一：Global parameters
* Process management and security
- chroot 改變當(dāng)前工作目錄
- daemon 運(yùn)行方式為后臺(tái)工作
- user - group 工作用戶和組
-log <address> <facility>日志輸出設(shè)備
- nbproc 創(chuàng)建工作的進(jìn)程數(shù)目
-pidfile pid文件位置
- ulimit-n 設(shè)置每個(gè)進(jìn)程的可用的最大文件描述符
- stats 創(chuàng)建監(jiān)控所用的套接字目錄
- node 創(chuàng)建另外一個(gè)節(jié)點(diǎn)名字共用一個(gè)IP地址，用來識(shí)別哪個(gè)節(jié)點(diǎn)在處理流量
- description 描述實(shí)例的名稱
maxconn <number> 每個(gè)進(jìn)程可用的最大連接數(shù)
maxpipes <number> 每個(gè)進(jìn)程可用的最大管道數(shù)
nokqueue nopoll nosepoll nosplice 禁用這些功能
spread-checks <0..50, in percent> health check 的時(shí)間間隔
tune.bufsize <number>
tune.maxaccept <number>
tune.maxpollevents <number>
tune.maxrewrite <number>
tune.rcvbuf.client <number>
tune.rcvbuf.server <number>
tune.sndbuf.client <number>
tune.sndbuf.server <number>
以上憑字面理解吧
debug 調(diào)試模式，輸出啟動(dòng)信息到標(biāo)準(zhǔn)輸出
quiet 安裝模式，啟動(dòng)時(shí)無輸出
二：defaults 塊
作用于其后緊跟的listen塊，直至下一個(gè)defaults 塊，下一個(gè)default 將替換上一個(gè)塊作用于以后的listen
frontend 塊，接受請(qǐng)求的端口組
backend塊，后端處理的server 組
listen塊，frontend和backend 塊的結(jié)合
三：常用配置命令
balance <algorithm> [ <arguments> ]
balance url_param <param> [check_post [<max_wait>]] 負(fù)載均衡模塊設(shè)置
Examples :
balance roundrobin
balance url_param userid
balance url_param session_id check_post 64
balance hdr(User-Agent)
balance hdr(host)
balance hdr(Host) use_domain_only
block { if | unless } <condition> 在7層阻止訪問
Example:
acl invalid_src src 0.0.0.0/7 224.0.0.0/3 acl定義和squid 很像
acl invalid_src src_port 0:1023
acl local_dst hdr(host) -i localhost
block if invalid_src || local_dst
capture cookie <name> len <length> 在請(qǐng)求和回應(yīng)包中捕捉記錄指定長(zhǎng)度的cookie,name 為cookie的開頭幾個(gè)字母
Example:
capture cookie ASPSESSION len 32
capture request header <name> len <length>
capture response header <name> len <length> 同上
clitimeout <timeout> (deprecated)
contimeout <timeout> (deprecated) 客戶端超時(shí)時(shí)間，不贊成設(shè)置
cookie <name> [ rewrite | insert | prefix ] [ indirect ] [ nocache ] [ postonly ] [ domain <domain> ]* 允許持續(xù)的基于cookie 的后端連接
default_backend <backend> 默認(rèn)應(yīng)用的后端
Example :
use_backend dynamic if url_dyn
use_backend static if url_css url_img extension_img
default_backend dynamic 當(dāng)沒有匹配時(shí)就用dynamic
errorfile <code> <file> 定義出現(xiàn)錯(cuò)誤的代碼的返回頁
Example :
errorfile 400 /etc/haproxy/errorfiles/400badreq.http
errorfile 403 /etc/haproxy/errorfiles/403forbid.http
errorfile 503 /etc/haproxy/errorfiles/503sorry.http
errorloc <code> <url> errorloc302 <code> <url> 出錯(cuò)重定向到指定url
force-persist { if | unless } <condition> 在特定條件下，強(qiáng)制繼續(xù)連接down 掉的服務(wù)器后端
fullconn <conns> 定義后端組的最大連接數(shù)
grace <time> haproxy停止后，再持續(xù)多長(zhǎng)時(shí)間用于處理連接
http-check disable-on-404 如果后端檢測(cè)返回404，將不再把后端計(jì)入負(fù)載均衡
http-check send-state 允許haproxy 發(fā)送 X-Haproxy-Server-State
http-request { allow | deny | http-auth [realm <realm>] } [ { if | unless } <condition> ] 七層訪問控制
Example:
acl nagios src 192.168.129.3
acl local_net src 192.168.0.0/16
acl auth_ok http_auth(L1)
http-request allow if nagios
http-request allow if local_net auth_ok
http-request auth realm Gimme if local_net auth_ok
http-request deny
Example:
acl auth_ok http_auth_group(L1) G1
http-request auth unless auth_ok
mode { tcp|http|health } 設(shè)定啟動(dòng)的實(shí)例的協(xié)議類型
monitor fail { if | unless } <condition> 監(jiān)控失敗條件設(shè)置
option abortonclose 丟棄由于客戶端等待時(shí)間過長(zhǎng)而關(guān)閉連接但仍在haproxy等待隊(duì)列中的請(qǐng)求
option accept-invalid-http-request 接受無效的http請(qǐng)求，建議關(guān)閉（開啟可能有安全隱患）
option accept-invalid-http-response 接受無效的response ,建議關(guān)閉
option allbackups 應(yīng)該是后備服務(wù)器，如果正常的后端無法使用，就使用這些后備的設(shè)備，balance方式還是用原來的，沒有優(yōu)先的選擇，常用來提供錯(cuò)誤的頁面
option checkcache 分析后端response,阻止可緩存的cookie,它對(duì)response 進(jìn)行嚴(yán)格檢查，包括"Cache-control", "Pragma" and "Set-cookie" ，查看在客戶端代理那邊保存是否有風(fēng)險(xiǎn)，如果這個(gè)允許的話，符全以下條件 的response 將被允許，其它的將被阻止。
- all those without "Set-Cookie" header ;
- all those with a return code other than 200, 203, 206, 300, 301, 410,
provided that the server has not set a "Cache-control: public" header ;
- all those that come from a POST request, provided that the server has not
set a 'Cache-Control: public' header ;
- those with a 'Pragma: no-cache' header
- those with a 'Cache-control: private' header
- those with a 'Cache-control: no-store' header
- those with a 'Cache-control: max-age=0' header
- those with a 'Cache-control: s-maxage=0' header
- those with a 'Cache-control: no-cache' header
- those with a 'Cache-control: no-cache="set-cookie"' header
- those with a 'Cache-control: no-cache="set-cookie,' header
(allowing other fields after set-cookie)
option clitcpka 是否允許客戶端發(fā)送tcp keepalive 包,這個(gè)和http 的keepalive 沒有關(guān)系
option contstats 允許連續(xù)的流量統(tǒng)計(jì)更新
option dontlog-normal 開啟正常連接的日志
option dontlognull 記錄空連接
option forceclose 允許關(guān)閉session 在后端把response 發(fā)送后
option forwardfor [ except <network> ] [ header <name> ] 允許在request 中加入X-Forwarded-For header 發(fā)往server
option http-pretend-keepalive 定義是否haproxy要宣布同server keepalive
option http-server-close 是否開啟在server 端 connection closing
option http-use-proxy-header 用non-standard Proxy-Connection 替換 connection
option httpchk <method> <uri> <version> 允許用http協(xié)議檢查server 的健康
Examples :
# Relay HTTPS traffic to Apache instance and check service availability
# using HTTP request "OPTIONS * HTTP/1.1" on port 80.
backend https_relay
mode tcp
option httpchk OPTIONS * HTTP/1.1\r\nHost:\ www
server apache1 192.168.1.1:443 check port 80
option httplog [ clf ] 定制日志格式
option http_proxy 開啟http 代理模式，只有最基本的代理功能
option ignore-persist { if | unless } <condition> 在某條件下拒絕持續(xù)連接，適用于對(duì)靜態(tài)文件的負(fù)載均衡
option independant-streams 啟用雙向超時(shí)處理，如socket 的read 和write
option log-health-checks 記錄健康檢查日志
option log-separate-errors 對(duì)非完全成功的連接改變?nèi)罩居涗浀燃?jí)
option logasap 大傳輸大文件時(shí)可以提前記錄日志
option mysql-check mysql 健康檢查
option nolinger 清除骯臟連接后開成的tcp 狀態(tài)及占用的資源，不過并不是強(qiáng)列要求你用這個(gè)選項(xiàng)，當(dāng)然如果你有thousands of FIN_WAIT1 sessions on your system ，那肯定得用了
option originalto [ except <network> ] [ header <name> ] 允許在requests中加入X-Original-To header 發(fā)往server
option persist 強(qiáng)制將http請(qǐng)求發(fā)往已經(jīng)down 掉的server
option redispatch 是否允許重新分配在session 失敗后
option smtpchk smtp 檢查
option socket-stats 允許對(duì)單個(gè)socket進(jìn)行統(tǒng)計(jì)
option srvtcpka 是否允許向server 發(fā)送keepalive
option tcpka 是否允許向server和client發(fā)送keepalive
option tcplog 允許記錄tcp 連接的狀態(tài)和時(shí)間
option transparent 允許客戶端透明代理
rate-limit sessions <rate> 設(shè)置frontend 每秒處理的連接的上限，如果到達(dá)上限就停止建立新的connection
redirect location <to> [code <code>] <option> [{if | unless} <condition>]
redirect prefix <to> [code <code>] <option> [{if | unless} <condition>] 重定向，相當(dāng)于rewrite
Example: move the login URL only to HTTPS.
acl clear dst_port 80
acl secure dst_port 8080
acl login_page url_beg /login
acl logout url_beg /logout
acl uid_given url_reg /login?userid=[^&]+
acl cookie_set hdr_sub(cookie) SEEN=1
redirect prefix https:// set-cookie SEEN=1 if !cookie_set
redirect prefix https:// if login_page !secure
redirect prefix http:// drop-query if login_page !uid_given
redirect location http:/// if !login_page secure
redirect location / clear-cookie USERID= if logout
Example: send redirects for request for articles without a '/'.
acl missing_slash path_reg ^/article/[^/]*$
redirect code 301 prefix / drop-query append-slash if missing_slash
redisp (deprecated)
redispatch (deprecated) 開啟session 重新分配在connection連接失敗后，不贊成啟用
reqadd <string> [{if | unless} <cond>] 在http請(qǐng)示的末尾加上string
Example : add "X-Proto: SSL" to requests coming via port 81
acl is-ssl dst_port 81
reqadd X-Proto:\ SSL if is-ssl
reqallow <search> [{if | unless} <cond>]
reqiallow <search> [{if | unless} <cond>] (ignore case) request 請(qǐng)求訪問控制
Example :
# allow www.* but refuse *.local
reqiallow ^Host:\ www\.
reqideny ^Host:\ .*\.local
reqdel <search> [{if | unless} <cond>]
reqidel <search> [{if | unless} <cond>] (ignore case) 刪除請(qǐng)求的head 中的內(nèi)容
Example :
# remove X-Forwarded-For header and SERVER cookie
reqidel ^X-Forwarded-For:.*
reqidel ^Cookie:.*SERVER=
reqdeny <search> [{if | unless} <cond>]
reqideny <search> [{if | unless} <cond>] (ignore case) 拒絕訪問
reqrep <search> <string> [{if | unless} <cond>]
reqirep <search> <string> [{if | unless} <cond>] (ignore case) request 請(qǐng)求替換
Example :
# replace "/static/" with "/" at the beginning of any request path.
reqrep ^([^\ ]*)\ /static/(.*) \1\ /\2
# replace "www.mydomain.com" with "www" in the host name.
reqirep ^Host:\ www.mydomain.com Host:\ www
reqtarpit <search> [{if | unless} <cond>]
reqitarpit <search> [{if | unless} <cond>] (ignore case) 阻止ｈｔｔｐ請(qǐng)求中的某些信息
Examples :
# ignore user-agents reporting any flavour of "Mozilla" or "MSIE", but
# block all others.
reqipass ^User-Agent:\.*(Mozilla|MSIE)
reqitarpit ^User-Agent:
# block bad guys
acl badguys src 10.1.0.3 172.16.13.20/28
reqitarpit . if badguys
retries <value> 當(dāng)對(duì)ｓｅｒｖｅｒ的ｃｏｎｎｅｃｔｉｏｎ失敗后，重試的次數(shù)
rspadd <string> [{if | unless} <cond>] response 增加信息
rspdel <search> [{if | unless} <cond>]
rspidel <search> [{if | unless} <cond>] (ignore case)
rspdeny <search> [{if | unless} <cond>]
rspideny <search> [{if | unless} <cond>] (ignore case)
rsprep <search> <string> [{if | unless} <cond>]
rspirep <search> <string> [{if | unless} <cond>] (ignore case)
以上和request 的差不多
source <addr>[:<port>] [usesrc { <addr2>[:<port2>] | client | clientip } ] 定義從代理出去的連接的對(duì)象，用于限定地址可以訪問server
一些timeout
srvtimeout <timeout> server 處理超時(shí)，不贊成設(shè)置
timeout check X - X X
timeout client X X X -
timeout clitimeout (deprecated) X X X -
timeout connect X - X X
timeout contimeout (deprecated) X - X X
timeout http-keep-alive X X X X
timeout http-request X X X X
timeout queue X - X X
timeout server X - X X
timeout srvtimeout (deprecated) X - X X
timeout tarpit X X X X
stats auth <user>:<passwd> 監(jiān)控統(tǒng)計(jì)的賬號(hào)和密碼
backend public_www
server srv1 192.168.0.1:80
stats enable
stats hide-version
stats scope .
stats uri /admin?stats
stats realm Haproxy\ Statistics
stats auth admin1:AdMiN123
stats auth admin2:AdMiN321
# internal monitoring access (unlimited)
backend private_monitoring
stats enable
stats uri /admin?stats
stats refresh 5s
還有很多參數(shù)，以上能用到的也沒有幾個(gè)，只要滿足當(dāng)前需求就好，對(duì)于性能要求高的話，建議把不需要的功能 都關(guān)了吧
