Linux: 企业级反向代理HAProxy

TCP 和 HTTP反向代理
SSL/TSL服务器
可以针对HTTP请求添加cookie，进行路由后端服务器
可平衡负载至后端服务器，并支持持久连接
支持所有主服务器故障切换至备用服务器
支持专用端口实现监控服务
支持停止接受新连接请求，而不影响现有连接
可以在双向添加，修改或删除HTTP报文首部
响应报文压缩
支持基于pattern实现连接请求的访问控制
通过特定的URI为授权用户提供详细的状态信息

支持http反向代理
支持动态程序的反向代理
支持基于数据库的反向代理

正向代理--squid，nginx
缓存代理--varnish
web服务--nginx、tengine、apache、php、tomcat
UDP--目前不支持UDP协议
单机性能--相比LVS性能较差

[root@centos7 ~]# yum install haproxy -y
#验证haproxy版本
[root@centos7 ~]# haproxy -v
HA-Proxy version 1.5.18 2016/05/10
Copyright 2000-2016 Willy Tarreau <[email protected]>

[root@centos8 ~]#dnf -y install haproxy
[root@centos8 ~]#haproxy -v
HA-Proxy version 1.8.15 2018/12/13
Copyright 2000-2018 Willy Tarreau <[email protected]>
[root@centos8 ~]#haproxy -vv
HA-Proxy version 1.8.15 2018/12/13
Copyright 2000-2018 Willy Tarreau <[email protected]>
Build options :
TARGET     = linux2628
CPU         = generic
CC             = gcc
CFLAGS     = -O2 -g -fno-strict-aliasing -Wdeclaration-after-statement -fwrapv -
Wno-format-truncation -Wno-null-dereference -Wno-unused-label
OPTIONS = USE_LINUX_TPROXY=1 USE_CRYPT_H=1 USE_GETADDRINFO=1 USE_ZLIB=1
USE_REGPARM=1 USE_OPENSSL=1 USE_LUA=1 USE_SYSTEMD=1 USE_PCRE=1
Default settings :
maxconn = 2000, bufsize = 16384, maxrewrite = 1024, maxpollevents = 200
Built with OpenSSL version : OpenSSL 1.1.1 FIPS     11 Sep 2018
Running on OpenSSL version : OpenSSL 1.1.1c FIPS     28 May 2019
OpenSSL library supports TLS extensions : yes
OpenSSL library supports SNI : yes
OpenSSL library supports : TLSv1.0 TLSv1.1 TLSv1.2 TLSv1.3
Built with Lua version : Lua 5.3.4
Built with transparent proxy support using: IP_TRANSPARENT IPV6_TRANSPARENT
IP_FREEBIND
Encrypted password support via crypt(3): yes
Built with multi-threading support.
Built with PCRE version : 8.42 2018-03-20
Running on PCRE version : 8.42 2018-03-20
PCRE library supports JIT : no (USE_PCRE_JIT not set)
Built with zlib version : 1.2.11
Running on zlib version : 1.2.11
Compression algorithms supported : identity("identity"), deflate("deflate"),
raw-deflate("deflate"), gzip("gzip")
Built with network namespace support.
Available polling systems :
        epoll : pref=300, test result OK
            poll : pref=200, test result OK
        select : pref=150, test result OK
Total: 3 (3 usable), will use epoll.
Available filters :
[SPOE] spoe
[COMP] compression
[TRACE] trace

#wget http://www.nosuchhost.net/~cheese/fedora/packages/epel-7/x86_64/cheese-
release-7-1.noarch.rpm
#rpm -ivh cheese-release-7-1.noarch.rpm
#yum install haproxy
#验证haproxy版本
# haproxy -v
HA-Proxy version 1.8.14-52e4d43 2018/09/20
Copyright 2000-2018 Willy Tarreau <[email protected]>

[root@centos7 ~]#wget https://centos7.iuscommunity.org/ius-release.rpm
[root@centos7 ~]#rpm -Uvh ius-release*rpm
[root@centos7 ~]#yum -y install epel-release
[root@centos7 ~]#rpm -Uvh ius-release*rpm
[root@centos7 ~]#yum install haproxy18u
[root@centos7 ~]#haproxy -v
HA-Proxy version 1.8.23 2019/11/25
Copyright 2000-2019 Willy Tarreau <[email protected]>

#下载安装lua库对应的版本
[root@centos7 ~]#wget https://dl.iuscommunity.org/pub/ius/stable/CentOS/7/x86_64/lua53u-libs-5.3.4-1.ius.centos7.x86_64.rpm
#安装lua库
[root@centos7 ~]#yum -y install lua53u-libs-5.3.4-1.ius.centos7.x86_64.rpm
#下载haproxy
[root@centos7 ~]#wget https://dl.iuscommunity.org/pub/ius/stable/CentOS/7/x86_64/haproxy18u-1.8.20-1.el7.ius.x86_64.rpm
#安装haproxy
[root@centos7 ~]#yum -y install haproxy18u-1.8.20-1.el7.ius.x86_64.rpm
[root@centos7 ~]#haproxy -v
HA-Proxy version 1.8.20 2019/04/25
Copyright 2000-2019 Willy Tarreau <[email protected]>
[root@centos7 ~]#systemctl start haproxy
[root@centos7 ~]#systemctl status haproxy.service
● haproxy.service - HAProxy Load Balancer
    Loaded: loaded (/usr/lib/systemd/system/haproxy.service; disabled; vendor
preset: disabled)
    Active: active (running) since Mon 2020-03-30 21:17:23 CST; 56s ago
Process: 1257 ExecStartPre=/usr/sbin/haproxy -f $CONFIG -c -q (code=exited,
status=0/SUCCESS)
Main PID: 1258 (haproxy)
    CGroup: /system.slice/haproxy.service
                    ├─1258 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p
/run/haproxy.pid
                    └─1260 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p
/run/haproxy.pid
Mar 30 21:17:23 centos7.cici.com systemd[1]: Starting HAProxy Load
Balancer...
Mar 30 21:17:23 centos7.cici.com systemd[1]: Started HAProxy Load
Balancer.

#HAProxy 1.8及1.9版本编译参数：
make     ARCH=x86_64 TARGET=linux2628 USE_PCRE=1 USE_OPENSSL=1 USE_ZLIB=1 USE_SYSTEMD=1     USE_CPU_AFFINITY=1     PREFIX=/usr/local/haproxy
#HAProxy 2.0以上版本编译参数：
[root@centos7 ~]#yum -y install gcc openssl-devel pcre-devel systemd-devel
[root@centos7 ~]#tar xvf haproxy-2.1.3.tar.gz -C /usr/local/src
[root@centos7 ~]#cd /usr/local/src/haproxy-2.1.3/
#查看安装方法
[root@centos7 haproxy-2.1.3]#ll Makefile
-rw-rw-r-- 1 root root 40812 Feb 12 23:18 Makefile
[root@centos7 haproxy-2.1.3]#cat README
[root@centos7 haproxy-2.1.3]#cat INSTALL
#参考INSTALL文件进行编译安装
[root@centos7 haproxy-2.1.3]#make ARCH=x86_64 TARGET=linux-glibc USE_PCRE=1 USE_OPENSSL=1 USE_ZLIB=1 USE_SYSTEMD=1 USE_LUA=1 LUA_INC=/usr/local/src/lua-5.3.5/src/ LUA_LIB=/usr/local/src/lua-5.3.5/src/
[root@centos7 haproxy-2.1.3]# make install PREFIX=/apps/haproxy
[root@centos7 haproxy-2.1.3]#ln -s /apps/haproxy/sbin/haproxy /usr/sbin/
#查看生成的文件
[root@centos7 haproxy-2.1.3]#tree /apps/haproxy/
/apps/haproxy/
├── doc
│        └── haproxy
│                ├── 51Degrees-device-detection.txt
│                ├── architecture.txt
│                ├── close-options.txt
│                ├── configuration.txt
│                ├── cookie-options.txt
│                ├── DeviceAtlas-device-detection.txt
│                ├── intro.txt
│                ├── linux-syn-cookies.txt
│                ├── lua.txt
│                ├── management.txt
│                ├── netscaler-client-ip-insertion-protocol.txt
│                ├── network-namespaces.txt
│                ├── peers.txt
│                ├── peers-v2.0.txt
│                ├── proxy-protocol.txt
│                ├── regression-testing.txt
│                ├── seamless_reload.txt
│                ├── SOCKS4.protocol.txt
│                ├── SPOE.txt
│                └── WURFL-device-detection.txt
├── sbin
│        └── haproxy
└── share
    └── man
            └── man1
                    └── haproxy.1
6 directories, 22 files

#验证HAProxy版本：
[root@centos7 ~]#which haproxy
/usr/sbin/haproxy
[root@centos7 ~]#haproxy -v
HA-Proxy version 2.1.3 2020/02/12 - https://haproxy.org/
Status: stable branch - will stop receiving fixes around Q1 2021.
Known bugs: http://www.haproxy.org/bugs/bugs-2.1.3.html
[root@centos7 ~]#haproxy -v
HA-Proxy version 2.0.14 2020/04/02 - https://haproxy.org/
#大写-V选项显示版本和帮助用法
[root@centos7 ~]#haproxy -V
HA-Proxy version 2.0.14 2020/04/02 - https://haproxy.org/
Usage : haproxy [-f <cfgfile|cfgdir>]* [ -vdVD ] [ -n <maxconn> ] [ -N
<maxpconn> ]
            [ -p <pidfile> ] [ -m <max megs> ] [ -C <dir> ] [-- <cfgfile>*]
                -v displays version ; -vv shows known build options.
                -d enters debug mode ; -db only disables background mode.
                -dM[<byte>] poisons memory with <byte> (defaults to 0x50)
                -V enters verbose mode (disables quiet mode)
                -D goes daemon ; -C changes to <dir> before loading files.
                -W master-worker mode.
                -Ws master-worker mode with systemd notify support.
                -q quiet mode : don't display messages
                -c check mode : only check config files and exit
                -n sets the maximum total # of connections (uses ulimit -n)
                -m limits the usable amount of memory (in MB)
                -N sets the default, per-proxy maximum # of connections (0)
                -L set local peer name (default to hostname)
                -p writes pids of all children to this file
                -de disables epoll() usage even when available
                -dp disables poll() usage even when available
                -dS disables splice usage (broken on old kernels)
                -dG disables getaddrinfo() usage
                -dR disables SO_REUSEPORT usage
                -dr ignores server address resolution failures
                -dV disables SSL verify on servers side
                -sf/-st [pid ]* finishes/terminates old pids.
                -x <unix_socket> get listening sockets from a unix socket
                -S <bind>[,<bind options>...] new master CLI

[root@centos7 ~]#haproxy -vv
HA-Proxy version 2.1.3 2020/02/12 - https://haproxy.org/
Status: stable branch - will stop receiving fixes around Q1 2021.
Known bugs: http://www.haproxy.org/bugs/bugs-2.1.3.html
Build options :
TARGET     = linux-glibc
CPU         = generic
CC             = gcc
CFLAGS     = -m64 -march=x86-64 -O2 -g -fno-strict-aliasing -Wdeclaration-after-
statement -fwrapv -Wno-unused-label -Wno-sign-compare -Wno-unused-parameter -
Wno-old-style-declaration -Wno-ignored-qualifiers -Wno-clobbered -Wno-missing-
field-initializers -Wtype-limits
OPTIONS = USE_PCRE=1 USE_OPENSSL=1 USE_LUA=1 USE_ZLIB=1 USE_SYSTEMD=1
Feature list : +EPOLL -KQUEUE -MY_EPOLL -MY_SPLICE +NETFILTER +PCRE -PCRE_JIT -
PCRE2 -PCRE2_JIT +POLL -PRIVATE_CACHE +THREAD -PTHREAD_PSHARED -REGPARM -
STATIC_PCRE -STATIC_PCRE2 +TPROXY +LINUX_TPROXY +LINUX_SPLICE +LIBCRYPT +CRYPT_H
-VSYSCALL +GETADDRINFO +OPENSSL +LUA +FUTEX +ACCEPT4 -MY_ACCEPT4 +ZLIB -SLZ
+CPU_AFFINITY +TFO +NS +DL +RT -DEVICEATLAS -51DEGREES -WURFL +SYSTEMD -
OBSOLETE_LINKER +PRCTL +THREAD_DUMP -EVPORTS
Default settings :
bufsize = 16384, maxrewrite = 1024, maxpollevents = 200
Built with multi-threading support (MAX_THREADS=64, default=4).
Built with OpenSSL version : OpenSSL 1.0.2k-fips     26 Jan 2017
Running on OpenSSL version : OpenSSL 1.0.2k-fips     26 Jan 2017
OpenSSL library supports TLS extensions : yes
OpenSSL library supports SNI : yes
OpenSSL library supports : SSLv3 TLSv1.0 TLSv1.1 TLSv1.2
Built with Lua version : Lua 5.3.5
Built with network namespace support.
Built with transparent proxy support using: IP_TRANSPARENT IPV6_TRANSPARENT
IP_FREEBIND
Built with PCRE version : 8.32 2012-11-30
Running on PCRE version : 8.32 2012-11-30
PCRE library supports JIT : no (USE_PCRE_JIT not set)
Encrypted password support via crypt(3): yes
Built with zlib version : 1.2.7
Running on zlib version : 1.2.7
Compression algorithms supported : identity("identity"), deflate("deflate"),
raw-deflate("deflate"), gzip("gzip")
Available polling systems :
        epoll : pref=300, test result OK
            poll : pref=200, test result OK
        select : pref=150, test result OK
Total: 3 (3 usable), will use epoll.
Available multiplexer protocols :
(protocols marked as <default> cannot be specified using 'proto' keyword)
                        h2 : mode=HTTP             side=FE|BE         mux=H2
                    fcgi : mode=HTTP             side=BE                 mux=FCGI
            <default> : mode=HTTP             side=FE|BE         mux=H1
            <default> : mode=TCP                 side=FE|BE         mux=PASS
Available services : none
Available filters :
[SPOE] spoe
[CACHE] cache
[FCGI] fcgi-app
[TRACE] trace
[COMP] compression

[root@centos7 ~]#cat /usr/lib/systemd/system/haproxy.service
[Unit]
Description=HAProxy Load Balancer
After=syslog.target network.target
[Service]
ExecStartPre=/usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg     -c -q
ExecStart=/usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p
/var/lib/haproxy/haproxy.pid
ExecReload=/bin/kill -USR2 $MAINPID
[Install]
WantedBy=multi-user.target

#默认缺少配置文件，无法启动
[root@centos7 ~]#systemctl daemon-reload
[root@centos7 ~]#systemctl start haproxy
Job for haproxy.service failed because the control process exited with error
code. See "systemctl status haproxy.service" and "journalctl -xe" for details.
[root@centos7 ~]#tail /var/log/messages
Mar 30 22:28:50 centos7 systemd: haproxy.service: control process exited,
code=exited status=1
Mar 30 22:28:50 centos7 systemd: Failed to start HAProxy Load Balancer.
Mar 30 22:28:50 centos7 systemd: Unit haproxy.service entered failed state.
Mar 30 22:28:50 centos7 systemd: haproxy.service failed.
Mar 30 22:28:54 centos7 systemd: Starting HAProxy Load Balancer...
Mar 30 22:28:54 centos7 haproxy: [ALERT] 089/222854 (28223) : Cannot open
configuration file/directory /etc/haproxy/haproxy.cfg : No such file or
directory
Mar 30 22:28:54 centos7 systemd: haproxy.service: control process exited,
code=exited status=1
Mar 30 22:28:54 centos7 systemd: Failed to start HAProxy Load Balancer.
Mar 30 22:28:54 centos7 systemd: Unit haproxy.service entered failed state.
Mar 30 22:28:54 centos7 systemd: haproxy.service failed.

#查看配置文件范例
[root@centos7 ~]#tree /usr/local/src/haproxy-2.1.3/examples/
/usr/local/src/haproxy-2.1.3/examples/
├── acl-content-sw.cfg
├── content-sw-sample.cfg
├── errorfiles
│        ├── 400.http
│        ├── 403.http
│        ├── 408.http
│        ├── 500.http
│        ├── 502.http
│        ├── 503.http
│        ├── 504.http
│        └── README
├── haproxy.init
├── option-http_proxy.cfg
├── socks4.cfg
├── transparent_proxy.cfg
└── wurfl-example.cfg
1 directory, 15 files
#创建自定义的配置文件
[root@centos7 ~]# mkdir /etc/haproxy
[root@centos7 ~]# vim /etc/haproxy/haproxy.cfg
global
    maxconn 100000
        chroot /apps/haproxy
    stats socket /var/lib/haproxy/haproxy.sock mode 600 level admin
        #uid 99
        #gid 99
    user haproxy
    group haproxy
    daemon
        #nbproc 4
        #cpu-map 1 0
        #cpu-map 2 1
        #cpu-map 3 2
        #cpu-map 4 3
    pidfile /var/lib/haproxy/haproxy.pid
    log 127.0.0.1 local2 info
defaults
    option http-keep-alive
    option forwardfor
    maxconn 100000
    mode http
    timeout connect 300000ms
    timeout client 300000ms
    timeout server 300000ms
listen stats
    mode http
    bind 0.0.0.0:9999
    stats enable
    log global
    stats uri         /haproxy-status
    stats auth     haadmin:123456
listen web_port
    bind 10.0.0.7:80
    mode http
    log global
    server web1     127.0.0.1:8080 check inter 3000 fall 2 rise 5

#准备socket文件目录
[root@centos7 ~]# mkdir /var/lib/haproxy
#设置用户和目录权限
[root@centos7 ~]# useradd -r -s /sbin/nologin -d /var/lib/haproxy haproxy
[root@centos7 ~]# systemctl enable --now haproxy

[root@centos7 ~]#systemctl status haproxy
● haproxy.service - HAProxy Load Balancer
    Loaded: loaded (/usr/lib/systemd/system/haproxy.service; disabled; vendor
preset: disabled)
    Active: active (running) since Mon 2020-03-30 20:45:20 CST; 4min 45s ago
Process: 1362 ExecStartPre=/usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg -c -q
(code=exited, status=0/SUCCESS)
Main PID: 1363 (haproxy)
    CGroup: /system.slice/haproxy.service
                    ├─1363 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p
/var/lib/haproxy/haproxy.pid
                    └─1366 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p
/var/lib/haproxy/haproxy.pid
Mar 30 20:45:20 centos7.cici.com systemd[1]: Starting HAProxy Load
Balancer...
Mar 30 20:45:20 centos7.cici.com systemd[1]: Started HAProxy Load
Balancer.
Mar 30 20:45:20 centos7.cici.com haproxy[1363]: [NOTICE] 089/204520
(1363) : New worker #1 (1366...ked
Mar 30 20:45:20 centos7.cici.com haproxy[1363]: [WARNING] 089/204520
(1366) : Server web_port/we...ue.
Mar 30 20:45:20 centos7.cici.com haproxy[1363]: [ALERT] 089/204520
(1366) : proxy 'web_port' has...le!
Hint: Some lines were ellipsized, use -l to show in full.
[root@centos7 ~]# pstree -p |grep haproxy
                    |-haproxy(28101)---haproxy(28105)

defaults [<name>]   #默认配置项，针对以下的frontend、backend和listen生效，可以多个name也可以没有name
frontend <name>     #前端servername，类似于Nginx的一个虚拟主机 server和LVS服务集群。
backend <name>      #后端服务器组，等于nginx的upstream和LVS中的RS服务器
listen     <name>   #将frontend和backend合并在一起配置，相对于frontend和backend配置更简洁，生产常用

name字段只能使用大小写字母，数字，'-'(dash)，'_'(underscore)，'.' (dot)和 ':'(colon)，并且严格区分大小写

#创建子配置目录
[root@centos7 ~]#mkdir /etc/haproxy/conf.d/
#创建子配置文件，注意：必须为cfg后缀非.开头的配置文件
[root@centos7 ~]#vim     /etc/haproxy/conf.d/test.cfg
listen WEB_PORT_80
bind 10.0.0.7:80
mode http
balance roundrobin
server web1     10.0.0.17:80 check inter 3000 fall 2 rise 5
server web2     10.0.0.27:80 check inter 3000 fall 2 rise 5
#添加子配置目录到unit文件中
[root@centos7 ~]#vim /lib/systemd/system/haproxy.service
[Unit]
Description=HAProxy Load Balancer
After=syslog.target network.target
[Service]
#修改下面两行
ExecStartPre=/usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg -f
/etc/haproxy/conf.d/ -c -q
ExecStart=/usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -f
/etc/haproxy/conf.d/     -p /var/lib/haproxy/haproxy.pid
ExecReload=/bin/kill -USR2 $MAINPID
[Install]
WantedBy=multi-user.target
[root@centos7 ~]#systemctl daemon-reload
[root@centos7 ~]#systemctl restart haproxy

[root@centos7 ~]#yum -y install socat
#查看帮助
[root@centos7 ~]#socat -h
[root@centos7 ~]#echo "help" | socat stdio /var/lib/haproxy/haproxy.sock
Unknown command. Please enter one of the following commands only :
help                     : this message
prompt                 : toggle interactive mode with prompt
quit                     : disconnect
show tls-keys [id|*]: show tls keys references or dump tls ticket keys when id
specified
    set ssl tls-key [id|keyfile] <tlskey>: set the next TLS key for the <id> or
<keyfile> listener to <tlskey>
    set ssl cert <certfile> <payload> : replace a certificate file
commit ssl cert <certfile> : commit a certificate file
abort ssl cert <certfile> : abort a transaction for a certificate file
show sess [id] : report the list of current sessions or dump this session
shutdown session : kill a specific session
shutdown sessions server : kill sessions on a server
    clear counters : clear max statistics counters (add 'all' for all counters)
show info         : report information about the running process
[desc|json|typed]*
show stat         : report counters for each proxy and server [desc|json|typed]*
show schema json : report schema used for stats
disable agent : disable agent checks (use 'set server' instead)
disable health : disable health checks (use 'set server' instead)
disable server : disable a server for maintenance (use 'set server' instead) #禁用服务器
enable agent     : enable agent checks (use 'set server' instead)
enable health : enable health checks (use 'set server' instead)
enable server : enable a disabled server (use 'set server' instead)     #启用服务器
    set maxconn server : change a server's maxconn setting
    set server         : change a server's state, weight or address                     #设置服务器
    get weight         : report a server's current weight
    set weight         : change a server's weight (deprecated)
show startup-logs : report logs emitted during HAProxy startup
show peers [peers section]: dump some information about all the peers or this
peers section
    set maxconn global : change the per-process maxconn setting
    set rate-limit : change a rate limiting value
    set severity-output [none|number|string] : set presence of severity level in
feedback information
    set timeout     : change a timeout setting
show env [var] : dump environment variables known to the process
show cli sockets : dump list of cli sockets
show cli level     : display the level of the current CLI session
show fd [num] : dump list of file descriptors in use
show activity : show per-thread activity stats (for support/developers)
operator             : lower the level of the current CLI session to operator
user                     : lower the level of the current CLI session to user
    clear table     : remove an entry from a table
    set table [id] : update or create a table entry's data
show table [id]: report table usage stats or dump this table's contents
disable frontend : temporarily disable specific frontend
enable frontend : re-enable specific frontend
    set maxconn frontend : change a frontend's maxconn setting
 show servers state [id]: dump volatile server information (for backend <id>)
show backend     : list backends in the current running config
shutdown frontend : stop a specific frontend
    set dynamic-cookie-key backend : change a backend secret key for dynamic
cookies
enable dynamic-cookie backend : enable dynamic cookies on a specific backend
disable dynamic-cookie backend : disable dynamic cookies on a specific backend
show errors     : report last request and response errors for each proxy
show resolvers [id]: dumps counters from all resolvers section and
                                        associated name servers
show cache         : show cache status
add acl             : add acl entry
    clear acl <id> : clear the content of this acl
del acl             : delete acl entry
    get acl             : report the patterns matching a sample for an ACL
show acl [id] : report available acls or dump an acl's contents
add map             : add map entry
    clear map <id> : clear the content of this map
del map             : delete map entry
    get map             : report the keys and values matching a sample for a map
    set map             : modify map entry
show map [id] : report available maps or dump a map's contents
trace <module> [cmd [args...]] : manage live tracing
show trace [<module>] : show live tracing state
show threads     : show some threads debugging information
show pools         : report information about the memory pools usage
show events [<sink>] : show event sink state
show profiling : show CPU profiling options
    set profiling : enable/disable CPU profiling
[root@centos7 ~]#echo "show info" | socat stdio /var/lib/haproxy/haproxy.sock
Name: HAProxy
Version: 2.1.3
Release_date: 2020/02/12
Nbthread: 4
Nbproc: 1
Process_num: 1
Pid: 2279
Uptime: 0d 0h46m07s
Uptime_sec: 2767
Memmax_MB: 0
PoolAlloc_MB: 0
PoolUsed_MB: 0
PoolFailed: 0
Ulimit-n: 200041
Maxsock: 200041
Maxconn: 100000
Hard_maxconn: 100000
CurrConns: 0
CumConns: 1
CumReq: 1
MaxSslConns: 0
CurrSslConns: 0
CumSslConns: 0
Maxpipes: 0
PipesUsed: 0
PipesFree: 0
ConnRate: 0
ConnRateLimit: 0
MaxConnRate: 0
SessRate: 0
SessRateLimit: 0
MaxSessRate: 0
SslRate: 0
SslRateLimit: 0
MaxSslRate: 0
SslFrontendKeyRate: 0
SslFrontendMaxKeyRate: 0
SslFrontendSessionReuse_pct: 0
SslBackendKeyRate: 0
SslBackendMaxKeyRate: 0
SslCacheLookups: 0
SslCacheMisses: 0
CompressBpsIn: 0
CompressBpsOut: 0
CompressBpsRateLim: 0
ZlibMemUsage: 0
MaxZlibMemUsage: 0
Tasks: 19
Run_queue: 1
Idle_pct: 100
node: centos7.cici.com
Stopping: 0
Jobs: 7
Unstoppable Jobs: 0
Listeners: 6
ActivePeers: 0
ConnectedPeers: 0
DroppedLogs: 0
BusyPolling: 0
FailedResolutions: 0
TotalBytesOut: 0
BytesOutRate: 0
DebugCommandsIssued: 0
[root@centos7 ~]#cat /etc/haproxy/haproxy.cfg
......
listen me-test-80
bind :81,:82
mode http
server web1 10.0.0.17:80 check inter 3000 fall 3 rise 5
server web2 10.0.0.27:80 check weight 3 
......

[root@centos7 ~]#echo "show servers state" | socat stdio /var/lib/haproxy/haproxy.sock
1
# be_id be_name srv_id srv_name srv_addr srv_op_state srv_admin_state
srv_uweight srv_iweight srv_time_since_last_change srv_check_status
srv_check_result srv_check_health srv_check_state srv_agent_state bk_f_forced_id
srv_f_forced_id srv_fqdn srv_port srvrecord
2 me-test-80 1 web1 10.0.0.17 2 0 2 1 812 6 3 7 6 0 0 0 - 80 -
2 me-test-80 2 web2 10.0.0.27 2 0 2 3 812 6 3 4 6 0 0 0 - 80 -
4 web_port 1 web1 127.0.0.1 0 0 1 1 810 8 2 0 6 0 0 0 - 8080 -
[root@centos7 ~]#echo "get weight me-test-80/web2" | socat stdio
/var/lib/haproxy/haproxy.sock
3 (initial 3)

#修改weight，注意只针对单进程有效
[root@centos7 ~]#echo "set weight me-test-80/web2 2" | socat stdio /var/lib/haproxy/haproxy.sock
[root@centos7 ~]#echo "get weight me-test-80/web2" | socat stdio /var/lib/haproxy/haproxy.sock
2 (initial 3)

#将后端服务器禁用，注意只针对单进程有效
[root@centos7 ~]#echo "disable server me-test-80/web2" | socat stdio /var/lib/haproxy/haproxy.sock
#启用后端服务器
[root@centos7 ~]#echo "enable server me-test-80/web2" | socat stdio /var/lib/haproxy/haproxy.sock
#将后端服务器软下线，即weight设为0
[root@centos7 ~]#echo "set weight me-test-80/web1 0" | socat stdio /var/lib/haproxy/haproxy.sock
#针对haproxy的多进程,将后端服务器禁用
[root@centos7 ~]#vim /etc/haproxy/haproxy.cfg
......
stats socket /var/lib/haproxy/haproxy1.sock mode 600 level admin process 1 #绑定第1个进程和socket文件
stats socket /var/lib/haproxy/haproxy2.sock mode 600 level admin process 2 #绑定第2个进程和socket文件
nbproc 2
.....
[root@centos7 ~]#echo "disable server me-test-80/web2" | socat stdio /var/lib/haproxy/haproxy1.sock
[root@centos7 ~]#echo "disable server me-test-80/web2" | socat stdio /var/lib/haproxy/haproxy2.sock
[root@haproxy ~]#for i in {1..2};do echo "set weight me-test-80/web$i 10" | socat stdio /var/lib/haproxy/haproxy$i.sock;done
#如果静态算法，如:static-rr，可以更改weight为0或1，但不支持动态更改weight为其它值，否则会提示下面信息
[root@centos7 ~]#echo "set weight me-test-80/web1 0" | socat stdio /var/lib/haproxy/haproxy.sock
[root@centos7 ~]#echo "set weight me-test-80/web1 1" | socat stdio /var/lib/haproxy/haproxy.sock
[root@centos7 ~]#echo "set weight me-test-80/web1 2" | socat stdio /var/lib/haproxy/haproxy.sock
Backend is using a static LB algorithm and only accepts weights '0%' and '100%'.

[root@centos7 ~]#cat haproyx_host_up_down.sh
. /etc/init.d/functions
case $1 in
up)
        echo "set weight me-m42-web-80/$2 1" | socat stdio /var/lib/haproxy/haproxy.sock
    [ $? -eq 0 ] && action "$2 is up"
    ;;
down)
        echo "set weight me-m42-web-80/$2 0" | socat stdio /var/lib/haproxy/haproxy.sock
    [ $? -eq 0 ] && action "$2 is down"
    ;;
*)
        echo "Usage: `basename $0` up|down IP"
    ;;
esac

listen web_host
bind 10.0.0.7:80,:8801-8810,10.0.0.7:9001-9010
mode http
log global
balance roundrobin
server web1 10.0.0.17:80 weight 1 check inter 3000 fall 2 rise 5
server web2 10.0.0.27:80 weight 2 check inter 3000 fall 2 rise 5

# echo "get weight web_host/web1" | socat stdio /var/lib/haproxy/haproxy.sock
1 (initial 1)
# echo "set weight web_host/web1 3" | socat stdio /var/lib/haproxy/haproxy.sock
# echo "get weight web_host/web1" | socat stdio /var/lib/haproxy/haproxy.sock
3 (initial 1)

listen web_host
bind 10.0.0.7:80,:8801-8810,10.0.0.7:9001-9010
mode http
log global
balance leastconn
server web1 10.0.0.17:80 weight 1 check inter 3000 fall 2 rise 5
server web2 10.0.0.27:80 weight 1 check inter 3000 fall 2 rise 5

listen web_host
bind 10.0.0.7:80,:8801-8810,10.0.0.7:9001-9010
mode http
log global
balance random
server web1 10.0.0.17:80 weight 1 check inter 3000 fall 2 rise 5
server web2 10.0.0.27:80 weight 1 check inter 3000 fall 2 rise 5

<scheme>://<user>:<password>@<host>:<port>/<path>;<params>?<query>#<frag>
左半部分：/<path>;<params>
整个uri：/<path>;<params>?<query>#<frag>

假设：
url = http://www.me.com/foo/bar/index.php?key=value

则：
host = "www.me.com"
url_param = "key=value"

#静态
static-rr--------->tcp/http 
first------------->tcp/http 
#动态
roundrobin-------->tcp/http
leastconn--------->tcp/http
random------------>tcp/http
#以下静态和动态取决于hash_type是否consistent
source------------>tcp/http
Uri--------------->http
url_param--------->http     
hdr--------------->http
rdp-cookie-------->tcp

first #使用较少
static-rr #做了session共享的web集群
roundrobin
random
leastconn #数据库
source #基于客户端公网IP的会话保持
Uri--------------->http     #缓存服务器，CDN服务商，蓝汛、百度、阿里云、腾讯
url_param--------->http     #可以实现session保持
hdr #基于客户端请求报文头部做下一步处理
rdp-cookie #基于Windows主机,很少使用

cookie name [ rewrite | insert | prefix ][ indirect ] [ nocache ][ postonly ] [
preserve ][ httponly ] [ secure ][ domain ]* [ maxidle <idle> ][ maxlife ]
name： #cookie 的 key名称，用于实现持久连接
insert： #插入新的cookie,默认不插入cookie
indirect： #如果客户端已经有cookie,则不会再发送cookie信息
nocache： #当client和hapoxy之间有缓存服务器（如：CDN）时，不允许中间缓存器缓存cookie，因为这会导致很多经过同一个CDN的请求都发送到同一台后端服务器

listen web_port
bind 10.0.0.7:80
balance roundrobin
mode http #不支持 tcp mode
log global
cookie WEBSRV insert nocache indirect
server web1     10.0.0.17:80 check inter 3000 fall 2 rise 5 cookie web1
server web2     10.0.0.27:80 check inter 3000 fall 2 rise 5 cookie web2

[root@centos6 ~]#curl -i 10.0.0.7
HTTP/1.1 200 OK
date: Thu, 02 Apr 2020 02:26:08 GMT
server: Apache/2.4.6 (CentOS)
last-modified: Thu, 02 Apr 2020 01:44:28 GMT
etag: "a-5a244f0fd5175"
accept-ranges: bytes
content-length: 10
content-type: text/html; charset=UTF-8
set-cookie: WEBSRV=web2; path=/
cache-control: private
10.0.0.27

[root@centos6 ~]#curl -i 10.0.0.7
HTTP/1.1 200 OK
date: Thu, 02 Apr 2020 02:26:15 GMT
server: Apache/2.4.6 (CentOS)
last-modified: Thu, 02 Apr 2020 01:44:13 GMT
etag: "a-5a244f01f8adc"
accept-ranges: bytes
content-length: 10
content-type: text/html; charset=UTF-8
set-cookie: WEBSRV=web1; path=/
cache-control: private
10.0.0.17
[root@centos6 ~]#curl -b WEBSRV=web1 10.0.0.7
10.0.0.17
[root@centos6 ~]#curl -b WEBSRV=web2 10.0.0.7
10.0.0.27
[root@centos6 ~]#curl -vb WEBSRV=web1 10.0.0.7
* About to connect() to 10.0.0.7 port 80 (#0)
*     Trying 10.0.0.7... connected
* Connected to 10.0.0.7 (10.0.0.7) port 80 (#0)
> GET / HTTP/1.1
> User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.27.1
zlib/1.2.3 libidn/1.18 libssh2/1.4.2
> Host: 10.0.0.7
> Accept: */*
> Cookie: WEBSRV=web1
>
< HTTP/1.1 200 OK
< date: Thu, 02 Apr 2020 02:27:54 GMT
< server: Apache/2.4.6 (CentOS)
< last-modified: Thu, 02 Apr 2020 01:44:13 GMT
< etag: "a-5a244f01f8adc"
< accept-ranges: bytes
< content-length: 10
< content-type: text/html; charset=UTF-8
<
10.0.0.17
* Connection #0 to host 10.0.0.7 left intact
* Closing connection #0
[root@centos6 ~]#curl -vb WEBSRV=web2 10.0.0.7
* About to connect() to 10.0.0.7 port 80 (#0)
*     Trying 10.0.0.7... connected
* Connected to 10.0.0.7 (10.0.0.7) port 80 (#0)
> GET / HTTP/1.1
> User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.27.1
zlib/1.2.3 libidn/1.18 libssh2/1.4.2
> Host: 10.0.0.7
> Accept: */*
> Cookie: WEBSRV=web2
>
< HTTP/1.1 200 OK
< date: Thu, 02 Apr 2020 02:27:57 GMT
< server: Apache/2.4.6 (CentOS)
< last-modified: Thu, 02 Apr 2020 01:44:28 GMT
< etag: "a-5a244f0fd5175"
< accept-ranges: bytes
< content-length: 10
< content-type: text/html; charset=UTF-8
<
10.0.0.27
* Connection #0 to host 10.0.0.7 left intact
* Closing connection #0

stats enable                       #基于默认的参数启用stats page
stats hide-version                 #将状态页中haproxy版本隐藏
stats refresh <delay>              #设定自动刷新时间间隔，默认不自动刷新
stats uri <prefix>                 #自定义stats page uri，默认值：/haproxy?stats
stats realm <realm>                #账户认证时的提示信息，示例：stats realm     HAProxy\ Statistics
stats auth <user>:<passwd>         #认证时的账号和密码，可定义多个用户,每行指定一个用户.默认：no authentication
stats admin { if | unless } <cond> #启用stats page中的管理功能

listen stats
bind :9999
stats enable
#stats hide-version
stats uri /haproxy-status         #自定义stats page uri
stats realm HAProxy\ Stats\ Page  #账户认证时的提示信息
stats auth haadmin:123456         #两个用户
stats auth admin:123456
#stats refresh 30s
stats admin if TRUE               #安全原因，不建议打开

pid = 27134 (process #1, nbproc = 1, nbthread = 1)       #pid为当前pid号，process为当前进程号，nbproc和nbthread为一共多少进程和每个进程多少个线程
uptime = 0d 0h00m04s                                     #启动了多长时间
system limits: memmax = unlimited; ulimit-n = 200029     #系统资源限制：内存/最大打开文件数/
maxsock = 200029; maxconn = 100000; maxpipes = 0         #最大socket连接数/单进程最大连接数/最大管道数maxpipes
current conns = 2; current pipes = 0/0; conn rate = 2/sec; bit rate = 0.000 kbps  #当前连接数/当前管道数/当前连接速率
Running tasks: 1/14; idle = 100 %                        #运行的任务/当前空闲率
active UP：                                              #在线服务器
backup UP：                                              #标记为backup的服务器
active UP, going down：                                  #监测未通过正在进入down过程
backup UP, going down：                                  #备份服务器正在进入down过程
active DOWN, going up：                                  #down的服务器正在进入up过程
backup DOWN, going up：                                  #备份服务器正在进入up过程
active or backup DOWN：                                  #在线的服务器或者是backup的服务器已经转换成了down状态
not checked：                                            #标记为不监测的服务器
active or backup DOWN for maintenance (MAINT)            #active或者backup服务器人为下线的
active or backup SOFT STOPPED for maintenance            #active或者backup被人为软下线(人为将weight改成0)

[root@centos8 ~]#curl -I http://haadmin:[email protected]:9999/haproxy-status
HTTP/1.1 200 OK
cache-control: no-cache
content-type: text/html
[root@centos8 ~]#curl -I -u haadmin:123456 http://10.0.0.7:9999/haproxy-status
HTTP/1.1 200 OK
cache-control: no-cache
content-type: text/html
[root@centos8 ~]#echo $?
0
[root@haproxy ~]#systemctl stop haproxy
[root@centos8 ~]#curl -I http://haadmin:[email protected]:9999/haproxy-status
curl: (7) Failed to connect to 10.0.0.7 port 9999: Connection refused
[root@centos8 ~]#echo $?
7

#haproxy 配置：
listen web_http_nodes
    bind     172.16.0.100:80
    mode tcp                         #不支持http协议
    balance roundrobin
    server web1 www.cici.com:80 send-proxy check inter 3000 fall 3 rise 5 #添加send-proxy
#nginx 配置：在访问日志中通过变量$proxy_protocol_addr 记录透传过来的客户端IP
http {
log_format main     '$remote_addr - $remote_user [$time_local] "$request" "$proxy_protocol_addr"'
    server {
            listen             80 proxy_protocol; #启用此项，将无法直接访问此网站，只能通过四层代理访问
            server_name www.cici.com;
......

#nginx在开启proxy_protocol前
[root@internet ~]#curl 172.16.0.100
<html>
<head><title>400 Bad Request</title></head>
<body>
<center><h1>400 Bad Request</h1></center>
<hr><center>nginx</center>
</body>
</html>
[root@VM_0_10_centos ~]# tail -f /apps/nginx/logs/nginx.access.log
111.199.187.69 - - [09/Apr/2020:20:48:51 +0800] "PROXY TCP4 10.0.0.7 58.87.87.99
35948 80" sendfileon
111.199.187.69 - - [09/Apr/2020:20:48:54 +0800] "PROXY TCP4 10.0.0.7 58.87.87.99
35952 80" sendfileon
111.199.187.69 - - [09/Apr/2020:20:48:57 +0800] "PROXY TCP4 10.0.0.7 58.87.87.99
35954 80" sendfileon

#在nginx服务器上开启日志格式和proxy_protocal
[root@VM_0_10_centos ~]# vim /apps/nginx/conf/nginx.conf
http {
.......
log_format main     '$remote_addr - $remote_user [$time_local] "$request" "$proxy_protocol_addr"'
    sendfile             on;
    keepalive_timeout     65;
    client_max_body_size 100m;
    server {
            listen             80 default_server proxy_protocol ;
......
#nginx在开启proxy_protocol后，可以看客户端真实源IP

[root@VM_0_10_centos ~]# tail -f /apps/nginx/logs/nginx.access.log
111.199.187.69 - - [09/Apr/2020:20:52:52 +0800] "GET / HTTP/1.1"
"172.16.0.200"sendfileon

log global                                     #开启记录日志,默认不开启
option httplog                                 #开启记录httplog日志格式选项
capture cookie <name> len <length>             #捕获请求和响应报文中的 cookie及值的长度,将之记录到日志
capture request header <name> len <length>     #捕获请求报文中指定的首部内容和长度并记录日志
capture response header <name> len <length>    #捕获响应报文中指定的内容和长度首部并记录日志
#示例：
log global
option httplog
capture request header Host len     256
capture request header User-Agent len 512
capture request header Referer len 15
capture request header X-Forwarded-For len 15

[root@haproxy ~]#tail /var/log/haproxy.log
Apr     9 19:42:02 localhost haproxy[60236]: 172.16.0.200:54630
[09/Apr/2020:19:42:02.623] web_prot_http_nodes web_prot_http_nodes/web1
0/0/1/1/2 200 4264 - - ---- 1/1/0/0/0 0/0 "GET / HTTP/1.1"

listen web_host
bind 10.0.0.7:80
mode http
balance roundrobin
log global                                 #开启日志功能
option httplog                             #开启httplog日志格式选项
capture request header User-Agent len 512  #记录日志信息,记录User-Agent首部值的前512个字符
capture request header Host len     256    #记录日志信息,记录Host首部值
cookie SERVER-COOKIE insert indirect nocache
server web1 10.0.0.17:80 cookie web1 check inter 3000 fall 3 rise 5
server web2 10.0.0.27:80 cookie web2 check inter 3000 fall 3 rise 5

[root@centos7 ~]#tail -n3 /var/log/haproxy.log
Apr     2 12:44:26 localhost haproxy[27637]: 10.0.0.6:50004
[02/Apr/2020:12:44:26.817] web_port web_port/web1 0/0/0/2/3 200 42484 - - --NI
1/1/0/0/0 0/0 {curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.27.1
zlib/1.2.3 libidn/1.18 libssh2/1.4.2|10.0.0.7} "GET /test.php HTTP/1.1"
Apr     2 12:44:27 localhost haproxy[27637]: 10.0.0.6:50006
[02/Apr/2020:12:44:27.294] web_port web_port/web2 0/0/0/1/1 404 370 - - --NI
1/1/0/0/0 0/0 {curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.27.1
zlib/1.2.3 libidn/1.18 libssh2/1.4.2|10.0.0.7} "GET /test.php HTTP/1.1"
Apr     2 12:44:27 localhost haproxy[27637]: 10.0.0.6:50008
[02/Apr/2020:12:44:27.840] web_port web_port/web1 0/0/0/3/4 200 42484 - - --NI
1/1/0/0/0 0/0 {curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.27.1
zlib/1.2.3 libidn/1.18 libssh2/1.4.2|10.0.0.7} "GET /test.php HTTP/1.1"

compression algo <algorithm> ...       #启用http协议中的压缩机制，常用算法有gzip，deflate
#压缩算法<algorithm>支持下面类型：
identity                               #debug调试使用的压缩方式
gzip                                   #常用的压缩方式，与各浏览器兼容较好
deflate                                #有些浏览器不支持
raw-deflate                            #新式的压缩方式
compression type <mime type> ...       #要压缩的文件类型
#示例：
compression algo gzip deflate
compression type text/html text/css text/plain

listen web_host
bind 10.0.0.7:80
mode http
balance roundrobin
log global
option httplog
compression algo gzip deflate     #启用压缩和指定算法
compression type compression type text/plain text/html text/css text/xml
text/javascript application/javascript                         #指定压缩文件类型
server web1 10.0.0.17:80 cookie web1 check inter 3000 fall 3 rise 5
server web2 10.0.0.27:80 cookie web2 check inter 3000 fall 3 rise 5

#后端服务器准备一个文本文件
[root@centos7 ~]#ll /var/www/html/m.txt -h
-rwxr-xr-x 1 root root 772K Apr     2 12:56 /var/www/html/m.txt

[root@centos6 ~]#curl -is --compressed     10.0.0.7/m.txt|less
HTTP/1.1 200 OK
date: Thu, 02 Apr 2020 05:00:26 GMT
server: Apache/2.4.6 (CentOS) PHP/5.4.16
last-modified: Thu, 02 Apr 2020 04:56:25 GMT
etag: W/"c0ef6-5a2479f7aee68"
accept-ranges: bytes
content-type: text/plain; charset=UTF-8
set-cookie: WEBSRV=web1; path=/
cache-control: private
content-encoding: deflate
transfer-encoding: chunked
vary: Accept-Encoding
Feb     2 18:49:27 centos7 journal: Runtime journal is using 6.0M (max allowed
48.6M, trying to leave 72.9M free of 480.1M available → current limit 48.6M).
Feb     2 18:49:27 centos7 kernel: Initializing cgroup subsys cpuset
Feb     2 18:49:27 centos7 kernel: Initializing cgroup subsys cpu
Feb     2 18:49:27 centos7 kernel: Initializing cgroup subsys cpuacct
......

基于四层的传输端口做状态监测，此为默认方式
基于指定 URI 做状态监测,需要访问整个页面资源,占用更多带宽
基于指定 URI 的request请求头部内容做状态监测，占用较少带宽,建议使用此方式

option httpchk     #启用七层健康性检测，对tcp 和 http 模式都支持，默认为：OPTIONS
/ HTTP/1.0
option httpchk <uri>
option httpchk <method> <uri>
option httpchk <method> <uri> <version>
#期望以上检查得到的响应码
http-check expect [!] <match> <pattern>
#示例：
http-check expect status 200
http-check expect ! rstatus ^5 #支持正则表达式
#关于HTTP/1.1的说明
<version> is the optional HTTP version string. It defaults to "HTTP/1.0" but
some servers might behave incorrectly in HTTP 1.0, so turning it to HTTP/1.1 may
sometimes help. Note that the Host field is                 mandatory in HTTP/1.1, and
as a trick, it is possible to pass it after "\r\n" following the version string.

listen web_host
bind 10.0.0.7:80
mode http
balance roundrobin
    #option httpchk GET /monitor/check.html #默认HTTP/1.0
    #option httpchk GET /monitor/check.html HTTP/1.0
    #option httpchk GET /monitor/check.html HTTP/1.1 #注意：HTTP/1.1强制要求必须
有Host字段
option httpchk HEAD /monitor/check.html HTTP/1.1\r\nHost:\ 10.0.0.7 #使用HEAD
减少网络流量
cookie SERVER-COOKIE insert indirect nocache
server web1 10.0.0.17:80 cookie web1 check inter 3000 fall 3 rise 5
server web2 10.0.0.27:80 cookie web2 check inter 3000 fall 3 rise 5

#在所有后端服务建立检测页面
[root@backend ~]#mkdir /var/www/html/monitor/
[root@backend ~]#echo monitor > /var/www/html/monitor/check.html
#关闭一台Backend服务器
[root@backend1 ~]#systemctl stop httpd

#后端服务器查看访问日志
[root@backend ~]#tail /var/log/httpd/access_log
10.0.0.7 - - [02/Apr/2020:14:25:22 +0800] "HEAD /monitor/check.html HTTP/1.1"
200 - "-" "-"
10.0.0.7 - - [02/Apr/2020:14:25:25 +0800] "HEAD /monitor/check.html HTTP/1.1"
200 - "-" "-"
10.0.0.7 - - [02/Apr/2020:14:25:28 +0800] "HEAD /monitor/check.html HTTP/1.1"
200 - "-" "-"

acl     <aclname> <criterion>     [flags]         [operator]     [<value>]
acl         名称         匹配规范         匹配模式         具体操作符         操作对象类型

与：隐式（默认）使用
或：使用"or" 或 "||"表示
否定：使用 "!" 表示

#示例：
if valid_src valid_port #与关系，ACL中A和B都要满足为true，默认为与
if invalid_src || invalid_port     #或，ACL中A或者B满足一个为true
if ! invalid_src #非，取反，不满足ACL才为true

[root@centos7 ~]#cat /etc/haproxy/conf.d/test.cfg
frontend me_http_port
    bind 10.0.0.7:80
    mode http
    balance roundrobin
    log global
    option httplog
###################### acl setting ###############################
    acl pc_domain hdr_dom(host)             -i www.me.org
    acl mobile_domain hdr_dom(host)     -i mobile.me.org
###################### acl hosts #################################
    use_backend pc_hosts     if     pc_domain
    use_backend mobile_hosts         if     mobile_domain
    default_backend pc_hosts     #所有ACL都不匹配,则使用的默认backend
###################### backend hosts #############################
backend mobile_hosts
    mode http
    server web1 10.0.0.17 check inter 2000 fall 3 rise 5
backend pc_hosts
    mode http
    server web2 10.0.0.27:80 check inter 2000 fall 3 rise 5

[root@centos6 ~]#cat /etc/hosts
127.0.0.1     localhost localhost.localdomain localhost4 localhost4.localdomain4
centos6.localdomain
::1                 localhost localhost.localdomain localhost6 localhost6.localdomain6
10.0.0.7 mobile.me.org www.me.org me.org
[root@centos6 ~]#curl www.me.org
10.0.0.27
[root@centos6 ~]#curl mobile.me.org
10.0.0.17
[root@centos6 ~]#curl me.org
10.0.0.27

root@centos7 ~]#cat /etc/haproxy/conf.d/test.cfg
frontend me_http_port
    bind 10.0.0.7:80
    mode http
    balance roundrobin
    log global
    option httplog
###################### acl setting ###############################
    acl pc_domain hdr_dom(host)             -i www.me.org
    acl mobile_domain hdr_dom(host)     -i mobile.me.org
    acl ip_range_test src 172.18.0.0/16 10.0.0.6         #基于源地址的ACL,定义多个ACL的顺序无关
    acl ip_range_test2 src 172.18.0.200
###################### acl hosts #################################
    use_backend pc_hosts                 if     ip_range_test     #放在前面的ACL规则优先生效,引用
    ACL时,严格的ACL应放在前面
    use_backend pc_hosts                 if     pc_domain
    use_backend mobile_hosts         if     mobile_domain
    default_backend pc_hosts
###################### backend hosts #############################
backend mobile_hosts
    mode http
    server web1 10.0.0.17 check inter 2000 fall 3 rise 5
backend pc_hosts
    mode http
    server web2 10.0.0.27:80 check inter 2000 fall 3 rise 5

[root@centos6 ~]#hostname -I
10.0.0.6
[root@centos6 ~]#curl www.me.org
10.0.0.27
[root@internet ~]#curl -H "HOST: www.me.org" 10.0.0.7
10.0.0.27
[root@centos6 ~]#curl mobile.me.org
10.0.0.27
[root@centos6 ~]#curl me.org
10.0.0.27
[root@centos8 ~]#curl mobile.me.org
10.0.0.17
[root@centos8 ~]#curl www.me.org
10.0.0.27
[root@centos8 ~]#curl me.org
10.0.0.27

listen web_host
    bind 10.0.0.7:80
    mode http
    balance roundrobin
    log global
    option httplog
###################### acl setting ###############################
    acl acl_deny_src src 10.0.0.6 192.168.0.0/24
###################### acl hosts #################################
    http-request deny     if acl_deny_src     #2.1版本后，不再支持block
    #block if acl_deny_src
    #http-request allow
    default_backend default_web
###################### backend hosts #############################
backend me_host
    mode http
    server web1 10.0.0.17 check inter 2000 fall 3 rise 5
backend default_web
    mode http
    server web1 10.0.0.27:80 check inter 2000 fall 3 rise 5

[root@centos6 ~]#curl www.me.org
<html><body><h1>403 Forbidden</h1>
Request forbidden by administrative rules.
</body></html>

[root@ubuntu2004 ~]#curl -I www.163.com
HTTP/1.1 403 Forbidden
Date: Fri, 01 Jan 2021 06:57:22 GMT
Content-Type: text/html
Content-Length: 237
Connection: keep-alive
Server: web cache
Expires: Fri, 01 Jan 2021 06:57:22 GMT
X-Ser: BC17_lt-shandong-zaozhuang-6-cache-1
Cache-Control: no-cache,no-store,private
cdn-user-ip: 111.199.184.218
cdn-ip: 124.132.138.17
X-Cache-Remote: HIT
cdn-source: baishan
[root@ubuntu2004 ~]#curl -I -A "wget" www.163.com
HTTP/1.1 403 Forbidden
Date: Fri, 01 Jan 2021 06:58:13 GMT
Content-Type: text/html
Content-Length: 237
Connection: keep-alive
Server: web cache
Expires: Fri, 01 Jan 2021 06:58:13 GMT
X-Ser: BC17_lt-shandong-zaozhuang-6-cache-1
Cache-Control: no-cache,no-store,private
cdn-user-ip: 111.199.184.218
cdn-ip: 124.132.138.17
X-Cache-Remote: HIT
cdn-source: baishan

#不拒绝其它浏览器的访问
[root@ubuntu2004 ~]#curl -I -A "ApacheBench" www.163.com
HTTP/1.1 301 Moved Permanently
Date: Fri, 01 Jan 2021 06:58:41 GMT
Content-Length: 0
Connection: keep-alive
Server: web cache
Location: https://www.163.com/
Cache-Control: no-cache,no-store,private
cdn-user-ip: 111.199.184.218
cdn-ip: 124.132.138.11
X-Cache-Remote: MISS
cdn-source: baishan

[root@centos7 ~]#cat /etc/haproxy/conf.d/test.cfg
frontend me_http_port
    bind 10.0.0.7:80
    mode http
    balance roundrobin
    log global
    option httplog
###################### acl setting ###############################
    acl acl_user_agent hdr_sub(User-Agent)     -i curl wget             #基于浏览器的ACL
    acl acl_user_agent_ab hdr_sub(User-Agent)     -i ApacheBench
###################### acl hosts #################################
    redirect prefix     http://www.baidu.com if acl_user_agent #302 临时重定向至新URL
    http-request deny         if acl_user_agent_ab #拒绝ab
    default_backend pc_hosts
###################### backend hosts #############################
backend mobile_hosts
    mode http
    server web1 10.0.0.17 check inter 2000 fall 3 rise 5
backend pc_hosts
    mode http
    server web2 10.0.0.27:80 check inter 2000 fall 3 rise 5

[root@centos6 ~]#curl -I 10.0.0.7
HTTP/1.1 302 Found
content-length: 0
location: http://10.0.0.8/
cache-control: no-cache
[root@centos6 ~]#curl -L 10.0.0.7
10.0.0.8
[root@centos6 ~]#wget -O - -q http://10.0.0.7
10.0.0.8
[root@centos6 ~]#curl -A chrome http://10.0.0.7
10.0.0.27
#模拟ab
[root@centos6 ~]#curl -A ApacheBench 10.0.0.7
<html><body><h1>403 Forbidden</h1>
Request forbidden by administrative rules.
</body></html>
[root@centos6 ~]#ab -n1 -c 1 http://10.0.0.7/
This is ApacheBench, Version 2.3 <$Revision: 655654 $>
Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
Licensed to The Apache Software Foundation, http://www.apache.org/
Benchmarking 10.0.0.7 (be patient).....done
Server Software:             
Server Hostname:                 10.0.0.7
Server Port:                         80
Document Path:                 /
Document Length:                 93 bytes
Concurrency Level:             1
Time taken for tests:     0.001 seconds
Complete requests:             1
Failed requests:                 0
Write errors:                     0
Non-2xx responses:             1         #提示出现非200的响应
Total transferred:             208 bytes
HTML transferred:             93 bytes
Requests per second:         939.85 [#/sec] (mean)
Time per request:             1.064 [ms] (mean)
Time per request:             1.064 [ms] (mean, across all concurrent requests)
Transfer rate:                     190.91 [Kbytes/sec] received
Connection Times (ms)
                        min mean[+/-sd] median     max
Connect:                 1         1     0.0             1             1
Processing:         1         1     0.0             1             1
Waiting:                 0         0     0.0             0             0
Total:                     1         1     0.0             1             1
#haproxy日志提示403
[root@centos7 ~]#tail /var/log/haproxy.log
Apr     4 08:16:29 localhost haproxy[1483]: 10.0.0.6:56470
[04/Apr/2020:08:16:29.977] me_http_port me_http_port/<NOSRV>
0/-1/-1/-1/0 403 212 - - PR-- 1/1/0/0/0 0/0 "GET / HTTP/1.1"

[root@centos7 ~]#cat /etc/haproxy/conf.d/test.cfg
frontend me_http_port
    bind 10.0.0.7:80
    mode http
    balance roundrobin
    log global
    option httplog
###################### acl setting ###############################
    acl acl_static path_end -i .jpg .jpeg .png .gif .css .js .html     #基于文件后缀名的ACL
    acl acl_php     path_end -i .php
###################### acl hosts #################################
    use_backend mobile_hosts if acl_static
    use_backend app_hosts if acl_php
    default_backend pc_hosts
###################### backend hosts #############################
backend mobile_hosts
    mode http
    server web1 10.0.0.17 check inter 2000 fall 3 rise 5
backend pc_hosts
    mode http
    server web2 10.0.0.27:80 check inter 2000 fall 3 rise 5
backend app_hosts
    mode http
    server web2 10.0.0.27:80 check inter 2000 fall 3 rise 5
#分别在后端两台主机准备相关文件
[root@centos17 ~]#ls /var/www/html
index.html wang.jpg
[root@centos27 ~]#cat /var/www/html/test.php
<?php
echo "<h1>http://10.0.0.27/test.php</h1>\n";
?>

[root@centos7 ~]#cat /etc/haproxy/conf.d/test.cfg
frontend me_http_port
    bind 10.0.0.7:80
    mode http
    balance roundrobin
    log global
    option httplog
###################### acl setting ###############################
    acl acl_static path_beg     -i /static /images /javascript                 #基于路径的ACL
    acl acl_static path_end     -i .jpg .jpeg .png .gif .css .js .html .htm     #ACL同名为或关系
    acl acl_app path_beg     -i /api
###################### acl hosts #################################
    use_backend static_hosts if acl_static
    use_backend app_hosts     if acl_app
    default_backend app_hosts
###################### backend hosts #############################
backend static_hosts
    mode http
    server web1 10.0.0.17 check inter 2000 fall 3 rise 5
backend app_hosts
    mode http
    server web2 10.0.0.27:80 check inter 2000 fall 3 rise 5

#创建相关文件
[root@centos17 ~]#mkdir /var/www/html/static
[root@centos17 ~]#echo 10.0.0.17 > /var/www/html/static/test.html
#测试访问
[root@centos6 ~]#curl 10.0.0.7/static/test.html
10.0.0.17

#自定义错误页
errorfile <code> <file>
<code> #HTTP status code.支持200, 400, 403, 405, 408, 425, 429, 500, 502，503,504
<file> #包含完整HTTP响应头的错误页文件的绝对路径。 建议后缀".http"，以和一般的html文件相区分
#示例：
errorfile 400 /etc/haproxy/errorfiles/400badreq.http
errorfile 403 /etc/haproxy/errorfiles/403forbid.http
errorfile 503 /etc/haproxy/errorfiles/503sorry.http

defaults
#option forwardfor
#no option http-use-htx 支持html文件,此设置和版本有关，2.1不支持
#......
#加下面行
errorfile 500 /usr/local/haproxy/html/500.http
errorfile 502 /usr/local/haproxy/html/502.http
errorfile 503 /usr/local/haproxy/html/503.http

[root@centos7 ~]#vim /etc/haproxy/haproxy.cfg
defaults
option http-keep-alive
option forwardfor
maxconn 100000
mode http
timeout connect 300000ms
timeout client 300000ms
timeout server 300000ms
errorfile 503 /apps/haproxy/html/503.http 
listen
.......
[root@centos7 ~]#vim /apps/haproxy/html/503.http
HTTP/1.1 503 Service Unavailable
Content-Type:text/html;charset=utf-8
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>报错页面</title>
</head>
<body>
<center><h1>网站维护中......请稍候再试</h1></center>
<center><h2>联系电话：400-123-4567</h2></center>
<center><h3>503 Service Unavailable</h3></center>
</body>
[root@centos7 ~]#systemctl restart haproxy
#将后端服务器down，可以观察到以下页面

[root@haproxy ~]#vi /etc/haproxy/haproxy.cfg
defaults
    option http-keep-alive
    no option http-use-htx     #在defaults 块中添加
    errorfile 503 /apps/haproxy/errorfiles/503.html 
[root@haproxy ~]#cat /apps/haproxy/errorfiles/503.html
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>报错页面</title>
</head>
<body>
<center><h1>网站维护中......请稍侯再试</h1></center>
<center><h2>联系电话：400-123-8888</h2></center>
<center><h3>503 Service Unavailable</h3></center>
</body>
#注意没有响应头信息
[root@internet ~]#curl -I 172.16.0.100
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>报错页面</title>
</head>
<body>
<center><h1>网站维护中......请稍侯再试</h1></center>
<center><h2>联系电话：400-123-8888</h2></center>
<center><h3>503 Service Unavailable</h3></center>
</body>
#ubuntu的客户端提示错误
root@ubuntu2004:~# curl     172.16.0.100
curl: (1) Received HTTP/0.9 when not allowed

#错误页面重定向
errorloc <code> <url>
#相当于errorloc302 <code> <url>，利用302重定向至指URL
#示例：
errorloc 503 http://www.me.com/error_pages/503.html

[root@centos7 ~]#vim /etc/haproxy/haproxy.cfg
defaults
#option http-keep-alive
#option forwardfor
#no option http-use-htx
#...... 加以下一行
#errorfile 503 /apps/haproxy/html/503.http
errorloc 503 http://10.0.0.8/error_page/503.html
[root@centos8 ~]#cat /var/www/html/error_page/503.html
<!DOCTYPE html>
<html lang="en">
<head>
<title>报错页面</title>
</head>
<body>
<center><h1>网站维护中......请稍侯再试</h1></center>
<center><h2>联系电话：400-123-4567</h2></center>
<center><h3>503 Service Unavailable</h3></center>
</body>
#浏览器访问http://haproxy/ 302自动跳转至下面页面

listen redis-port
    bind 10.0.0.7:6379
    mode tcp
    balance leastconn
    server server1 10.0.0.17:6379 check
    server server2 10.0.0.27:6379 check backup

[root@centos7 ~]#vim /etc/haproxy/haproxy.cfg
listen me_mysql
    bind 10.0.0.7:3306
    mode tcp
    balance leastconn
    server mysql1 10.0.0.17:3306 check 
    server mysql2 10.0.0.27:3306 check                     #如果不写端口号，可以转发，但无法check状态

#或者使用frontend和backend实现
frontend mysql
    bind :3306
    mode tcp     #必须指定tcp模式
    default_backend mysqlsrvs
backend mysqlsrvs
    mode tcp #必须指定tcp模式
    balance leastconn
    server mysql1 10.0.0.17:3306
    server mysql2 10.0.0.27:3306
[root@centos7 ~]#systemctl restart haproxy
#在后端服务器安装和配置mariadb服务
[root@centos7 ~]#yum -y install mariadb-server
[root@centos7 ~]#mysql -e "grant all on *.* to test@'10.0.0.%' identified by'123456'"
[root@centos7 ~]#vim /etc/my.cnf
[mysqld]
server-id=17 #在另一台主机为27
[root@centos7 ~]#systemctl start mariadb

#测试
[root@centos6 ~]#mysql -utest -p123456 -e "show variables like 'hostname'"
+---------------+--------------------------+
| Variable_name | Value                                     |
+---------------+--------------------------+
| hostname         | centos17.cici.com |
+---------------+--------------------------+
[root@centos6 ~]#mysql -utest -p123456 -e "show variables like 'hostname'"
+---------------+--------------------------+
| Variable_name | Value                                     |
+---------------+--------------------------+
| hostname         | centos27.cici.com |
+---------------+--------------------------+
[root@centos6 ~]#mysql -utest -p123456 -h10.0.0.7 -e 'select @@server_id'
+-------------+
| @@server_id |
+-------------+
|                     17 |
+-------------+
[root@centos6 ~]#mysql -utest -p123456 -h10.0.0.7 -e 'select @@server_id'
+-------------+
| @@server_id |
+-------------+
|                     27 |
+-------------+

frontend web_host
    bind 10.0.0.7:80
    mode http
    balance roundrobin
    log global
    option httplog
###################### acl setting ############################### 
    acl static_path path_beg     -i /static /images /javascript
    acl invalid_src src 192.168.1.0/24 10.0.0.8
###################### acl hosts #################################
    use_backend static_path_host if HTTP_1.1 TRUE static_path
    tcp-request connection reject if invalid_src         #四层ACL控制 
    default_backend default_web
################### backend hosts ################################
backend php_server_host
    mode http
    server web1 10.0.0.17 check inter 2000 fall 3 rise 5
backend static_path_host
    mode http
    server web1 10.0.0.27 check inter 2000 fall 3 rise 5
backend default_web
    mode http
    server web1 10.0.0.37:80 check inter 2000 fall 3 rise 5

#方法1
[root@centos7 ~]mkdir /etc/haproxy/certs/
[root@centos7 ~]cd /etc/haproxy/certs/
[root@centos7 certs]#openssl genrsa -out haproxy.key 2048
[root@centos7 certs]#openssl req -new -x509 -key haproxy.key -out haproxy.crt -subj "/CN=www.me.org"
#或者用下一条命令实现
[root@centos7 certs]#openssl req -x509 -newkey rsa:2048 -subj
"/CN=www.me.org" -keyout haproxy.key -nodes -days 365 -out haproxy.crt
[root@centos7 certs]#cat haproxy.key haproxy.crt > haproxy.pem
[root@centos7 certs]#openssl x509 -in haproxy.pem -noout -text #查看证书

#方法2
[root@centos7 ~]#mkdir /etc/haproxy/certs/
[root@centos7 ~]#cd /etc/pki/tls/certs
[root@centos7 certs]#make /etc/haproxy/certs/haproxy.pem 
umask 77 ; \
PEM1=`/bin/mktemp /tmp/openssl.XXXXXX` ; \
PEM2=`/bin/mktemp /tmp/openssl.XXXXXX` ; \
/usr/bin/openssl req -utf8 -newkey rsa:2048 -keyout $PEM1 -nodes -x509 -days 365 -out $PEM2 ; \
cat $PEM1 > /etc/haproxy/certs/haproxy.pem ; \
echo ""     >> /etc/haproxy/certs/haproxy.pem ; \
cat $PEM2 >> /etc/haproxy/certs/haproxy.pem ; \
rm -f $PEM1 $PEM2
Generating a 2048 bit RSA private key
.+++
..............................................+++
writing new private key to '/tmp/openssl.x8hOA8'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:beijing
Locality Name (eg, city) [Default City]:beijing
Organization Name (eg, company) [Default Company Ltd]:me
Organizational Unit Name (eg, section) []:it
Common Name (eg, your name or your server's hostname) []:www.me.org
Email Address []:
[root@centos7 certs]#ll /etc/haproxy/certs/
total 4
-rw------- 1 root root 3027 Apr     4 10:35 haproxy.pem

[root@centos7 ~]#cat /etc/haproxy/conf.d/test.cfg
frontend me_http_port
    bind 10.0.0.7:80
###################### https setting ############################## 
    bind 10.0.0.7:443 ssl crt /etc/haproxy/certs/haproxy.pem
    redirect scheme https if !{ ssl_fc }                 # 注意{ }内的空格
    http-request set-header X-forwarded-Port     %[dst_port]
    http-request add-header X-forwarded-Proto https if { ssl_fc }
    mode http
    balance roundrobin
    log global
    option httplog
###################### acl setting ###############################
    acl mobile_domain hdr_dom(host)     -i mobile.me.org
###################### acl hosts #################################
    default_backend pc_hosts
################### backend hosts #################################
backend mobile_hosts
    mode http
    server web1 10.0.0.17:80 check inter 2000 fall 3 rise 5
backend pc_hosts
mode http
    #http-request set-header X-forwarded-Port     %[dst_port] 也可加在此处
    #http-request add-header X-forwarded-Proto https if { ssl_fc }
    server web2 10.0.0.27:80 check inter 2000 fall 3 rise 5

[root@centos7 ~]#ss -ntl
State         Recv-Q Send-Q                 Local Address:Port     Peer Address:Port             

LISTEN         0             100                                 127.0.0.1:25                                 *:*                 

LISTEN         0             128                                     10.0.0.7:443                             *:*                 

LISTEN         0             128                                                 *:9999                             *:*                 

LISTEN         0             128                                     10.0.0.7:80                                 *:*                 

LISTEN         0             128                                                 *:22                                 *:*                 

LISTEN         0             128                                         [::]:22                                 [::]:* 

[root@centos27 ~]#vim /etc/httpd/conf/httpd.conf
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" \"%{X-
Forwarded-Port}i\" \"%{X-Forwarded-Proto}i\"" combined 

[root@centos6 ~]#curl -IkL http://www.me.org
HTTP/1.1 302 Found
content-length: 0
location: https://www.me.org/
cache-control: no-cache
HTTP/1.1 200 OK
date: Sat, 04 Apr 2020 02:31:31 GMT
server: Apache/2.4.6 (CentOS) PHP/5.4.16
last-modified: Thu, 02 Apr 2020 01:44:13 GMT
etag: "a-5a244f01f8adc"
accept-ranges: bytes
content-length: 10
content-type: text/html; charset=UTF-8
[root@centos6 ~]#curl -Ik https://www.me.org
HTTP/1.1 200 OK
date: Sat, 04 Apr 2020 02:31:50 GMT
server: Apache/2.4.6 (CentOS) PHP/5.4.16
last-modified: Thu, 02 Apr 2020 01:44:28 GMT
etag: "a-5a244f0fd5175"
accept-ranges: bytes
content-length: 10
content-type: text/html; charset=UTF-8

#查看后端服务器的访问日志
[root@centos27 ~]#tail /var/log/httpd/access_log
10.0.0.7 - - [04/Apr/2020:10:40:17 +0800] "HEAD / HTTP/1.1" 200 - "-"
"curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.27.1 zlib/1.2.3
libidn/1.18 libssh2/1.4.2" "443" "https"