HAProxy – Will HAProxy automatically reload list files

haproxyload balancingwhitelist

I have text files with lists of IP addresses that I want to use to help determine to right actions to take with HAProxy.

So if HAProxy loads whitelists like this.

acl whitelist src -f /path/to/ips.list

If ips.list were to be modified would HAProxy automatically reload it – So I can modify the IP lists on the fly?

Best Answer

Haproxy will only read its config, including such files, during startup and when explicitly told to reload its config. If you installed haproxy via a package then the init.d script should have a reload target for this. Otherwise a quick search of serverfault for "haproxy reload" will show numerous examples how to do it. A reload will not interrupt any existing sessions so is very unobtrusive.

Related Solutions

Haproxy graceful reload

The command you posted does not seem 100% correct to me. On my system, it reads:

haproxy -f /etc/haproxy/haproxy.cfg -p /var/run/haproxy.pid -D -sf $(cat /var/run/haproxy.pid)

You mistyped the value of last option -sf.

Haproxy redirect based on path

This can be done using some temporary headers like this, inserted between your acl definitions, and use_backend keywords:

http-request set-header X-Location-Path %[capture.req.uri] if has_legacy_abc OR has_legacy_def

http-request replace-header X-Location-Path [^/]+/(.*) \1 if has_legacy_abc OR has_legacy_def

http-request redirect location https://abcdomain.com/%[hdr(X-Location-Path)] if has_legacy_abc
http-request redirect location https://defdomain.com/%[hdr(X-Location-Path)] if has_legacy_def

Depending on the actual configuration of your domains/paths and required redirections, it might even be possible to collapse it all down into a single set of directives, like this:

...
frontend https
  bind *:{{ proxy_port }} ssl crt /etc/haproxy/bundle_dh.pem ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4 no-sslv3
  http-request set-header X-Forwarded-Proto https if { ssl_fc }
  http-request set-header X-Forwarded-Port %[dst_port]

  acl has_legacy path_beg /abc /def

  http-request set-header X-Location-Path %[capture.req.uri] if has_legacy
  http-request set-header X-Location-Host %[capture.req.uri] if has_legacy

  http-request replace-header X-Location-Host /([^/]*)/ \1 if has_legacy
  http-request replace-header X-Location-Path [^/]+/(.*) \1 if has_legacy

  http-request redirect location https://%[hdr(X-Location-Host)]domain.com/%[hdr(X-Location-Path)] if has_legacy_abc

  use backend abc_backend if { hdr(Host) -i abcdomain.com }
  use backend def_backend if { hdr(Host) -i defdomain.com }
...

Should the number of paths and domains be huge, you can use maps (where the key is the path, and the value is the destination host) to simplify things even more.

Best Answer

Related Solutions

Haproxy graceful reload

Haproxy redirect based on path

Related Topic