Skip to content

haproxy job from cf-haproxy/8

The HAProxy server can be used to terminate SSL in front of the Routers. Each HAProxy instance should point to multiple Routers.

Github source: 88368197 or master branch

Properties

ha_proxy

backend_port

Listening port for Router

Default
80

backend_servers

Array of the router IPs acting as the HTTP/TCP backends (should include servers all Availability Zones being used)

Default
[]

client_timeout

Timeout waiting for data from a client (in seconds)

Default
30

compress_types

If this property is set, gzip compression will be activated for the mime types named in this property. definition like ‘text/html text/plain text/css’

Default
""

connect_timeout

Timeout waiting for connections to establish to a server (in seconds)

Default
5

default_dh_param

Maximum size of DH params when generating epmehmeral keys during key exchange

Default
2048

disable_http

Disable port 80 traffic

Default
false

enable_4443

Enables port 4443 for backwards compatibility with WSS-based apps using the old CF haproxy

Default
false

headers

Hash of custom headers you wish you have set on each request. Spaces are automatically escaped, but any other haproxy delimiters will need to be escaped manually

Example
|+
  headers:
    X-Application-ID: my-custom-header
    MyCustomHeader: 3

https_redirect_all

If this is set to ‘true’, a https redirect rule for all http calls will be put in the config file

Default
false

https_redirect_domains

For each domain in this array, a HTTPS redirect rule will be put in the config file. Redirect will be applied for all subdomains

Default
[]

internal_only_domains

Array of domains for internal-only apps/services (not hostnames for the apps/services)

Default
[]

keepalive_timeout

Timeout waiting for new HTTP requests under http keep-alive mode (in seconds)

Default
1

log_level

Log level

Default
info

queue_timeout

Timeout for requests queued waiting for free connection slots (in seconds)

Default
30

request_timeout

Maximum HTTP request length (in seconds)

Default
30

routed_backend_servers

Hash of the URL prefixes -> array of the router IPs acting as the HTTP/TCP backends (should include servers all Availability Zones being used)

Default
{}

server_timeout

Timeout waiting for data from a server (in seconds)

Default
30

ssl_ciphers

List of SSL Ciphers that are passed to HAProxy

Default
ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:AES128:AES256:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK

ssl_pem

SSL certificate (PEM file), or an array of SSL certificates (PEM files)

syslog_server

An IPv4 address optionally followed by a colon and a UDP port. It can also be an IPv6 address or filesystem path to a UNIX domain socket.

Default
127.0.0.1

tcp

List of mappings to perform tcp-based proxying on. See example for mapping datastructure and keys

Default
[]
Example
tcp:
- backend_port: 80
  backend_servers:
  - 10.20.10.10
  - 10.20.10.11
  name: wss
  port: 4443
  ssl: true

websocket_timeout

Timeout for websocket/tunnel traffic (in seconds)

Default
3600

Templates

Templates are rendered and placed onto corresponding instances during the deployment process. This job's templates will be placed into /var/vcap/jobs/haproxy/ directory (learn more).

  • bin/haproxy_ctl (from haproxy_ctl)
  • bin/monit_debugger (from monit_debugger)
  • config/certs.ttar (from certs.ttar.erb)
  • config/haproxy.config (from haproxy.config.erb)
  • config/ssl_redirect.map (from ssl_redirect.map.erb)
  • data/properties.sh (from properties.sh.erb)
  • helpers/ctl_setup.sh (from helpers/ctl_setup.sh)
  • helpers/ctl_utils.sh (from helpers/ctl_utils.sh)

Packages

Packages are compiled and placed onto corresponding instances during the deployment process. Packages will be placed into /var/vcap/packages/ directory.