Haproxy的常见配置

转:https://gist.github.com/chanjarster/bb180190994d86bf0c8917fa134e57ea

1. # Haproxy的常见配置
   
2. # 参考文档：
   
3. # http://cbonte.github.io/haproxy-dconv/1.9/configuration.html
   
4. # http://blog.sina.com.cn/s/blog_704836f40102w243.html
   
5. # http://thread.gmane.org/gmane.comp.web.haproxy/12557
   
6. # https://serverfault.com/questions/678882/is-there-a-way-to-rate-limit-connections-with-haproxy-using-
   
7. # https://blog.codecentric.de/en/2014/12/haproxy-http-header-rate-limiting/
   
8. # http://cbonte.github.io/haproxy-dconv/1.9/management.html
   
9. # https://www.haproxy.com/blog/websockets-load-balancing-with-haproxy/
   
10. 
    
11. global
    
12.   daemon
    
13.   maxconn 20000
    
14.   stats socket /var/run/haproxy/haproxy.sock mode 0600 level admin
    
15.   log 127.0.0.1 local3
    
16. 
    
17. defaults
    
18.   mode http
    
19.   
    
20.   # 启动Haproxy web统计页面
    
21.   stats uri /haproxy-admin
    
22.   stats realm Haproxy\ Statistics
    
23.   stats auth 用户名:密码
    
24. 
    
25.   # 添加X-Forwarded-For头，使后端获得真实IP
    
26.   option forwardfor except 127.0.0.1
    
27.   
    
28.   # 开启http keep-alive
    
29.   option http-keep-alive
    
30.   
    
31.   # http keep-alive保持5秒
    
32.   timeout http-keep-alive 5s
    
33.   
    
34.   # 开启日志
    
35.   log 127.0.0.1 local3
    
36. 
    
37. frontend http-in
    
38.   
    
39.   # 绑定80端口
    
40.   bind *:80
    
41.   
    
42.   # 最大连接数
    
43.   maxconn 20000
    
44.   
    
45.   # 客户端响应超时
    
46.   timeout client 5s
    
47.   # http请求送达超时
    
48.   timeout http-request 5s
    
49.   # http keep-alive保持连接最长时间
    
50.   timeout http-keep-alive 5s
    
51.   # half-open connection未响应超时，针对web socket
    
52.   timeout client-fin 30s
    
53.   
    
54.   # 使用后端服务器组
    
55.   default_backend servers
    
56.   
    
57.   # START 过速请求的防御
    
58.   
    
59.   # 创建stick-table，记录 cookie(SESSIONID) -> 最近30秒内http请求次数
    
60.   # stick-table type string len 50 size 1m expire 10m store http_req_rate(30s)
    
61.   
    
62.   # 将cookie(SESSION)作为key，存到stick-table中
    
63.   # http-request track-sc0 req.cook(SESSION)
    
64.   
    
65.   # 定义ACL，请求次数是否超过100
    
66.   # acl abuse sc0_http_req_rate gt 100
    
67.   
    
68.   # 如果ACL为true，则拒绝http请求，响应429
    
69.   # http-request deny deny_status 429 if abuse
    
70.   
    
71.   # END
    
72.   
    
73.   # START IP 黑名单
    
74.   
    
75.   # 定义ACL，看client ip是否在ip-blacklist.txt内，文件内容如下：
    
76.   # xxx.xxx.xxx.xxx
    
77.   # xxx.xxx.xxx.xxx/8
    
78.   # acl block_ip src -f path/to/ip-blacklist.txt
    
79.   
    
80.   # 如果ACL为true，则拒绝http请求
    
81.   # http-request deny if block_ip
    
82.   
    
83.   # END
    
84.   
    
85.   # START User-Agent黑名单
    
86.   
    
87.   # 定义ACL，看user-agent头是否字符串substring在ua-blacklist.txt内，文件内容如下：
    
88.   # okhttp
    
89.   # chrome
    
90.   # acl block_ua hdr_sub(user-agent) -i -f path/to/ua-blacklist.txt
    
91.   
    
92.   # 如果ACL为true，则拒绝http请求
    
93.   # http-request deny if block_ua
    
94.   
    
95.   # END
    
96.   
    
97. backend servers
    
98.   # 连接到服务器超时
    
99.   timeout connect 30s
    
100.   # 服务器无活动超时
     
101.   timeout server 60s
     
102.   # tunnel超时，针对web socket
     
103.   timeout tunnel 1h
     
104. 
     
105.   # START 负载策略：轮询，session持久策略：cookie，这个策略最均匀
     
106.   balance roundrobin
     
107.   cookie SERVERNAME insert indirect nocache
     
108.   # END
     
109.   
     
110.   # START 负载策略：轮询，session持久策略：ip
     
111.   # balance roundrobin
     
112.   # stick-table type ip size 10m expire 3h
     
113.   # stick on src
     
114.   # END
     
115.   
     
116.   # START 负载策略：IP hash
     
117.   # balance source
     
118.   # END
     
119.   
     
120.   # xxx代表服务地址（可带端口号）
     
121.   # server1,2,3,4只是名字，可以改成需要的名字
     
122.   # check port yyyy 代表通过检测后端服务器的yyyy端口来判断服务器是否可用，如果不可用，会自动切换
     
123.   server server1 xxx check port yyyy maxconn 1000 maxqueue 10 slowstart 60s
     
124.   server server2 xxx check port yyyy maxconn 1000 maxqueue 10 slowstart 60s
     
125.   server server3 xxx check port yyyy maxconn 1000 maxqueue 10 slowstart 60s
     
126.   server server4 xxx check port yyyy maxconn 1000 maxqueue 10 slowstart 60s