8-1.5
ports:
- "4001:5000"
- "1947:1936"
networks:
- cms-net
environment:
BACKENDS: "service:5000"
DNS_ENABLED: "true"
LOG_LEVEL: "info"

When I roll back to version 1.8-1.5 the error goes away.

Thanks

Support for the ARM build

Hello! Thanks for the docker image provided, I found it very powerful when used along with the docker-compose

As ARM architecture is getting more popular - RaspberryPI / AWS T4/An Graviton2 instances ARM build would be handy

Thanks!

Customize forwardfor

In our architecture we have a haproxy for balancing between docker nodes

                                        / Backend server
                         HAProxy(docker)- Backend server
                        /               \ Backend server
REQUEST ----> HAPRoxy---                               
              (main)    \               / Backend server
                         HAProxy(docker)- Backend server
                                        \ Backend server

We need the first X-Forward-For header of the main HAProxy server. It could be done customizing the option: option forwardfor except <main-haproxy-ip>/32

Thanks in advance

Customize Cookie name

Currently, there is no way to push the name of the cookie (like JSESSIONID). There should be an environment variable (COOKIES_NAME?) to be used to inject the cookie from outside.

cookie JSESSIONID prefix nocache
server server1 host1:8080 cookie s1
server server1 host2:8080 cookie s2

wrong backend ports

When i use different backend ports, the last port used for both ips/hostnames.
backend1:3333 backend2:3334

in haproxy i see
backend1 3334
backend2 3334

Customize backend servers

BALANCE can be used to ask how servers will be used and we can use source IP to select a server. However, it would be nicer if there would be an environment variable to select and active/passive configuration (one node active, the rest of them passive). There are use cases when we only want one node active.

Logs error

Hello my docker-compose.yml is:

web:
  build: .
  env_file: .env
  command: python drivetech/manage.py run_gunicorn -b "0.0.0.0:80" -w 3
worker:
  build: .
  env_file: .env
  command: python drivetech/manage.py celery worker -B -l info
haproxy:
  image: eeacms/haproxy
  links:
    - web
  ports:
    - "80:5000"
    - "1936:1936"
  environment:
    - SERVICE_NAMES=web
    - BACKENDS_PORT=80

And this is error

haproxy_1  | syslog service cannot be started: [Errno 13] Permission denied: '/dev/log'
haproxy_1  | command service cannot be started: [Errno 13] Permission denied
haproxy_1  | Setting up watches.
haproxy_1  | Watches established.
haproxy_1  | Request made to kill system.
haproxy_1  | /etc/hosts CLOSE_WRITE,CLOSE 
haproxy_1  | syslog service cannot be started: [Errno 13] Permission denied: '/dev/log'
haproxy_1  | command service cannot be started: [Errno 13] Permission denied
haproxy_1  | Setting up watches.
haproxy_1  | Watches established.