haproxy acl 规则

haproxy acl 规则

1 按请求的主机头(名)负载

cat haproxy.cfg 

 

global
    log 127.0.0.1 local1
    maxconn 65000             #最大连接数
    chroot /usr/local/haproxy #安装目录
    uid 99                    #用户haproxy
    gid 99                    #组haproxy
    daemon                    #守护进程运行
    nbproc 1                  #进程数量
    pidfile /usr/local/haproxy/logs/haproxy.pid #haproxy pid

defaults
   log     global
   mode    http               #7层 http;4层tcp
   option  httplog            #http 日志格式
   option  httpclose          #主动关闭http通道
   option  redispatch         #serverId对应的服务器挂掉后,强制定向到其他健康的服务器
   option  forwardfor
   option  dontlognull
   maxconn 50000              #最大连接数
   contimeout      5000       #连接超时(毫秒)
   clitimeout      50000      #客户端超时(毫秒)
   srvtimeout      50000      #服务器超时(毫秒)

   #errorfile 502 /usr/local/haproxy/html/maintain.html
   #errorfile 503 /usr/local/haproxy/html/maintain.html
   #errorfile 504 /usr/local/haproxy/html/maintain.html


frontend test.com             #定义前端服务器(haproxy)
        bind *:80             #监听地址
        acl web-client path_beg -i /vsphere-client
        acl bbs hdr_reg(host) -i ^(bbs.test.com|shequ.test.com|forum)
        acl monitor hdr_beg(host) -i monitor.test.com    #定义ACL名称,对应的请求的主机头是monitor.test.com
        acl www hdr_beg(host) -i www.test.com
        use_backend  cache.test.com if static
        use_backend  monitor.test.com if bbs or monitor
        use_backend  www.test.com if www
        use_backend  vsphere-client if web-client

        default_backend www.test.com  #指定默认的后端服务器


backend monitor.test.com              #定义后端服务器群(web server/apache/nginx/iis..)
        mode http
        option  forwardfor    #后端服务器(apache/nginx/iis/*),从Http Header中获得客户端IP
        balance leastconn     #负载均衡的方式,最小连接
        cookie SERVERID       #插入serverid到cookie中,serverid后面可以定义
        option  httpchk HEAD /check.html #用来做健康检查html文档
        #option httpchk HEAD /index.php HTTP/1.1\r\nHost:monitor.test.com #HTTP && Host
        server server1 10.0.100.70:80 cookie server1 check inter 2000 rise 3 fall 3 weight 3
        #服务器定义:
        #cookie server1表示serverid为server1;
        #check inter 2000 是检测心跳频率(check 默认 );
        #rise 3 表示 3次正确认为服务器可用;
        #fall 3 表示 3次失败认为服务器不可用;
        #weight 表示权重。

backend www.test.com
        mode http
        option  forwardfor
        balance roundrobin    #负载均衡的方式,轮询方式
        cookie SERVERID
        option  httpchk HEAD /check.html
        server server1 10.0.100.71:80 cookie server1 check inter 2000 rise 3 fall 3 weight 3

backend vsphere-client
        mode http
        option  forwardfor header ORIG_CLIENT_IP
        balance roundrobin
        server server1 10.0.100.81:80 redir https://192.168.57.81:443 check inter 2000 rise 3 fall 3 weight 3

backend cache.test.com
        option  forwardfor
        #balance uri len 15 #url hash
        balance roundrobin
        server server1 10.0.100.73:80  check inter 2000 rise 3 fall 3 weight 3
        server server2 10.0.100.75:80  check inter 2000 rise 3 fall 3 weight 3

listen admin_stat                   #status
    bind 0.0.0.0:8080               #监听端口
    mode http                       #http的7层模式
    stats refresh 30s               #统计页面自动刷新时间
    stats uri /haproxy_stats_url    #统计页面URL
    stats realm Haproxy\ Statistics #统计页面密码框上提示文本
    stats auth admin:admin          #统计页面用户名和密码设置
    stats hide-version              #隐藏统计页面上HAProxy的版本信息
    stats admin if TRUE             #手工启用/禁用,后端服务器

 

 

2 其它acl 规则

 

###########acl 开始了############
acl bbs       hdr_reg(host) -i ^(bbs.test.com|forum.test.com)  #使用正则匹配
acl bbs_path  path_beg -i /bbs                #url 目录
acl youxi     path_beg -i /youxi
acl static    path_end -i .html .css .js      #url 结尾文件
acl php       path_end -i .php
acl jsp       path_end -i .jsp .do

use_backend bbs_pool if bbs or bbs_path       #注意 "or"
use_backend youxi_pool if youxi
use_backend static_pool if static
use_backend php_pool if php
use_backend jsp_pool if jsp
default_backend www.test.com
###########acl 结束了############

 

 

#acl 参数

acl(关键字) 定义acl(名称)  方法          -i (忽略大小写)  [匹配的路径或文件]

                          hdr_beg(host)

                          hdr_reg(host)

                          path_beg

                          path_end

 

 

3 use_backend 参数

 

or 用于匹配多个acl 名称
default_backend 没有满足条件的时候使用默认的后端服务器

 

 

参考1 

http://chiahu.com/blog/?p=532

 

参考2

http://xok.la/2010/07/haproxy.html  (404 了囧)

http://jk409.blog.51cto.com/406667/764782 (感谢google)

 

# 20120610

haproxy 重定向url (301)

acl web-client path_beg -i /vsphere-client

use_backend  vsphere-client if web-client

backend vsphere-client
        mode http
        option  forwardfor header ORIG_CLIENT_IP
        balance roundrobin
        option  httpchk HEAD /check.html
        server server1 10.0.100.81:80 redir https://192.168.57.81:443 check inter 2000 rise 3 fall 3 weight 3

测试192.168.57.82 为 haproxy ，192.168.57.81 为 https server

curl -ILv http://192.168.57.82/vsphere-client
* About to connect() to 192.168.57.82 port 80 (#0)
*   Trying 192.168.57.82... connected
* Connected to 192.168.57.82 (192.168.57.82) port 80 (#0)
> HEAD /vsphere-client HTTP/1.1
> User-Agent: curl/7.21.6 (x86_64-pc-linux-gnu) libcurl/7.21.6 OpenSSL/1.0.0e zlib/1.2.3.4 libidn/1.22 librtmp/2.3
> Host: 192.168.57.82
> Accept: */*
>
< HTTP/1.1 302 Found
HTTP/1.1 302 Found
< Cache-Control: no-cache
Cache-Control: no-cache
< Content-length: 0
Content-length: 0
< Location: https://192.168.57.81:443/vsphere-client
Location: https://192.168.57.81:443/vsphere-client
< Connection: close
Connection: close

<
* Closing connection #0
* Issue another request to this URL: 'https://192.168.57.81:443/vsphere-client'
* About to connect() to 192.168.57.81 port 443 (#0)
*   Trying 192.168.57.81... connected
* Connected to 192.168.57.81 (192.168.57.81) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS alert, Server hello (2):
* SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
* Closing connection #0

结束

更多欢迎到此讨论:

37275208