Sane HAProxy Config

[sous-chefs]

Sane HAProxy Config

[rshade]

root@default-ubuntu-1404:/usr/local/etc/haproxy# cat haproxy.cfg
global
     user haproxy
     group haproxy
     pidfile /var/run/haproxy.pid
     log /dev/log syslog info
     daemon
     quiet
     stats socket /var/run/haproxy.sock user haproxy group haproxy
     maxconn 4106
defaults
     timeout client 10s
     timeout server 10s
     timeout connect 10s

     log global
     mode http
     balance roundrobin
     option httplog
     option dontlognull
     option redispatch
     option httpchk GET /
     stats uri /haproxy-status
     stats auth statsuser:statspass
     http-check disable-on-404
     cookie SERVERID insert indirect nocache
frontend all_requests
     bind 0.0.0.0:85

[rshade]

global
     user haproxy
     group haproxy
     pidfile /var/run/haproxy.pid
     log /dev/log syslog info
     daemon
     quiet
     stats socket /var/run/haproxy.sock user haproxy group haproxy
     maxconn 4106
defaults
     timeout client 10s
     timeout server 10s
     timeout connect 10s

     log global
     mode http
     balance roundrobin
     option httplog
     option dontlognull
     option redispatch
     option httpchk GET /
     stats uri /haproxy-status
     http-check disable-on-404
     cookie SERVERID insert indirect nocache
frontend all_requests
     default_backend example
     bind 0.0.0.0:80
     maxconn 4096
     acl acl_test_example hdr_dom(host) -i -m dom test.example.com
     acl acl_appserver path_dom -i /appserver
     acl acl_example hdr_dom(host) -i -m dom example.com
     use_backend test_example if acl_test_example
     use_backend appserver if acl_appserver
     use_backend example if acl_example
     bind 0.0.0.0:445 ssl crt /usr/local/etc/haproxy/ssl_cert.pem no-sslv3
     redirect scheme https if !{ ssl_fc }
backend test_example
     server disabled-server 127.0.0.1:1 disabled
     server 01-ABCDEFGH0123 192.0.2.2:8080 inter 300 rise 3 fall 2 maxconn 100 check cookie 01-ABCDEFGH0123
backend appserver
     server disabled-server 127.0.0.1:1 disabled
     server 02-ABCDEFGH0123 192.0.2.2:8080 inter 300 rise 3 fall 2 maxconn 100 check cookie 02-ABCDEFGH0123
backend example
     server disabled-server 127.0.0.1:1 disabled
     server 03-ABCDEFGH0123 192.0.2.2:8080 inter 300 rise 3 fall 2 maxconn 100 check cookie 03-ABCDEFGH0123

[damacus]

How does this look for a set of resources?

haproxy_global_config do
     user 'haproxy'
     group 'haproxy'
     pidfile '/var/run/haproxy.pid'
     log '/dev/log syslog info'
     ? 'daemon'
     ? 'quiet'
     stats_socket '/var/run/haproxy.sock user haproxy group haproxy'
     maxconn 4106
end

hapoxy_default_config do
     client_timeout 10 # document these settings should be in seconds
     server_timeout 10
     connect_timeout 10
     log 'global'
     mode 'http'
     balance 'roundrobin'
     option httplog* # should these be an options hash? there isn't anything distinguishable about them
     option dontlognull*
     option redispatch*
     httpcheck 'GET /'
     stats_uri '/haproxy-status'
     http_check 'disable-on-404'
     cookie 'SERVERID insert indirect nocache'
end

haproxy_frontend '1' do
     requests 'all_requests'
     default_backend 'example'
     bind '0.0.0.0:80'
     maxconn 4096
     acl ['acl_test_example hdr_dom(host) -i -m dom test.example.com',
            'acl_appserver path_dom -i /appserver',
            'acl_example hdr_dom(host) -i -m dom example.com']
     use_backend ['test_example if acl_test_example',
                              'appserver if acl_appserver',
                               'example if acl_example']
     bind '0.0.0.0:445 ssl crt /usr/local/etc/haproxy/ssl_cert.pem no-sslv3'
     redirect_scheme 'https if !{ ssl_fc }'
end

haproxy_backend 'test_example' do
     disabled_server ['disabled-server 127.0.0.1:1 disabled']
     enabled_server ['01-ABCDEFGH0123 192.0.2.2:8080 inter 300 rise 3 fall 2 maxconn 100 check cookie 01-ABCDEFGH0123']
end

haproxy_backend 'appserver' do
     disabled_server ['disabled-server 127.0.0.1:1 disabled']
     enabled_server ['02-ABCDEFGH0123 192.0.2.2:8080 inter 300 rise 3 fall 2 maxconn 100 check cookie 02-ABCDEFGH0123']
end

haproxy_backend 'example' do
     disabled_server ['disabled-server 127.0.0.1:1 disabled']
     enabled_server ['03-ABCDEFGH0123 192.0.2.2:8080 inter 300 rise 3 fall 2 maxconn 100 check cookie 03-ABCDEFGH0123']
end

haproxy_syslog 'destination_1' do
  address: '127.0.0.1'
  length: nil
  format: nil
  facility: 'local0' 
  max_level: nil 
  min_level: nil
end

[rshade]

I was basically thinking the same thing. enabled_server under haproxy_backend can have multiples. I think it may need a add_server action

[rshade]

we should also make global_/default_ be the same naming style

[damacus]

We can accumulate (because I keep finding a need for this pattern apparently...) the servers.
So...:

haproxy_backend 'example' do
     disabled_server ['disabled-server 127.0.0.1:1 disabled']
     enabled_server ['1']
end

haproxy_backend 'example' do
     enabled_server ['2']
end

haproxy_backend 'example' do
     enabled_server ['3']
end

would give us:

haproxy_backend 'example' do
     disabled_server ['disabled-server 127.0.0.1:1 disabled']
     enabled_server ['1','2','3']
end

What do you mean by the same naming style for defaults and global?

[rshade]

I am thinking haproxy_global_config => haproxy_global, hapoxy_config_defaults => haproxy_defaults, or at least config in all of them. Not sure, I am probably being pedantic.

[rshade]

You might want to checkout #119 also.

[rshade]

this should fix #58 also

[damacus]

More resources to add as per #96 :
haproxy_userlist, haproxy_user and haproxy_group

[damacus]

load_balancer should support accumulator pattern for multiple listeners.

As per #106

[damacus]

Which of the following do we prefer?

considering we don't have many options in defaults right now I think the second could work.

  timeout {
    connect: '5000ms',
    client: '5000ms',
    server: '5000ms'
  }
  connect_timeout '5000ms'
  client_timeout '5000ms'
  server_timeout '5000ms'

[rshade]

there are a couple of other timeouts also so up to you.

[damacus]

hmm yeah

timeout check X - X X
timeout client X X X -
timeout client-fin X X X -
timeout connect X - X X
timeout http-keep-alive X X X X
timeout http-request X X X X
timeout queue X - X X
timeout server X - X X
timeout server-fin X - X X
timeout tarpit X X X X
timeout tunnel X - X X

[damacus]

OK. So going through all the possible options I need a few more good examples people are using.

I'd like to make it simple/easy to make common configurations. Past that, pass in extra_options hash.

If anyone else has exemplar configs that would be great.

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.