|
2 | 2 | <html lang="en"> |
3 | 3 | <head> |
4 | 4 | <meta charset="utf-8" /> |
5 | | - <title>HAProxy version 3.3-dev13-23 - Configuration Manual</title> |
| 5 | + <title>HAProxy version 3.3-dev13-44 - Configuration Manual</title> |
6 | 6 | <link href="https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/css/bootstrap.min.css" rel="stylesheet" /> |
7 | 7 | <link href="https://raw.githubusercontent.com/thomaspark/bootswatch/v3.3.7/cerulean/bootstrap.min.css" rel="stylesheet" /> |
8 | 8 | <link href="../css/page.css?0.4.2-15" rel="stylesheet" /> |
|
4699 | 4699 | You can use <strong>left</strong> and <strong>right</strong> arrow keys to navigate between chapters.<br> |
4700 | 4700 | </p> |
4701 | 4701 | <p class="text-right"> |
4702 | | - <small>Converted with <a href="https://github.com/cbonte/haproxy-dconv">haproxy-dconv</a> v<b>0.4.2-15</b> on <b>2025/11/17</b></small> |
| 4702 | + <small>Converted with <a href="https://github.com/cbonte/haproxy-dconv">haproxy-dconv</a> v<b>0.4.2-15</b> on <b>2025/11/20</b></small> |
4703 | 4703 | </p> |
4704 | 4704 | </div> |
4705 | 4705 | <!-- /.sidebar --> |
|
4710 | 4710 | <div class="text-center"> |
4711 | 4711 | <h1><a href="http://www.haproxy.org/" title="HAProxy"><img src="../img/HAProxyCommunityEdition_60px.png?0.4.2-15" /></a></h1> |
4712 | 4712 | <h2>Configuration Manual</h2> |
4713 | | - <p><strong>version 3.3-dev13-23</strong></p> |
| 4713 | + <p><strong>version 3.3-dev13-44</strong></p> |
4714 | 4714 | <p> |
4715 | 4715 | 2025/11/14<br> |
4716 | 4716 |
|
@@ -6404,6 +6404,8 @@ <h3 id="chapter-1.4.1" data-target="1.4.1"><small><a class="small" href="#1.4.1" |
6404 | 6404 | 408 when the request timeout strikes before the request is complete |
6405 | 6405 | 410 when the requested resource is no longer available and will not |
6406 | 6406 | be available again |
| 6407 | + 413 when a HTTP/1.0 GET/HEAD/DELETE requests has a payload, also see |
| 6408 | + the "<a href="#h1-accept-payload-with-any-method">h1-accept-payload-with-any-method</a>" option |
6407 | 6409 | 500 when HAProxy encounters an unrecoverable internal error, such as a |
6408 | 6410 | memory allocation failure, which should never happen |
6409 | 6411 | 501 when HAProxy is unable to satisfy a client request because of an |
@@ -8373,7 +8375,8 @@ <h2 id="chapter-3.1" data-target="3.1"><small><a class="small" href="#3.1">3.1.< |
8373 | 8375 | </div><div class="page-header"><b>See also:</b> hard-stop-after, monitor</div> |
8374 | 8376 | <a class="anchor" name="group"></a><a class="anchor" name="3-group"></a><a class="anchor" name="3.1-group"></a><a class="anchor" name="group (Global section)"></a><a class="anchor" name="group (Process management and security)"></a><div class="keyword"><b><a class="anchor" name="group"></a><a href="#3.1-group">group</a></b> <span style="color: #080"><group name></span></div><pre class="text">Similar to "<span class="dropdown"><a class="dropdown-toggle" data-toggle="dropdown" href="#">gid<span class="caret"></span></a><ul class="dropdown-menu"><li class="dropdown-header">This keyword is available in sections :</li><li><a href="#gid%20%28Process%20management%20and%20security%29">Process management and security</a></li><li><a href="#gid%20%28Bind%20options%29">Bind options</a></li></ul></span>" but uses the GID of group name <group name> from /etc/group. |
8375 | 8377 | See also "<span class="dropdown"><a class="dropdown-toggle" data-toggle="dropdown" href="#">gid<span class="caret"></span></a><ul class="dropdown-menu"><li class="dropdown-header">This keyword is available in sections :</li><li><a href="#gid%20%28Process%20management%20and%20security%29">Process management and security</a></li><li><a href="#gid%20%28Bind%20options%29">Bind options</a></li></ul></span>" and "<span class="dropdown"><a class="dropdown-toggle" data-toggle="dropdown" href="#">user<span class="caret"></span></a><ul class="dropdown-menu"><li class="dropdown-header">This keyword is available in sections :</li><li><a href="#user%20%28Userlists%29">Userlists</a></li><li><a href="#user%20%28Process%20management%20and%20security%29">Process management and security</a></li><li><a href="#user%20%28Bind%20options%29">Bind options</a></li></ul></span>". |
8376 | | -</pre><a class="anchor" name="h1-accept-payload-with-any-method"></a><a class="anchor" name="3-h1-accept-payload-with-any-method"></a><a class="anchor" name="3.1-h1-accept-payload-with-any-method"></a><a class="anchor" name="h1-accept-payload-with-any-method (Global section)"></a><a class="anchor" name="h1-accept-payload-with-any-method (Process management and security)"></a><div class="keyword"><b><a class="anchor" name="h1-accept-payload-with-any-method"></a><a href="#3.1-h1-accept-payload-with-any-method">h1-accept-payload-with-any-method</a></b></div><pre class="text">Does not reject HTTP/1.0 GET/HEAD/DELETE requests with a payload. |
| 8378 | +</pre><a class="anchor" name="h1-accept-payload-with-any-method"></a><a class="anchor" name="3-h1-accept-payload-with-any-method"></a><a class="anchor" name="3.1-h1-accept-payload-with-any-method"></a><a class="anchor" name="h1-accept-payload-with-any-method (Global section)"></a><a class="anchor" name="h1-accept-payload-with-any-method (Process management and security)"></a><div class="keyword"><b><a class="anchor" name="h1-accept-payload-with-any-method"></a><a href="#3.1-h1-accept-payload-with-any-method">h1-accept-payload-with-any-method</a></b></div><pre class="text">Does not reject HTTP/1.0 GET/HEAD/DELETE requests with a payload with a |
| 8379 | +413 Payload Too Large HTTP response. |
8377 | 8380 |
|
8378 | 8381 | While It is explicitly allowed in HTTP/1.1, HTTP/1.0 is not clear on this |
8379 | 8382 | point and some old servers don't expect any payload and never look for body |
@@ -21650,14 +21653,19 @@ <h2 id="chapter-5.1" data-target="5.1"><small><a class="small" href="#5.1">5.1.< |
21650 | 21653 | Here are the protocols that may be used as argument to a "<span class="dropdown"><a class="dropdown-toggle" data-toggle="dropdown" href="#">proto<span class="caret"></span></a><ul class="dropdown-menu"><li class="dropdown-header">This keyword is available in sections :</li><li><a href="#proto%20%28Bind%20options%29">Bind options</a></li><li><a href="#proto%20%28Server%20and%20default-server%20options%29">Server and default-server options</a></li></ul></span>" directive on |
21651 | 21654 | a bind line : |
21652 | 21655 |
|
| 21656 | + quic : mode=HTTP side=FE|BE mux=QUIC flags=HTX|NO_UPG|FRAMED |
21653 | 21657 | h2 : mode=HTTP side=FE|BE mux=H2 flags=HTX|HOL_RISK|NO_UPG |
21654 | 21658 | h1 : mode=HTTP side=FE|BE mux=H1 flags=HTX|NO_UPG |
21655 | 21659 | none : mode=TCP side=FE|BE mux=PASS flags=NO_UPG |
21656 | 21660 |
|
21657 | 21661 | Idea behind this option is to bypass the selection of the best multiplexer's |
21658 | 21662 | protocol for all connections instantiated from this listening socket. For |
21659 | | -instance, it is possible to force the http/2 on clear TCP by specifying "proto |
21660 | | -h2" on the bind line. |
| 21663 | +instance, it is possible to force the http/2 on clear TCP by specifying |
| 21664 | +"proto h2" on the bind line. |
| 21665 | + |
| 21666 | +If the ALPN or the NPN settings are configured, the specified protocols |
| 21667 | +should be compatible with the multiplexer's protocol to avoid any issue. For |
| 21668 | +instance, if "proto h1" is set, the ALPN should not be set to "h2". |
21661 | 21669 | </pre><a class="anchor" name="quic-cc-algo"></a><a class="anchor" name="5-quic-cc-algo"></a><a class="anchor" name="5.1-quic-cc-algo"></a><a class="anchor" name="quic-cc-algo (Bind and server options)"></a><a class="anchor" name="quic-cc-algo (Bind options)"></a><div class="keyword"><b><a class="anchor" name="quic-cc-algo"></a><a href="#5.1-quic-cc-algo">quic-cc-algo</a></b> <span style="color: #800">{ cubic | newreno | bbr | nocc }</span><span style="color: #008">[(<span style="color: #080"><args,...></span>)]</span></div><pre class="text">This is a QUIC specific setting to select the congestion control algorithm |
21662 | 21670 | for any connection attempts to the configured QUIC listeners. They are |
21663 | 21671 | similar to those used by TCP. |
@@ -22236,11 +22244,16 @@ <h2 id="chapter-5.2" data-target="5.2"><small><a class="small" href="#5.2">5.2.< |
22236 | 22244 | h1 : mode=HTTP side=FE|BE mux=H1 flags=HTX|NO_UPG |
22237 | 22245 | none : mode=TCP side=FE|BE mux=PASS flags=NO_UPG |
22238 | 22246 | quic : mode=HTTP side=FE|BE mux=QUIC flags=HTX|NO_UPG|FRAMED |
| 22247 | + spop : mode=SPOP side=BE mux=SPOP flags=HOL_RISK|NO_UPG |
22239 | 22248 |
|
22240 | 22249 | Idea behind this option is to bypass the selection of the best multiplexer's |
22241 | 22250 | protocol for health-check connections established to this server. |
22242 | 22251 | If not defined, the server one will be used, if set. |
22243 | 22252 |
|
| 22253 | +If the ALPN or the NPN settings are configured, the specified protocols |
| 22254 | +should be compatible with the multiplexer's protocol to avoid any issue. For |
| 22255 | +instance, if "proto h1" is set, the ALPN should not be set to "h2". |
| 22256 | + |
22244 | 22257 | QUIC check configuration is not fully implemented yet. First, QUIC checks may |
22245 | 22258 | only be performed for QUIC servers. Second, if one or more check specific |
22246 | 22259 | connection parameters is specified on a QUIC server, check protocol will |
@@ -22960,10 +22973,15 @@ <h2 id="chapter-5.2" data-target="5.2"><small><a class="small" href="#5.2">5.2.< |
22960 | 22973 | fcgi : mode=HTTP side=BE mux=FCGI flags=HTX|HOL_RISK|NO_UPG |
22961 | 22974 | h1 : mode=HTTP side=FE|BE mux=H1 flags=HTX|NO_UPG |
22962 | 22975 | none : mode=TCP side=FE|BE mux=PASS flags=NO_UPG |
| 22976 | + spop : mode=SPOP side=BE mux=SPOP flags=HOL_RISK|NO_UPG |
22963 | 22977 |
|
22964 | 22978 | Idea behind this option is to bypass the selection of the best multiplexer's |
22965 | 22979 | protocol for all connections established to this server. |
22966 | 22980 |
|
| 22981 | +If the ALPN or the NPN settings are configured, the specified protocols |
| 22982 | +should be compatible with the multiplexer's protocol to avoid any issue. For |
| 22983 | +instance, if "proto h1" is set, the ALPN should not be set to "h2". |
| 22984 | + |
22967 | 22985 | See also "<a href="#ws">ws</a>" to use an alternative protocol for websocket streams. |
22968 | 22986 | </pre><a class="anchor" name="redir"></a><a class="anchor" name="5-redir"></a><a class="anchor" name="5.2-redir"></a><a class="anchor" name="redir (Bind and server options)"></a><a class="anchor" name="redir (Server and default-server options)"></a><div class="keyword"><b><a class="anchor" name="redir"></a><a href="#5.2-redir">redir</a></b> <span style="color: #080"><prefix></span></div><pre class="text">May be used in the following contexts: http |
22969 | 22987 |
|
@@ -33685,13 +33703,22 @@ <h2 id="chapter-12.8" data-target="12.8"><small><a class="small" href="#12.8">12 |
33685 | 33703 | is experimental meaning that "<a href="#expose-experimental-directives">expose-experimental-directives</a>" must be in the |
33686 | 33704 | global section so this can be used. |
33687 | 33705 |
|
33688 | | -Current limitations as of 3.2: The feature is limited to the HTTP-01 challenge |
33689 | | -for now. The current HAProxy architecture is a non-blocking model, access to |
33690 | | -the disk is not supposed to be done after the configuration is loaded, because |
33691 | | -it could block the event loop, blocking the traffic on the same thread. Meaning |
33692 | | -that the certificates and keys generated from HAProxy will need to be dumped |
33693 | | -from outside HAProxy using "dump ssl cert" on the stats socket. |
33694 | | -External Account Binding (EAB) is not supported. |
| 33706 | +Current limitations as of 3.3: |
| 33707 | +- The feature is limited to the HTTP-01 or DNS-01 challenges for now. HTTP-01 |
| 33708 | + is completely handled by HAProxy, but DNS-01 needs either the dataplaneAPI or |
| 33709 | + another 3rd party tool to talk to a DNS provider API. |
| 33710 | +- It is possible to start without an existing certificate on the disk. To do |
| 33711 | + so, the certificate must configured in a crt-store. |
| 33712 | + When using the "<span class="dropdown"><a class="dropdown-toggle" data-toggle="dropdown" href="#">acme<span class="caret"></span></a><ul class="dropdown-menu"><li class="dropdown-header">This keyword is available in sections :</li><li><a href="#acme%20%28Load%20options%29">Load options</a></li><li><a href="#acme%20%28ACME%29">ACME</a></li></ul></span>" keyword in a crt-store, a temporary key pair will be |
| 33713 | + used until the ACME certificate is generated. |
| 33714 | +- The current HAProxy architecture is a non-blocking model, access to the disk |
| 33715 | + is not supposed to be done after the configuration is loaded, because it |
| 33716 | + could block the event loop, blocking the traffic on the same thread. Meaning |
| 33717 | + that the certificates and keys generated from HAProxy will need to be dumped |
| 33718 | + from outside HAProxy using "dump ssl cert" on the stats socket. It's possible |
| 33719 | + to automate the dump of the certificates by using the dataplaneAPI or the |
| 33720 | + haproxy-dump-certs script provided in the admin/cli/ directory. |
| 33721 | +- External Account Binding (EAB) is not supported. |
33695 | 33722 |
|
33696 | 33723 | The ACME scheduler starts at HAProxy startup, it will loop over the |
33697 | 33724 | certificates and start an ACME renewal task when the notAfter task is past |
@@ -33785,7 +33812,7 @@ <h2 id="chapter-12.8" data-target="12.8"><small><a class="small" href="#12.8">12 |
33785 | 33812 | <br> |
33786 | 33813 | <hr> |
33787 | 33814 | <div class="text-right"> |
33788 | | - HAProxy 3.3-dev13-23 – Configuration Manual<br> |
| 33815 | + HAProxy 3.3-dev13-44 – Configuration Manual<br> |
33789 | 33816 | <small>, 2025/11/14</small> |
33790 | 33817 | </div> |
33791 | 33818 | </div> |
|
0 commit comments