HAProxy 3.3 Documentation

https://www.haproxy.org/download/3.3/doc/
Admin
HAProxy is a free, open-source software solution that provides a high availability load balancer and...
Tokens:123,425
Snippets:1,836
Trust Score:9.9
Update:1 month ago
Show doc for...
Tokens:
Raw
### Example TCP Frontend and Backend Configuration

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

A complete configuration example showing a TCP frontend with logging enabled and a corresponding backend.

```haproxy
        frontend fnt
            mode tcp
            option tcplog
            log global
            default_backend bck

        backend bck
            server srv1 127.0.0.1:8000
```

--------------------------------

### Tokenization and argument parsing example

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Demonstrates how the configuration parser tokenizes and reassembles arguments.

```text
.if streq("$ENABLE_SSL",     1)
  |---|--------------------|   |--|
    1           2               3
```

```text
.if streq(0, 1)
  |---|-------|--|
    1     2     3
```

```text
.if streq(0, 1)
  |---|-----|-|--|
    \    \    \  \_ argument2: " 1"
     \    \    \___ argument1: "0"
      \    \_______ function: "streq"
       \___________ directive: ".if"
```

--------------------------------

### Full HAProxy ACME configuration example

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

A complete example showing global settings, frontend binding, and multiple ACME sections for RSA and ECDSA certificates.

```haproxy
global
    expose-experimental-directives
    httpclient.resolvers.prefer ipv4

frontend in
    bind *:80
    bind *:443 ssl
    http-request return status 200 content-type text/plain lf-string "%[path,field(-1,/)].%[path,field(-1,/),map(virt@acme)]\n" if { path_beg '/.well-known/acme-challenge/' }
    ssl-f-use crt "foo.example.com.pem.rsa"   acme LE1 domains "foo.example.com.pem,bar.example.com"
    ssl-f-use crt "foo.example.com.pem.ecdsa" acme LE2 domains "foo.example.com.pem,bar.example.com"

acme LE1
    directory https://acme-staging-v02.api.letsencrypt.org/directory
    account-key /etc/haproxy/letsencrypt.account.key
    contact john.doe@example.com
    challenge http-01
    keytype RSA
    bits 2048
    map virt@acme

acme LE2
    directory https://acme-staging-v02.api.letsencrypt.org/directory
    account-key /etc/haproxy/letsencrypt.account.key
    contact john.doe@example.com
    challenge http-01
    keytype ECDSA
    curves P-384
    map virt@acme
```

--------------------------------

### OCSP Update Log Examples

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Log output examples for successful OCSP updates and HTTP errors during the update process.

```text
<133>Mar  6 11:16:53 haproxy[14872]: <OCSP-UPDATE> /path_to_cert/foo.pem 1 \
        "Update successful" 0 1
```

```text
<133>Mar  6 11:18:55 haproxy[14872]: <OCSP-UPDATE> /path_to_cert/bar.pem 2 \
        "HTTP error" 1 0
<133>Mar  6 11:18:55 haproxy[14872]: -:- [06/Mar/2023:11:18:52.200] \
        <OCSP-UPDATE> -/- 2/0/-1/-1/3009 503 217 - - SC-- 0/0/0/0/3 0/0 {} \
        "GET http://127.0.0.1:12345/MEMwQT HTTP/1.1"
```

--------------------------------

### Configure Default Log Format

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Example configuration for the default log format and its corresponding log output.

```haproxy
listen www
    mode http
    log global
    server srv1 127.0.0.1:8000
```

```text
>>> Feb  6 12:12:09 localhost \
      haproxy[14385]: Connect from 10.0.1.2:33312 to 10.0.3.31:8012 \
      (www/HTTP)
```

--------------------------------

### Enable HTTP logging in a frontend

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Example configuration for a frontend using HTTP mode and standard logging.

```haproxy
frontend http-in
    mode http
    option httplog
    log global
    default_backend bck
```

--------------------------------

### Configure Peers with Bind and SSL

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Example demonstrating the use of the bind keyword and default-server settings within a peers section.

```haproxy
     peers mypeers
        bind 192.168.0.1:1024 ssl crt mycerts/pem
        default-server ssl verify none
        server haproxy1 #local peer
        server haproxy2 192.168.0.2:1024
        server haproxy3 10.2.0.1:1024
```

--------------------------------

### Configure Peers and Backend Stick-Table

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Example showing the legacy peer declaration and a backend using a stick-table with peers.

```haproxy
    # The old way.
    peers mypeers
        peer haproxy1 192.168.0.1:1024
        peer haproxy2 192.168.0.2:1024
        peer haproxy3 10.2.0.1:1024

    backend mybackend
        mode tcp
        balance roundrobin
        stick-table type ip size 20k peers mypeers
        stick on src

        server srv1 192.168.0.30:80
        server srv2 192.168.0.31:80
```

--------------------------------

### IPv4 Address Matching Examples

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Examples of IPv4 address notation including standard, abbreviated, and CIDR netmask formats.

```text
    +------------------+------------------+------------------+
    |   Example 1      |     Example 2    |     Example 3    |
    +------------------+------------------+------------------+
    |  192.168.0.1     |   10.0.0.12      |   127.0.0.1      |
    |  192.168.1       |   10.12          |   127.1          |
    |  192.168.0.1/22  |   10.0.0.12/8    |   127.0.0.1/8    |
    |  192.168.1/22    |   10.12/8        |   127.1/8        |
    +------------------+------------------+------------------+
```

--------------------------------

### Define HAProxy Backend Server

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Example configuration for a backend named static with a single server.

```text
        backend static
            server srv1 127.0.0.1:8000
```

--------------------------------

### Set Default Server Parameters

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Example of setting default options for servers within a backend.

```HAProxy
default-server inter 1000 weight 13
```

--------------------------------

### Minimal Server State Configuration

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Example configuration for enabling server state persistence in HAProxy.

```haproxy
global
 stats socket /tmp/socket
 server-state-base /etc/haproxy/states

defaults
 load-server-state-from-file local

backend bk
 server s1 127.0.0.1:22 check weight 11
 server s2 127.0.0.1:22 check weight 12
```

--------------------------------

### Configure LOG Backend Load Balancing

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Examples of configuring global logging and specific backends for log distribution.

```haproxy
global
  log backend@mylog-rrb local0 # send all logs to mylog-rrb backend
  log backend@mylog-hash local0 # send all logs to mylog-hash backend

backend mylog-rrb
  mode log
  balance roundrobin

  server s1 udp@127.0.0.1:514 # will receive 50% of log messages
  server s2 udp@127.0.0.1:514

backend mylog-hash
  mode log

  # extract "METHOD URL PROTO" at the end of the log message,
  # and let haproxy hash it so that log messages generated from
  # similar requests get sent to the same syslog server:
  balance log-hash 'field(-2,")'

  # server list here
  server s1 127.0.0.1:514
  #...
```

--------------------------------

### Configure SSL/TLS Ciphers

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Example of setting cipher suites for TLSv1.2 and earlier, and TLSv1.3.

```HAProxy Configuration
          ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256
          ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
```

--------------------------------

### Test HAProxy configuration syntax

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Command to validate the configuration file syntax before starting the service.

```bash
$ sudo haproxy -f configuration.conf -c
```

--------------------------------

### Define a complete FastCGI proxy configuration

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Example showing frontend, backend, and fcgi-app configuration blocks for a PHP application.

```text
frontend front-http
    mode http
    bind *:80
    bind *:

    use_backend back-dynamic if { path_reg ^/.+\.php(/.*)?$ }
    default_backend back-static

backend back-static
    mode http
    server www A.B.C.D:80

backend back-dynamic
    mode http
    use-fcgi-app php-fpm
    server php-fpm A.B.C.D:9000 proto fcgi

fcgi-app php-fpm
    log-stderr global
    option keep-conn

    docroot /var/www/my-app
    index index.php
    path-info ^(/.+\.php)(/.*)?$
```

--------------------------------

### Configure HTTPS Frontend and Backend

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Example configuration for an HTTPS frontend and a backend server using SSL certificates.

```haproxy
frontend https-in
    mode http
    option httpslog
    log global
    bind *:443 ssl crt mycerts/srv.pem ...
    default_backend bck

backend static
    server srv1 127.0.0.1:8000 ssl crt mycerts/clt.pem ...
```

--------------------------------

### Sample TCP Log Output

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

A raw log line generated by the example configuration provided above.

```text
    >>> Feb  6 12:12:56 localhost \
          haproxy[14387]: 10.0.1.2:33313 [06/Feb/2009:12:12:51.443] fnt \
          bck/srv1 0/0/5007 212 -- 0/0/0/0/3 0/0
```

--------------------------------

### Configure TCP/HTTP Load Balancing Algorithms

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Examples of various balance directives for TCP and HTTP traffic.

```haproxy
balance roundrobin
balance url_param userid
balance url_param session_id check_post 64
balance hdr(User-Agent)
balance hdr(host)
balance hdr(Host) use_domain_only
balance hash req.cookie(clientid)
balance hash var(req.client_id)
balance hash req.hdr_ip(x-forwarded-for,-1),ipmask(24)
```

--------------------------------

### Configure CPU Mapping

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Examples of binding thread groups to specific CPU sets for performance optimization.

```text
cpu-map 1/all 0-3 # bind all threads of the first group on the
                  # first 4 CPUs

cpu-map 1/1- 0-   # will be replaced by "cpu-map 1/1-64 0-63"
                  # or "cpu-map 1/1-32 0-31" depending on the machine's
                  # word size.
```

--------------------------------

### Configure ALPN for HTTP/2 and HTTP/1.1

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Example of advertising multiple protocols for ALPN negotiation in order of preference.

```text
server 127.0.0.1:443 ssl crt pub.pem alpn h2,http/1.1
```

--------------------------------

### Reference Peers Stick-Table in Frontend

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Example showing how to reference a stick-table defined within a peers section from a frontend.

```haproxy
      peers mypeers
          peer A ...
          peer B ...
          table t1 ...

      frontend fe1
          tcp-request content track-sc0 src table mypeers/t1
```

--------------------------------

### Configure CPU Mapping

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Examples of binding threads to specific CPU cores using the cpu-map directive.

```text
# all these lines bind thread 1 to the cpu 0, the thread 2 to cpu 1
      # and so on.
      cpu-map auto:1/1-4   0-3
      cpu-map auto:1/1-4   0-1 2-3
      cpu-map auto:1/1-4   3 2 1 0
      cpu-map auto:1/1-4   3,2,1,0

      # bind each thread to exactly one CPU using all/odd/even keyword
      cpu-map auto:1/all   0-63
      cpu-map auto:1/even  0-31
      cpu-map auto:1/odd   32-63

      # invalid cpu-map because thread and CPU sets have different sizes.
      cpu-map auto:1/1-4   0    # invalid
      cpu-map auto:1/1     0-3  # invalid

      # map 40 threads of those 4 groups to individual CPUs
      cpu-map auto:1/1-10   0-9
      cpu-map auto:2/1-10   10-19
      cpu-map auto:3/1-10   20-29
      cpu-map auto:4/1-10   30-39

      # Map 80 threads to one physical socket and 80 others to another socket
      # without forcing assignment. These are split into 4 groups since no
      # group may have more than 64 threads.
      cpu-map 1/1-40   0-39,80-119    # node0, siblings 0 & 1
      cpu-map 2/1-40   0-39,80-119
      cpu-map 3/1-40   40-79,120-159  # node1, siblings 0 & 1
      cpu-map 4/1-40   40-79,120-159
```

--------------------------------

### Define Listen Sections with Identifiers

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Example showing how section ordering affects assigned identifiers for proxies.

```haproxy
listen foo
    bind :80

listen bar
    bind :81
```

--------------------------------

### Configure Backend Connection Limits

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Example of setting fullconn and server-specific connection limits to manage concurrent requests.

```haproxy
backend dynamic
   fullconn   10000
   server     srv1   dyn1:80 minconn 100 maxconn 1000
   server     srv2   dyn2:80 minconn 100 maxconn 1000
```

--------------------------------

### Example HAProxy Log Entry

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

A sample log line generated by HAProxy showing connection details and timing metrics.

```text
    >>> Feb  6 12:14:14 localhost \
          haproxy[14389]: 10.0.1.2:33317 [06/Feb/2009:12:14:14.655] http-in \
          static/srv1 10/0/30/69/109 200 2750 - - ---- 1/1/1/1/0 0/0 {1wt.eu} \
          {} "GET /index.html HTTP/1.1"
```

--------------------------------

### Configure HTTP Redirection

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Example of using the redir parameter to redirect GET and HEAD requests to an external server.

```text
  Example :  server srv1 192.168.1.1:80 redir http://image1.mydomain.com check
```

--------------------------------

### Configure Server Initialization States

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Examples demonstrating the use of the init-state parameter to control server availability during startup or health check transitions.

```haproxy
      # pass client traffic ONLY to Redis "master" node
      backend redis-master
        mode tcp
        balance first
        option tcp-check
        tcp-check send role\r\n
        tcp-check expect string master
        server-template redis 3 _redis._tcp.redis-headless-service.sandbox.svc.cluster.local:6379 check ... init-state down
```

```haproxy
      # pass traffic to the server only after 3 successful health checks
      backend google-backend
        mode http
        server srv1 google.com:80 check init-state fully-down rise 3
        server srv2 google.com:80 check init-state fully-down rise 3
```

--------------------------------

### Restrict HTTP Methods via ACL

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Example demonstrating how to use the method fetch to restrict allowed HTTP methods to GET and HEAD.

```haproxy
# only accept GET and HEAD requests
acl valid_method method GET HEAD
http-request deny if ! valid_method
```

--------------------------------

### Frontend Connection Error Log Examples

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Examples of various HAProxy connection error log entries and their corresponding interpretations.

```text
>>> haproxy[18113]: 127.0.0.1:34548 [15/Oct/2003:15:18:55.798] px-http \
      px-http/<NOSRV> -1/-1/-1/-1/8490 -1 0 - - CR-- 2/2/2/0/0 0/0 ""
```

```text
>>> haproxy[18113]: 127.0.0.1:34549 [15/Oct/2003:15:19:06.103] px-http \
     px-http/<NOSRV> -1/-1/-1/-1/50001 408 0 - - cR-- 2/2/2/0/0 0/0 ""
```

```text
>>> haproxy[18989]: 127.0.0.1:34550 [15/Oct/2003:15:24:28.312] px-tcp \
      px-tcp/srv1 0/0/5007 0 cD 0/0/0/0/0 0/0
```

```text
>>> haproxy[18989]: 10.0.0.1:34552 [15/Oct/2003:15:26:31.462] px-http \
      px-http/srv1 3183/-1/-1/-1/11215 503 0 - - SC-- 205/202/202/115/3 \
      0/0 "HEAD / HTTP/1.0"
```

--------------------------------

### Configure init-addr resolution order

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Examples showing how to set the order of address resolution methods for servers using FQDNs.

```haproxy
defaults
    # never fail on address resolution
    default-server init-addr last,libc,none
```

```haproxy
defaults
    # disable libc resolution in combination with resolvers
    default-server init-addr last,none
```

--------------------------------

### Sample Fetch Method Syntax

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Standard syntax patterns for calling sample fetch methods.

```HAProxy
   - name
   - name(arg1)
   - name(arg1,arg2)
```

--------------------------------

### Redirect HTTP Request

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Example of a redirect directive used in HAProxy configuration.

```text
http-request redirect location /goaway if ABUSE
```

--------------------------------

### Configure log destinations and levels

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Examples of various log configurations including systemd, stdout, stderr, and remote syslog servers.

```text
log global
log stdout format short daemon          # send log to systemd
log stdout format raw daemon            # send everything to stdout
log stderr format raw daemon notice     # send important events to stderr
log 127.0.0.1:514 local0 notice         # only send important events
log tcp@127.0.0.1:514 local0 notice notice  # same but limit output
                                            # level and send in tcp
log "${LOCAL_SYSLOG}:514" local0 notice   # send to local server
```

--------------------------------

### Supported predicates

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Examples of built-in predicates used within conditional expressions.

```text
awslc_api_atleast(35)
```

```text
awslc_api_before(26)
```

```text
defined(<name>)
```

--------------------------------

### Conditional Configuration Examples

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Demonstrates using environment variables, feature flags, and version checks to conditionally apply HAProxy configuration settings.

```HAProxy Configuration
   # 1. HAPROXY_MWORKER variable is set automatically by HAProxy in master and
   # in worker process environments (see HAProxy variables matrix from
   # 2.3. Environment variables). Its presence enables an additional listener.

   global
     master-worker

   .if defined(HAPROXY_MWORKER)
       listen mwcli_px
          bind :1111
          ...
   .endif

   # 2. HAPROXY_BRANCH is set automatically by HAProxy in master and in worker
   # process environments (see HAProxy variables matrix from 2.3. Environment
   # variables). We check HAPROXY_BRANCH value and conditionally enable
   # mworker-max-reloads parameter.

   global
     master-worker

   .if streq("$HAPROXY_BRANCH",3.1)
        mworker-max-reloads 5
   .endif

   # 3. Some arbitrary environment variables are set by user in the global
   # section. If HAProxy is started in master-worker mode, they are presented in
   # master and in worker process environments. We check values of these
   # variables and conditionally enable ports 80 and 443. Environment variables
   # checks can be mixed with features and version checks.

   global
     setenv WITH_SSL yes
     unsetenv SSL_ONLY

   .if strneq("$SSL_ONLY",yes)
          bind :80
   .endif

   .if streq("$WITH_SSL",yes)
     .if feature(OPENSSL)
          bind :443 ssl crt ...
     .endif
   .endif

   .if feature(OPENSSL) && (streq("$WITH_SSL",yes) || streq("$SSL_ONLY",yes))
          bind :443 ssl crt ...
   .endif

   .if version_atleast(2.4-dev19)
       profiling.memory on
   .endif

   .if !feature(OPENSSL)
       .alert "SSL support is mandatory"
   .endif
```

--------------------------------

### Set Encrypted Header

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Example of setting an encrypted header using aes_gcm_enc.

```HAProxy Configuration
http-response set-header X-Encrypted-Text %[var(txn.plain),\
  aes_gcm_enc(128,txn.nonce,Zm9vb2Zvb29mb29wZm9vbw==,txn.aead_tag)]
```

--------------------------------

### Example Log Output with Header Captures

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Sample log lines demonstrating how captured headers appear in the logs enclosed in braces.

```Log
>>> Aug  9 20:26:09 localhost \
      haproxy[2022]: 127.0.0.1:34014 [09/Aug/2004:20:26:09] proxy-out \
      proxy-out/cache1 0/0/0/162/+162 200 +350 - - ---- 0/0/0/0/0 0/0 \
      {fr.adserver.yahoo.co||http://fr.f416.mail.} {|864|private||} \
      "GET http://fr.adserver.yahoo.com/"

>>> Aug  9 20:30:46 localhost \
      haproxy[2022]: 127.0.0.1:34020 [09/Aug/2004:20:30:46] proxy-out \
      proxy-out/cache1 0/0/0/182/+182 200 +279 - - ---- 0/0/0/0/0 0/0 \
      {w.ods.org||} {Formilux/0.1.8|3495|||} \
      "GET http://trafic.1wt.eu/ HTTP/1.1"

>>> Aug  9 20:30:46 localhost \
      haproxy[2022]: 127.0.0.1:34028 [09/Aug/2004:20:30:46] proxy-out \
      proxy-out/cache1 0/0/2/126/+128 301 +223 - - ---- 0/0/0/0/0 0/0 \
      {www.sytadin.equipement.gouv.fr||http://trafic.1wt.eu/} \
      {Apache|230|||http://www.sytadin.} \
      "GET http://www.sytadin.equipement.gouv.fr/ HTTP/1.1"
```

--------------------------------

### Configure Cookie Persistence

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Examples of declaring persistence cookies with various modes and constraints.

```HAProxy
cookie JSESSIONID prefix
cookie SRV insert indirect nocache
cookie SRV insert postonly indirect
cookie SRV insert indirect nocache maxidle 30m maxlife 8h
```

--------------------------------

### Configure ACME domains

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Example of loading a certificate with ACME enabled and specifying associated domains.

```text
load crt "example.com.pem" acme LE domains "bar.example.com,foo.example.com"
```

--------------------------------

### Define Default Certificates on Bind Lines

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Examples showing how to specify multiple default certificates using the default-crt option on a bind line.

```text
# this bind line has 2 default certificates
bind *:443 default-crt foobar.pem.rsa default-crt foobar.pem.ecdsa crt website.pem.rsa

# this bind line has 3 default certificates
bind *:443 crt website.pem.rsa default-crt foobar.pem.rsa default-crt foobar.pem.ecdsa
```

--------------------------------

### Retrieve Subject Distinguished Name Format

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Example of retrieving the subject DN in a specific format.

```text
ssl_c_s_dn(,0,rfc2253)
```

--------------------------------

### Configure QUIC Congestion Control Algorithms

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Examples of setting the congestion control algorithm for QUIC listeners, including optional window size parameters.

```text
# newreno congestion control algorithm
quic-cc-algo newreno
# cubic congestion control algorithm with one megabytes as window
quic-cc-algo cubic(1m)
```

--------------------------------

### Retrieve Issuer Distinguished Name Format

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Example of retrieving the issuer DN in a specific format.

```text
ssl_c_i_dn(,0,rfc2253)
```

--------------------------------

### Configure Server State Loading

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Example of a minimal configuration to enable seamless reloads by loading server states from a file.

```HAProxy
      global
       stats socket /tmp/socket
       server-state-file /tmp/server_state

      defaults
       load-server-state-from-file global

      backend bk
       server s1 127.0.0.1:22 check weight 11
       server s2 127.0.0.1:22 check weight 12
```

--------------------------------

### Equivalent log-format configurations

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Demonstrates various ways to achieve the same log-format output using different combinations of quoting and escaping.

```text
log-format %{+Q}o\ %t\ %s\ %{-Q}r
log-format "%{+Q}o %t %s %{-Q}r"
log-format '%{+Q}o %t %s %{-Q}r'
log-format "%{+Q}o %t"' %s %{-Q}r'
log-format "%{+Q}o %t"' %s'\ %{-Q}r
```

--------------------------------

### Define Default Backend

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Example of routing traffic to a default backend when no specific rules match.

```HAProxy
use_backend     dynamic  if  url_dyn
use_backend     static   if  url_css url_img extension_img
default_backend dynamic
```

--------------------------------

### Select backends using ACLs

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Examples of defining ACLs to match URL paths and host headers for backend routing.

```text
   acl url_static  path_beg         /static /images /img /css
   acl url_static  path_end         .gif .png .jpg .css .js
   acl host_www    hdr_beg(host) -i www
   acl host_static hdr_beg(host) -i img. video. download. ftp.
```

--------------------------------

### Equivalent Configuration Styles

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Demonstrates that whitespace and comments are treated as delimiters, making different formatting styles functionally equivalent.

```haproxy
global#this is the global section
daemon#daemonize
    frontend         foo
mode             http   # or tcp
```

```haproxy
global
    daemon

# this is the public web frontend
frontend foo
    mode http
```

--------------------------------

### Configure HAProxy Statistics

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Examples demonstrating how to enable statistics, hide version information, and configure authentication for backends.

```HAProxy Configuration
    # public access (limited to this backend only)
    backend public_www
        server srv1 192.168.0.1:80
        stats enable
        stats hide-version
        stats scope   .
        stats uri     /admin?stats
        stats realm   HAProxy\ Statistics
        stats auth    admin1:AdMiN123
        stats auth    admin2:AdMiN321

    # internal monitoring access (unlimited)
    backend private_monitoring
        stats enable
        stats uri     /admin?stats
        stats refresh 5s
```

--------------------------------

### Configure Trace Subsystems

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Example of defining trace rings and configuring trace subsystems for debugging purposes.

```haproxy
ring buf1
  size 10485760 # 10MB
  format timed
  backing-file /tmp/h1.traces

ring buf2
  size 10485760 # 10MB
  format timed
  backing-file /tmp/h2.traces

traces
  trace h1 sink buf1 level developer verbosity complete start now
  trace h2 sink buf1 level developer verbosity complete start now
```

--------------------------------

### SSL and Stick-Counter Configuration Directives

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

Global configuration settings for tuning SSL behavior and stick-counter memory allocation.

```text
tune.ssl.keyupdate-rate-limit <limit>
```

```text
tune.ssl.lifetime <timeout>
```

```text
tune.ssl.maxrecord <number>
```

```text
tune.ssl.ssl-ctx-cache-size <number>
```

```text
tune.stick-counters <number>
```

--------------------------------

### Basic HAProxy Configuration Example

Source: https://www.haproxy.org/download/3.3/doc/configuration.txt

A standard configuration for an HTTP proxy that listens on port 80 and forwards traffic to a backend server.

```text
    # Simple configuration for an HTTP proxy listening on port 80 on all
    # interfaces and forwarding requests to a single backend "servers" with a
    # single server "server1" listening on 127.0.0.1:8000
    global
        daemon
        maxconn 256

    defaults
        mode http
        timeout connect 5000ms
        timeout client 50000ms
        timeout server 50000ms

    frontend http-in
        bind *:80
        default_backend servers

    backend servers
        server server1 127.0.0.1:8000 maxconn 32
```
Tokens:
Raw