|
2 | 2 | <html lang="en"> |
3 | 3 | <head> |
4 | 4 | <meta charset="utf-8" /> |
5 | | - <title>HAProxy version 3.2-dev14-35 - Configuration Manual</title> |
| 5 | + <title>HAProxy version 3.2-dev15-11 - Configuration Manual</title> |
6 | 6 | <link href="https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/css/bootstrap.min.css" rel="stylesheet" /> |
7 | 7 | <link href="https://raw.githubusercontent.com/thomaspark/bootswatch/v3.3.7/cerulean/bootstrap.min.css" rel="stylesheet" /> |
8 | 8 | <link href="../css/page.css?0.4.2-15" rel="stylesheet" /> |
|
1355 | 1355 |
|
1356 | 1356 | <a class="list-group-item" href="#acme (ACME)">acme (ACME)</a> |
1357 | 1357 |
|
| 1358 | + <a class="list-group-item" href="#acme.scheduler">acme.scheduler</a> |
| 1359 | + |
1358 | 1360 | <a class="list-group-item" href="#act_conn">act_conn</a> |
1359 | 1361 |
|
1360 | 1362 | <a class="list-group-item" href="#add">add</a> |
|
4561 | 4563 | You can use <strong>left</strong> and <strong>right</strong> arrow keys to navigate between chapters.<br> |
4562 | 4564 | </p> |
4563 | 4565 | <p class="text-right"> |
4564 | | - <small>Converted with <a href="https://github.com/cbonte/haproxy-dconv">haproxy-dconv</a> v<b>0.4.2-15</b> on <b>2025/05/07</b></small> |
| 4566 | + <small>Converted with <a href="https://github.com/cbonte/haproxy-dconv">haproxy-dconv</a> v<b>0.4.2-15</b> on <b>2025/05/09</b></small> |
4565 | 4567 | </p> |
4566 | 4568 | </div> |
4567 | 4569 | <!-- /.sidebar --> |
|
4572 | 4574 | <div class="text-center"> |
4573 | 4575 | <h1><a href="http://www.haproxy.org/" title="HAProxy"><img src="../img/HAProxyCommunityEdition_60px.png?0.4.2-15" /></a></h1> |
4574 | 4576 | <h2>Configuration Manual</h2> |
4575 | | - <p><strong>version 3.2-dev14-35</strong></p> |
| 4577 | + <p><strong>version 3.2-dev15-11</strong></p> |
4576 | 4578 | <p> |
4577 | | - 2025/05/02<br> |
| 4579 | + 2025/05/09<br> |
4578 | 4580 |
|
4579 | 4581 | </p> |
4580 | 4582 | </div> |
@@ -7470,7 +7472,16 @@ <h2 id="chapter-3.1" data-target="3.1"><small><a class="small" href="#3.1">3.1.< |
7470 | 7472 |
|
7471 | 7473 | Please note that this option is only available when HAProxy has been |
7472 | 7474 | compiled with USE_51DEGREES and 51DEGREES_VER=4. |
7473 | | -</pre><a class="anchor" name="ca-base"></a><a class="anchor" name="3-ca-base"></a><a class="anchor" name="3.1-ca-base"></a><a class="anchor" name="ca-base (Global parameters)"></a><a class="anchor" name="ca-base (Process management and security)"></a><div class="keyword"><b><a class="anchor" name="ca-base"></a><a href="#3.1-ca-base">ca-base</a></b> <span style="color: #080"><dir></span></div><pre class="text">Assigns a default directory to fetch SSL CA certificates and CRLs from when a |
| 7475 | +</pre><a class="anchor" name="acme.scheduler"></a><a class="anchor" name="3-acme.scheduler"></a><a class="anchor" name="3.1-acme.scheduler"></a><a class="anchor" name="acme.scheduler (Global parameters)"></a><a class="anchor" name="acme.scheduler (Process management and security)"></a><div class="keyword"><b><a class="anchor" name="acme.scheduler"></a><a href="#3.1-acme.scheduler">acme.scheduler</a></b> <span style="color: #800">{ auto | off }</span></div><pre class="text">Enable or disable the ACME scheduler. |
| 7476 | + |
| 7477 | +The ACME scheduler starts at HAProxy startup, it will loop over the |
| 7478 | +certificates and start an ACME renewal task when the notAfter value is past |
| 7479 | +curtime + (notAfter - notBefore) / 12, or 7 days if notBefore is not defined. |
| 7480 | +The scheduler will then sleep and wakeup after 12 hours. |
| 7481 | + |
| 7482 | +The default value is "auto". |
| 7483 | +</pre><div class="page-header"><b>See also:</b> acme</div> |
| 7484 | +<a class="anchor" name="ca-base"></a><a class="anchor" name="3-ca-base"></a><a class="anchor" name="3.1-ca-base"></a><a class="anchor" name="ca-base (Global parameters)"></a><a class="anchor" name="ca-base (Process management and security)"></a><div class="keyword"><b><a class="anchor" name="ca-base"></a><a href="#3.1-ca-base">ca-base</a></b> <span style="color: #080"><dir></span></div><pre class="text">Assigns a default directory to fetch SSL CA certificates and CRLs from when a |
7474 | 7485 | relative path is used with "<span class="dropdown"><a class="dropdown-toggle" data-toggle="dropdown" href="#">ca-file<span class="caret"></span></a><ul class="dropdown-menu"><li class="dropdown-header">This keyword is available in sections :</li><li><a href="#ca-file%20%28Bind%20options%29">Bind options</a></li><li><a href="#ca-file%20%28Server%20and%20default-server%20options%29">Server and default-server options</a></li></ul></span>", "<a href="#ca-verify-file">ca-verify-file</a>" or "<span class="dropdown"><a class="dropdown-toggle" data-toggle="dropdown" href="#">crl-file<span class="caret"></span></a><ul class="dropdown-menu"><li class="dropdown-header">This keyword is available in sections :</li><li><a href="#crl-file%20%28Bind%20options%29">Bind options</a></li><li><a href="#crl-file%20%28Server%20and%20default-server%20options%29">Server and default-server options</a></li></ul></span>" |
7475 | 7486 | directives. Absolute locations specified in "<span class="dropdown"><a class="dropdown-toggle" data-toggle="dropdown" href="#">ca-file<span class="caret"></span></a><ul class="dropdown-menu"><li class="dropdown-header">This keyword is available in sections :</li><li><a href="#ca-file%20%28Bind%20options%29">Bind options</a></li><li><a href="#ca-file%20%28Server%20and%20default-server%20options%29">Server and default-server options</a></li></ul></span>", "<a href="#ca-verify-file">ca-verify-file</a>" and |
7476 | 7487 | "<span class="dropdown"><a class="dropdown-toggle" data-toggle="dropdown" href="#">crl-file<span class="caret"></span></a><ul class="dropdown-menu"><li class="dropdown-header">This keyword is available in sections :</li><li><a href="#crl-file%20%28Bind%20options%29">Bind options</a></li><li><a href="#crl-file%20%28Server%20and%20default-server%20options%29">Server and default-server options</a></li></ul></span>" prevail and ignore "<a href="#ca-base">ca-base</a>". |
@@ -7794,6 +7805,7 @@ <h2 id="chapter-3.1" data-target="3.1"><small><a class="small" href="#3.1">3.1.< |
7794 | 7805 | - "<a href="#ipv4">ipv4</a>": query and accept IPv4 addresses ("A" records) |
7795 | 7806 | - "<a href="#ipv6">ipv6</a>": query and accept IPv6 addresses ("AAAA" records) |
7796 | 7807 | - "auto": use IPv4, and IPv6 if the system has a default gateway for it. |
| 7808 | + The result of the last check is cached for 30 seconds. |
7797 | 7809 |
|
7798 | 7810 | When a single family is used, no request will be sent to resolvers for the |
7799 | 7811 | other family, and any response for the othe family will be ignored. The |
@@ -22887,15 +22899,20 @@ <h2 id="chapter-5.2" data-target="5.2"><small><a class="small" href="#5.2">5.2.< |
22887 | 22899 | instances on the fly. This option defaults to "last,libc" indicating that the |
22888 | 22900 | previous address found in the state file (if any) is used first, otherwise |
22889 | 22901 | the libc's resolver is used. This ensures continued compatibility with the |
22890 | | -historic behavior. |
22891 | | -</pre><div class="separator"> |
22892 | | -<span class="label label-success">Example:</span> |
22893 | | -<pre class="prettyprint"> |
22894 | | -<code>defaults |
22895 | | - <span class="comment"># never fail on address resolution</span> |
22896 | | - default-server init-addr last,libc,none |
22897 | | -</code></pre> |
22898 | | -</div><a class="anchor" name="inter"></a><a class="anchor" name="5-inter"></a><a class="anchor" name="5.2-inter"></a><a class="anchor" name="inter (Bind and server options)"></a><a class="anchor" name="inter (Server and default-server options)"></a><div class="keyword"><b><a class="anchor" name="inter"></a><a href="#5.2-inter">inter</a></b> <span style="color: #080"><delay></span></div><a class="anchor" name="fastinter"></a><a class="anchor" name="5-fastinter"></a><a class="anchor" name="5.2-fastinter"></a><a class="anchor" name="fastinter (Bind and server options)"></a><a class="anchor" name="fastinter (Server and default-server options)"></a><div class="keyword"><b><a class="anchor" name="fastinter"></a><a href="#5.2-fastinter">fastinter</a></b> <span style="color: #080"><delay></span></div><a class="anchor" name="downinter"></a><a class="anchor" name="5-downinter"></a><a class="anchor" name="5.2-downinter"></a><a class="anchor" name="downinter (Bind and server options)"></a><a class="anchor" name="downinter (Server and default-server options)"></a><div class="keyword"><b><a class="anchor" name="downinter"></a><a href="#5.2-downinter">downinter</a></b> <span style="color: #080"><delay></span></div><pre class="text">May be used in the following contexts: tcp, http, log |
| 22902 | +historic behavior. When using internal resolvers, it is generally recommended |
| 22903 | +to either disable libc-based resolution, or make it explicit (see <a href="#5.3">section 5.3</a> |
| 22904 | +for more details). |
| 22905 | + |
| 22906 | +Example 1: |
| 22907 | + defaults |
| 22908 | + # never fail on address resolution |
| 22909 | + default-server init-addr last,libc,none |
| 22910 | + |
| 22911 | +Example 2: |
| 22912 | + defaults |
| 22913 | + # disable libc resolution in combination with resolvers |
| 22914 | + default-server init-addr last,none |
| 22915 | +</pre><a class="anchor" name="inter"></a><a class="anchor" name="5-inter"></a><a class="anchor" name="5.2-inter"></a><a class="anchor" name="inter (Bind and server options)"></a><a class="anchor" name="inter (Server and default-server options)"></a><div class="keyword"><b><a class="anchor" name="inter"></a><a href="#5.2-inter">inter</a></b> <span style="color: #080"><delay></span></div><a class="anchor" name="fastinter"></a><a class="anchor" name="5-fastinter"></a><a class="anchor" name="5.2-fastinter"></a><a class="anchor" name="fastinter (Bind and server options)"></a><a class="anchor" name="fastinter (Server and default-server options)"></a><div class="keyword"><b><a class="anchor" name="fastinter"></a><a href="#5.2-fastinter">fastinter</a></b> <span style="color: #080"><delay></span></div><a class="anchor" name="downinter"></a><a class="anchor" name="5-downinter"></a><a class="anchor" name="5.2-downinter"></a><a class="anchor" name="downinter (Bind and server options)"></a><a class="anchor" name="downinter (Server and default-server options)"></a><div class="keyword"><b><a class="anchor" name="downinter"></a><a href="#5.2-downinter">downinter</a></b> <span style="color: #080"><delay></span></div><pre class="text">May be used in the following contexts: tcp, http, log |
22899 | 22916 |
|
22900 | 22917 | The "<a href="#inter">inter</a>" parameter sets the interval between two consecutive health checks |
22901 | 22918 | to <delay> milliseconds. If left unspecified, the delay defaults to 2000 ms. |
@@ -23441,13 +23458,16 @@ <h2 id="chapter-5.2" data-target="5.2"><small><a class="small" href="#5.2">5.2.< |
23441 | 23458 | </div><a class="anchor" name="resolvers"></a><a class="anchor" name="5-resolvers"></a><a class="anchor" name="5.2-resolvers"></a><a class="anchor" name="resolvers (Bind and server options)"></a><a class="anchor" name="resolvers (Server and default-server options)"></a><div class="keyword"><b><a class="anchor" name="resolvers"></a><a href="#5.2-resolvers">resolvers</a></b> <span style="color: #080"><id></span></div><pre class="text">May be used in the following contexts: tcp, http, log |
23442 | 23459 |
|
23443 | 23460 | Points to an existing "<span class="dropdown"><a class="dropdown-toggle" data-toggle="dropdown" href="#">resolvers<span class="caret"></span></a><ul class="dropdown-menu"><li class="dropdown-header">This keyword is available in sections :</li><li><a href="#resolvers%20%28Server%20and%20default-server%20options%29">Server and default-server options</a></li><li><a href="#resolvers%20%28The%20resolvers%20section%29">The resolvers section</a></li></ul></span>" section to resolve current server's |
23444 | | -hostname. |
| 23461 | +hostname. It is often recommended to disable libc-based resolution when using |
| 23462 | +resolvers, though exceptions exist (see <a href="#5.3.1">section 5.3.1</a>). In any case it is a |
| 23463 | +good practice to explicitly specify "<a href="#init-addr">init-addr</a>" when using resolvers in order |
| 23464 | +not to overlook this element. |
23445 | 23465 | </pre><div class="separator"> |
23446 | 23466 | <span class="label label-success">Example:</span> |
23447 | 23467 | <pre class="prettyprint"> |
23448 | | -<code>server s1 app1.domain.com:80 check resolvers mydns |
| 23468 | +<code>server s1 app1.domain.com:80 init-addr last,none check resolvers mydns |
23449 | 23469 | </code></pre> |
23450 | | -</div><pre class="text">See also <a href="#5.3">section 5.3</a> |
| 23470 | +</div><pre class="text">See also <a href="#5.3">section 5.3</a> for implementation details and traps to be aware of. |
23451 | 23471 | </pre><a class="anchor" name="send-proxy"></a><a class="anchor" name="5-send-proxy"></a><a class="anchor" name="5.2-send-proxy"></a><a class="anchor" name="send-proxy (Bind and server options)"></a><a class="anchor" name="send-proxy (Server and default-server options)"></a><div class="keyword"><b><a class="anchor" name="send-proxy"></a><a href="#5.2-send-proxy">send-proxy</a></b></div><pre class="text">May be used in the following contexts: tcp, http |
23452 | 23472 |
|
23453 | 23473 | The "<a href="#send-proxy">send-proxy</a>" parameter enforces use of the PROXY protocol over any |
@@ -23782,10 +23802,13 @@ <h2 id="chapter-5.3" data-target="5.3"><small><a class="small" href="#5.3">5.3.< |
23782 | 23802 | This is not sufficient in some cases, such as in Amazon where a server's IP |
23783 | 23803 | can change after a reboot or an ELB Virtual IP can change based on current |
23784 | 23804 | workload. |
| 23805 | + |
23785 | 23806 | This chapter describes how HAProxy can be configured to process server's name |
23786 | 23807 | resolution at run time. |
23787 | | -Whether run time server name resolution has been enable or not, HAProxy will |
23788 | | -carry on doing the first resolution when parsing the configuration. |
| 23808 | + |
| 23809 | +Whether run time server name resolution has been enable or not, by default |
| 23810 | +HAProxy will do the first resolution at startup during configuration parsing |
| 23811 | +via libc unless disabled by the "<a href="#init-addr">init-addr</a>" parameter. |
23789 | 23812 | </pre></div> |
23790 | 23813 | <a class="anchor" id="5.3.1" name="5.3.1"></a> |
23791 | 23814 | <h3 id="chapter-5.3.1" data-target="5.3.1"><small><a class="small" href="#5.3.1">5.3.1.</a></small> Global overview</h3> |
@@ -23817,6 +23840,17 @@ <h3 id="chapter-5.3.1" data-target="5.3.1"><small><a class="small" href="#5.3.1" |
23817 | 23840 |
|
23818 | 23841 | - a resolution is considered as invalid (NX, timeout, refused), when all the |
23819 | 23842 | servers return an error. |
| 23843 | + |
| 23844 | + - The DNS client implemented in HAProxy is very basic and will not understand |
| 23845 | + the vast number of options and advanced setups that an operating system's |
| 23846 | + resolver can deal with. As such, except for really trivial setups where a |
| 23847 | + server known by its FQDN only has exactly one IP address at a time and |
| 23848 | + might occasionally renew it (e.g. a reboot), it is highly recommended to |
| 23849 | + avoid mixing libc-based init-time resolution with DNS-based runtime |
| 23850 | + resolution, as such setups are known to cause failures upon address |
| 23851 | + renewal. As a conclusion, unless you know exactly what you are doing, you |
| 23852 | + should always exclude "libc" from "<a href="#init-addr">init-addr</a>" when using "<span class="dropdown"><a class="dropdown-toggle" data-toggle="dropdown" href="#">resolvers<span class="caret"></span></a><ul class="dropdown-menu"><li class="dropdown-header">This keyword is available in sections :</li><li><a href="#resolvers%20%28Server%20and%20default-server%20options%29">Server and default-server options</a></li><li><a href="#resolvers%20%28The%20resolvers%20section%29">The resolvers section</a></li></ul></span>" on a |
| 23853 | + server line. |
23820 | 23854 | </pre></div> |
23821 | 23855 | <a class="anchor" id="5.3.2" name="5.3.2"></a> |
23822 | 23856 | <h3 id="chapter-5.3.2" data-target="5.3.2"><small><a class="small" href="#5.3.2">5.3.2.</a></small> The resolvers section</h3> |
@@ -32671,8 +32705,8 @@ <h2 id="chapter-11.3" data-target="11.3"><small><a class="small" href="#11.3">11 |
32671 | 32705 | <br> |
32672 | 32706 | <hr> |
32673 | 32707 | <div class="text-right"> |
32674 | | - HAProxy 3.2-dev14-35 – Configuration Manual<br> |
32675 | | - <small>, 2025/05/02</small> |
| 32708 | + HAProxy 3.2-dev15-11 – Configuration Manual<br> |
| 32709 | + <small>, 2025/05/09</small> |
32676 | 32710 | </div> |
32677 | 32711 | </div> |
32678 | 32712 | <!-- /.col-lg-12 --> |
|
0 commit comments