Haproxy配置支持https获取用户IP地址

Posted 2020-08-16 八戒

global
    log         127.0.0.1 local0

    chroot      /var/lib/haproxy        #chroot运行路径
    pidfile     /var/run/haproxy.pid    #haproxy 进程PID文件
    maxconn     65535                   #默认最大连接数,需考虑ulimit-n限制
    user        haproxy
    group       haproxy
    daemon                              #以后台形式运行harpoxy
    tune.ssl.default-dh-param 2048
  ssl-server-verify none
    stats socket /var/lib/haproxy/stats

defaults
    option                  forwardfor
    option                  httpclose
    option                  dontlognull #不记录健康检查日志信息
    option                  redispatch  #当serverId对应的服务器挂掉后，强制定向到其他健康的服务器，以后将不支持
    retries                 3           #两次连接失败就认为是服务器不可用，也可以通过后面设置
    timeout connect         10s         #连接超时
    timeout client          50s         #客户端超时
    timeout server          50s         #服务器超时
    maxconn                 65535       #默认最大连接数,需考虑ulimit-n限制

########统计页面配置########

listen admin_stats
    bind        0.0.0.0:5000            #设置Frontend和Backend的组合体，监控组的名称，按需要自定义名称
    mode        http                    #http的7层模式
    stats       refresh 30s             #统计页面自动刷新时间
    stats       uri     /haproxy        #统计页面url
    stats       realm   Cloud\Haproxy   #统计页面密码框上提示文本
    stats       auth    admin:admin     #设置监控页面的用户和密码:admin,可以设置多个用户名
    stats       hide-version            #隐藏统计页面上HAProxy的版本信息
    stats       admin if TRUE           #设置手工启动/禁用，后端服务器(haproxy-1.4.9以后版本)

########frontend前端配置##############

########backend后端配置##############

listen http_80
    bind 0.0.0.0:80
    mode http
    balance leastconn
    log global
    log-format "%Tl",%{+Q}ci,"%fi:%fp",%{+Q}bi,%{+Q}r,%ST,%B,%{+Q}hr,%Tt
    option httpclose
    option forwardfor
    option http-server-close
    capture request header Host len 255
    capture request header User-Agent len 255
    capture request header Referer len 255
    capture request header Cookie len 255
    timeout http-request 50s
    timeout http-keep-alive 55s
    server http_80_web1_80 192.168.6.15:80 cookie web1_80 weight 10 check inter 3000 rise 3 fall 5
    server http_80_web2_80 192.168.6.16:80 cookie web2_80 weight 10 check inter 3000 rise 3 fall 5
    acl ericdress_com hdr(host) -m str ericdress.com
    redirect prefix http://www.ericdress.com code 301 if ericdress_com

########tcp配置#################
listen https_443
    bind *:443 ssl crt /etc/ssl/certs/eric.pem  #需要设置证书文件的位置
  mode http
  option httpclose
  option forwardfor
  reqadd X-Forwarded-Proto:\ https            #增加http头
  capture request header Host len 255
  capture request header User-Agent len 255
  capture request header Referer len 255
  capture request header Cookie len 255
    timeout http-request 50s
    timeout http-keep-alive 55s
    server http_443_web1_443 192.168.6.15:443 ssl cookie web1_443 weight 10 check inter 3000 rise 3 fall 5
  server http_443_web2_443 192.168.6.16:443 ssl cookie web2_443 weight 10 check inter 3000 rise 3 fall 5