• stats uri : /haproxy?stats

• stats realm : "HAProxy Statistics"
• stats auth : no authentication
• stats scope : no restriction

示例如下:

# public access (limited to this backend only)
backend public_www 
    server srv1 192.168.0.1:80 
    stats enable 
    stats hide-version 
    stats scope . 
    stats uri /admin?stats 
    stats realm Haproxy\ Statistics 
    stats auth admin1:AdMiN123 
    stats auth admin2:AdMiN321

 # internal monitoring access (unlimited)
backend private_monitoring 
    stats enable 
    stats uri  /admin?stats 
    stats refresh 5s

server <name> <address>[:[port]] [param*]:可用在listen,backend中定義一個(gè)后端主機(jī),其中部分可選params如下:

addr <ipv4|ipv6>: 健康狀態(tài)檢測(cè)的專用地址
backup
check: 執(zhí)行健康狀態(tài)檢測(cè).默認(rèn)為傳輸層檢測(cè).需要執(zhí)行應(yīng)用層檢測(cè)需要"httpchk","smtpchk", "mysql-check", "pgsql-check" and "ssl-hello-chk"
inter <delay>: 時(shí)間間隔,默認(rèn)為2秒
rise <count>: 判定為"健康"狀態(tài)需要檢測(cè)的次數(shù),默認(rèn)2次.
fall <count>: 判定為"不健康"狀態(tài)需要檢測(cè)的次數(shù),默認(rèn)為3次.
port <port>:健康狀態(tài)檢測(cè)時(shí)使用的端口.
注意：默認(rèn)為傳輸層檢測(cè)，即探測(cè)端口是否能響應(yīng)；需要執(zhí)行應(yīng)用層檢測(cè)，則需要httpchk, smtpchk, mysql-check, pgsql-check, ssl-hello-chk；
cookie <value>: 為當(dāng)前server指定其cookie值,此值會(huì)在收到請(qǐng)求報(bào)文時(shí)進(jìn)行檢測(cè),其功能在于實(shí)現(xiàn)基于cookie會(huì)話保持.
disabled:將些server標(biāo)記為不可用,進(jìn)入維護(hù)模式.
id <value>: 為此server設(shè)置保持id(正數(shù)且唯一),當(dāng)調(diào)度算法first為根據(jù)這個(gè)數(shù)值較小的id先進(jìn)行調(diào)度
maxconn <maxconn>: 當(dāng)前server的最大并發(fā)連接數(shù).
maxqueue <maxqueue>: 當(dāng)前server的等待隊(duì)列的最大長(zhǎng)度.
redir <prefix>: 將發(fā)往當(dāng)前server的所有請(qǐng)求會(huì)被重定向到別的主機(jī)(給出 scheme://host即可)如下示例:
server srv1 192.168.1.1:80 redir http://image1.mydomain.com check
weight <weight>: 當(dāng)前server的權(quán)重.

option httpchk: uri默認(rèn)為主頁
option httpchk <uri>
option httpchk <method> <uri>
option httpchk <method> <uri> <version>
以上在defaults,listen,backend可用,開啟HTTP協(xié)議,檢查服務(wù)器健康狀態(tài).

# Relay HTTPS traffic to Apache instance and check service availability
# using HTTP request "OPTIONS * HTTP/1.1" on port 80.
backend https_relay 
    mode tcp 
    option httpchk OPTIONS * HTTP/1.1\r\nHost:\ www 
    server apache1 192.168.1.1:443 check port 80

http-check expect [!] <match> <pattern>:在defaults ,listen,backend中可用期望在做健康狀態(tài)檢測(cè)時(shí)返回的內(nèi)容
match為status或string
示例: http-check expect status 200

cookie <name> [ rewrite | insert | prefix ] [ indirect ] [ nocache ] [ postonly ] [ preserve ] [ httponly ] [ secure ] [ domain <domain> ]* [ maxidle <idle> ] [ maxlife <life> ]
可在defaults,listen,backend使用,啟用基于cookie的會(huì)話綁定,需要結(jié)合server參數(shù)的cookie參數(shù)一起實(shí)現(xiàn)

rewrite: 這個(gè)關(guān)鍵字表明 這個(gè)將由server提供的cookie以及haproxy將會(huì)修改這個(gè)cookie,如何修改呢?將server的id放入. 當(dāng)由"Set-cookie"與"Cache-control"組成的復(fù)雜的首部離開應(yīng)用程序時(shí)這個(gè)模式會(huì)便于管理.

示例1:

cookie JSESSIONID prefix
cookie SRV insert indirect nocache
cookie SRV insert postonly indirect
cookie SRV insert indirect nocache maxidle 30m maxlife 8h

示例2(結(jié)合server的cookie參數(shù)),效果如下截圖,會(huì)把server發(fā)給client的cookie添加一個(gè)鍵值對(duì):

cookie WEBSRV insert indirect nocache
server web1 10.1.1.78:80 check weight 2 maxconn 5000 cookie WEB1   
server web2 10.1.1.79:80 check weight 1 maxconn 3000 cookie WEB2

Paste_Image.png

default_backend <backend>:設(shè)定默認(rèn)的backend,當(dāng)沒有 "use_backend" 規(guī)則被匹配時(shí).

與日志相關(guān)的
log global
log <address> [len <length>] <facility> [<level> [<minlevel>]]
no log
為frontend或backend定義日志記錄機(jī)制

示例說明

Tq: 等待客戶端發(fā)送一個(gè)完整的HTTP請(qǐng)求總共花費(fèi)的時(shí)間(毫秒),但不計(jì)算數(shù)據(jù),-1表示未連接
Tw: 在等待各隊(duì)列時(shí)所花費(fèi)的總時(shí)間(毫秒) It can be "-1" if the connection was aborted before reaching the queue.
Tc: 等待與最終服務(wù)器創(chuàng)建連接所需要的總時(shí)間(毫秒) 包含重試的It can be "-1" if the request was aborted before a connection could be established.
Tr:等待服務(wù)器發(fā)送一個(gè)完整的HTTP響應(yīng)總共花費(fèi)的時(shí)間(毫秒),但不計(jì)算數(shù)據(jù)
Tt

capture request header <name> len <length>:捕獲并記錄于日志 最近指定的請(qǐng)求首部.
capture response header <name> len <length>:
示例:

capture response header Content-length len 9
capture response header Location len 15

錯(cuò)誤頁面自定義相關(guān)參數(shù)

errorfile <code> <file>:Return a file contents instead of errors generated by HAProxy,可定義在defaults,frontend,listen,backend中,返回一個(gè)自定義文件內(nèi)容以替代HAProxy生成的錯(cuò)誤,示例如下

errorfile 400 /etc/haproxy/errorfiles/400badreq.http
errorfile 408 /dev/null # workaround Chrome pre-connect bug
errorfile 403 /etc/haproxy/errorfiles/403forbid.http
errorfile 503 /etc/haproxy/errorfiles/503sorry.http

errorloc <code> <url>
errorloc302 <code> <url>:Return an HTTP redirection to a URL instead of errors generated by HAProxy,可用在defaults,frontend,listen,backend中,返回一個(gè)HTTP重定向而不是由HAProxy生成的錯(cuò)誤頁面.
示例 errorloc 503 http://10.1.1.77:8090/errorpagetest.html

與修改請(qǐng)求或響應(yīng)報(bào)文相關(guān)
option forwardfor [ except <network> ] [ header <name> ] [ if-none ]:
Enable insertion of the X-Forwarded-For header to requests sent to servers允許插入一個(gè)X-Forwarded-For請(qǐng)求首部到server.X-Forwarded-For代表HTTP 請(qǐng)求端真實(shí) IP X-Forwarded-For: client, proxy1, proxy2

rspadd <string> [{if | unless} <cond>]: 示例rspadd X-Via:\ Haproxy
Add a header at the end of the HTTP response
reqadd <string> [{if | unless} <cond>]
Add a header at the end of the HTTP request
reqdel <search> [{if | unless} <cond>]
reqidel <search> [{if | unless} <cond>] (ignore case)
Delete all headers matching a regular expression in an HTTP request
rspdel <search> [{if | unless} <cond>]
rspidel <search> [{if | unless} <cond>] (ignore case)
Delete all headers matching a regular expression in an HTTP response
示例: rspidel Server.* 刪除以Server開頭的響應(yīng)報(bào)頭.

超時(shí)時(shí)長(zhǎng)相關(guān)參數(shù)
timeout client <timeout>
Set the maximum inactivity time on the client side.單位是毫秒
timeout server <timeout>
Set the maximum inactivity time on the server side.
timeout connect <timeout>
Set the maximum time to wait for a connection attempt to a server to succeed.
timeout http-keep-alive <timeout>
Set the maximum allowed time to wait for a new HTTP request to appear面向客戶端一側(cè)開啟保持連接功能
timeout client-fin <timeout>
Set the inactivity timeout on the client side for half-closed connections.設(shè)置客戶端一側(cè)半關(guān)閉連接時(shí)超時(shí)時(shí)長(zhǎng)
timeout server-fin <timeout>
Set the inactivity timeout on the server side for half-closed connections.

timeout http-request <timeout>
Set the maximum allowed time to wait for a complete HTTP request

timeout http-keep-alive <timeout>
Set the maximum allowed time to wait for a new HTTP request to appear

ACL相關(guān)的參數(shù)
Haproxy 完全能夠勝任從客戶端或服務(wù)器的請(qǐng)求與響應(yīng)流中提取數(shù)據(jù)
Access Control Lists (ACL)提供了一個(gè)靈活的解決方案去執(zhí)行內(nèi)容轉(zhuǎn)換以及根據(jù)從請(qǐng)求或響應(yīng)或者環(huán)境狀態(tài)做出決策.原理很簡(jiǎn)單:

• 從數(shù)據(jù)流,表或環(huán)境中提取數(shù)據(jù)樣本
• 有選擇性地對(duì)這些數(shù)據(jù)樣本做格式轉(zhuǎn)換
• 根據(jù)樣例生成一個(gè)或多個(gè)匹配模式
• 只有當(dāng)樣本與匹配模式匹配時(shí)才對(duì)其執(zhí)行相應(yīng)動(dòng)作
  語法格式:acl <aclname> <criterion> [flags] [operator] [<value>] ...

<value>類型:

boolean
integer or integer range
IP address / network
string (exact, substring, suffix, prefix, subdir, domain)
regular expression
hex block

<flags>類型:

-i : 被模式匹配時(shí)忽略字母大小寫
-f : 從文件加載模式
-m : use a specific pattern matching method,使用特定的模式匹配方法
-n : forbid the DNS resolutions
-M : load the file pointed by -f like a map file.
-u : force the unique id of the ACL
-- : force end of flags. Useful when a string looks like one of the flags.

operator類型:

數(shù)值

eq : true if the tested value equals at least one value
ge : true if the tested value is greater than or equal to at least one value
gt : true if the tested value is greater than at least one value
le : true if the tested value is less than or equal to at least one value
lt : true if the tested value is less than at least one value

字符串

• exact match (-m str) : 精確匹配

• substring match (-m sub) :子串匹配
• prefix match (-m beg) :前綴匹配
• suffix match (-m end) : 后綴匹配
• subdir match (-m dir) : 子目錄匹配
• domain match (-m dom) : 域名子串匹配(以.分隔)

條件的邏輯連接

• AND (implicit)

• OR (explicit with the "or" keyword or the "||" operator)
• Negation with the exclamation mark ("!")

<criterion>

根據(jù)(源與目標(biāo)的)IP與端口來設(shè)置ACL：
dst : ip
dst_port : integer

src : ip
src_port : integer          

示例：

acl myhost src 10.1.0.200
acl myport dst_port 8080
block if !myhost myport

ACL 7(應(yīng)用)層檢查機(jī)制用法：

path(路徑檢查) : string
This extracts the request's URL path, which starts at the first slash and ends before the question mark (without the host part).
ACL derivatives :

path : exact string match
path_beg : prefix match
path_dir : subdir match
path_dom : domain match
path_end : suffix match
path_len : length match
path_reg : regex match
path_sub : substring match
示例：

acl text_file  path_end -i  .txt
block if text_file

請(qǐng)求行首部檢查 :
req.hdr([<name>[,<occ>]]) : string
This extracts the last occurrence of header <name> in an HTTP request.

hdr([<name>[,<occ>]]) : exact string match
hdr_beg([<name>[,<occ>]]) : prefix match
hdr_dir([<name>[,<occ>]]) : subdir match
hdr_dom([<name>[,<occ>]]) : domain match
hdr_end([<name>[,<occ>]]) : suffix match
hdr_len([<name>[,<occ>]]) : length match
hdr_reg([<name>[,<occ>]]) : regex match

hdr_sub([<name>[,<occ>]]) : substring match
示例：

acl firefox hdr_reg(User-Agent) -i  .*firefox.*    
block if firefox

響應(yīng)行首部檢查
res.hdr([<name>[,<occ>]]) : string
This extracts the last occurrence of header <name> in an HTTP response, or of the last header if no <name> is specified.

shdr([<name>[,<occ>]]) : exact string match
shdr_beg([<name>[,<occ>]]) : prefix match
shdr_dir([<name>[,<occ>]]) : subdir match
shdr_dom([<name>[,<occ>]]) : domain match
shdr_end([<name>[,<occ>]]) : suffix match
shdr_len([<name>[,<occ>]]) : length match
shdr_reg([<name>[,<occ>]]) : regex match
shdr_sub([<name>[,<occ>]]) : substring match

url檢查
url : string
This extracts the request's URL as presented in the request.

url : exact string match
url_beg : prefix match
url_dir : subdir match
url_dom : domain match
url_end : suffix match
url_len : length match
url_reg : regex match
url_sub : substring match

請(qǐng)求方法檢查
method : integer + string

acl valid_method method GET HEAD
http-request deny if ! valid_method 

注意：HAProxy有眾多內(nèi)建的ACLs，這些ACLs可直接調(diào)用，例如LOCALHOST，TRUE，HTTP；

HTTP層訪問控制相關(guān)的參數(shù)：
block { if | unless } <condition>
Block a layer 7 request if/unless a condition is matched
阻止符合指定acl的訪問請(qǐng)求；
http-request { allow | deny | tarpit | auth [realm <realm>] | redirect <rule> | add-header <name> <fmt> | set-header <name> <fmt> | del-header <name> | set-nice <nice> | set-log-level <level> | replace-header <name> <match-regex> <replace-fmt> | replace-value <name> <match-regex> <replace-fmt> | set-tos <tos> | set-mark <mark> | add-acl(<file name>) <key fmt> | del-acl(<file name>) <key fmt> | del-map(<file name>) <key fmt> | set-map(<file name>) <key fmt> <value fmt> } [ { if | unless } <condition> ]
http-response { allow | deny | add-header <name> <fmt> | set-nice <nice> | set-header <name> <fmt> | del-header <name> | replace-header <name> <regex-match> <replace-fmt> | replace-value <name> <regex-match> <replace-fmt> | set-log-level <level> | set-mark <mark> | set-tos <tos> | add-acl(<file name>) <key fmt> | del-acl(<file name>) <key fmt> | del-map(<file name>) <key fmt> | set-map(<file name>) <key fmt> <value fmt> } [ { if | unless } <condition> ]:

示例1：

acl myhost          src             10.1.0.67
http-request deny  if  url_admin  !myhost   

示例2

acl nagios src 192.168.129.3
acl local_net src 192.168.0.0/16
acl auth_ok http_auth(L1)

http-request allow if nagios
http-request allow if local_net auth_ok
http-request auth realm Gimme if local_net auth_ok
http-request deny

TCP層訪問控制相關(guān)的參數(shù)：
tcp-request connection <action> [{if | unless} <condition>]
Perform an action on an incoming connection depending on a layer 4 condition
示例

tcp-request connection accept if { src -f /etc/haproxy/whitelist.lst }  # 這里的花括號(hào)部分即是一個(gè)acl
tcp-request connection reject if { src_conn_rate gt 10 }
tcp-request connection track-sc0 src

tcp-request content <action> [{if | unless} <condition>]
Perform an action on a new session depending on a layer 4-7 condition
示例:
后端主機(jī)調(diào)用：
use_backend <backend> [{if | unless} <condition>]
Switch to a specific backend if/unless an ACL-based condition is matched.