Le blog de Jean David TECHER, un Réunionnais à Saint-Priest/Lyon

1. Commands I used to build haproxy are shown below (I added instructions for zlib. All commands are taken from https://gist.github.com/codingtony/24fab751202dff4d547c. I am not the original author of all those commands. Kudo to this author to share his knowledge)

   DIR=$PWD
   
   #Compile static version of libressl
   export STATICLIBSSL=/tmp/staticlibssl
   wget http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.2.3.tar.gz
   tar xvzf libressl-2.2.3.tar.gz 
   cd libressl-2.2.3
   ./configure --prefix=$STATICLIBSSL --enable-shared=no
   make
   make install && cd $DIR
   
   export STATICLIBPCRE=/tmp/staticlibpcre
   wget ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/pcre-8.37.tar.bz2
   tar xvjf pcre-8.37.tar.bz2 
   cd pcre-8.37
   ./configure --prefix=$STATICLIBPCRE --enable-shared=no --enable-utf8 --enable-jit
   make
   make install
   cd $DIR
   
   
   export ZLIB=/tmp/staticzlib
   wget http://zlib.net/zlib-1.2.8.tar.gz
   tar xvzf zlib-1.2.8.tar.gz
   cd zlib-1.2.8
   ./configure --prefix=$ZLIB --static
   make
   make install
   cd $DIR
   
   wget http://www.haproxy.org/download/1.5/src/haproxy-1.5.14.tar.gz
   tar xvzf haproxy-1.5.14.tar.gz
   cd haproxy-1.5.14
   
   make TARGET=linux26 CPU=native ARCH=i686 USE_PCRE_JIT=1 USE_STATIC_PCRE=1 USE_OPENSSL=1 \
   PCRE_LIB=$STATICLIBPCRE/lib PCRE_INC=$STATICLIBPCRE/include \
   SSL_INC=$STATICLIBSSL/include SSL_LIB=$STATICLIBSSL/lib ADDLIB="-ldl -lrt" \
   USE_ZLIB=1 ZLIB_INC=$ZLIB/include/ ZLIB_LIB=$ZLIB/lib USE_LIBCRYPT=1
   
   strip haproxy
   

2. To check everything is fine

   root@olivia:~/tmp_haproxy_build# ./haproxy-1.5.14/haproxy -vv
   HA-Proxy version 1.5.14 2015/07/02
   Copyright 2000-2015 Willy Tarreau 
   
   Build options :
     TARGET  = linux26
     CPU     = native
     CC      = gcc
     CFLAGS  = -m32 -march=i686 -O2 -march=native -g -fno-strict-aliasing
     OPTIONS = USE_LIBCRYPT=1 USE_ZLIB=1 USE_OPENSSL=1 USE_STATIC_PCRE=1 USE_PCRE_JIT=1
   
   Default settings :
     maxconn = 2000, bufsize = 16384, maxrewrite = 8192, maxpollevents = 200
   
   Encrypted password support via crypt(3): yes
   Built with zlib version : 1.2.8
   Compression algorithms supported : identity, deflate, gzip
   Built with OpenSSL version : LibreSSL 2.2.3
   Running on OpenSSL version : LibreSSL 2.2.3
   OpenSSL library supports TLS extensions : yes
   OpenSSL library supports SNI : yes
   OpenSSL library supports prefer-server-ciphers : yes
   Built with PCRE version : 8.37 2015-04-28
   PCRE library supports JIT : yes
   
   Available polling systems :
         epoll : pref=300,  test result OK
          poll : pref=200,  test result OK
        select : pref=150,  test result OK
   Total: 3 (3 usable), will use epoll.
   

This is based on the work done by Lang Pavel. His work is available at https://github.com/langpavel/haproxy-doc. His PDF document for 1.5 was a little bit outdated. I took decision to regenate this document for HAProxy 1.5.14.

Document is available at http://www.davidgis.fr/documentation/HAProxy/1.5.14/HAProxy-1.5.14_configuration.pdf

http://www.tux-planet.fr/activer-le-mode-read-only-sur-un-serveur-mysql/

...
frontend public
        bind :80             # or any other IP:port combination we listen to.
        acl bad_guys_ip src -f /opt/lighttpd/1.4.37/conf/haproxy/block_ip.txt
        block if bad_guys_ip
        acl badbots hdr_reg(User-Agent) -i -f /opt/lighttpd/1.4.37/conf/haproxy/badbots.lst
        block if badbots

        # Some tests from my own PC on LAN   to check if I can disallow connection from LAN for my own PC
        # I am using Firefox 40 with this user-aggent "Mozilla/5.0 (X11; Linux i686; rv:40.0) Gecko/20100101 Firefox/40.0"
        # Just uncomment the two lines below and reload haproxy
        #acl badusers01 hdr_reg(User-Agent) -m str Mozilla/5\.0\ \(X11.*\ Linux\ i686.*\ rv\:40.0\)\ Gecko/20100101\ Firefox/40\.0
        #block if badusers01

        # Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.7.6)
        acl badusers02 hdr_reg(User-Agent) -m str Mozilla/5.0\ \(Windows.*U.*\ Windows\ NT\ 5\.1.*\ zh-CN.*rv\:1\.7\.6
        block if badusers02
        default_backend  lighttpd
....

To reload haproxy without restarting (my haproxy version is statically built using magicermine. I bought my licence in 2013 from magicermine.com 3 years ago)

 /opt/lighttpd/1.4.37/bin/haproxy-1.4.24.ermine -f /opt/lighttpd/1.4.37/conf/haproxy/haproxy.cfg -sf $(pidof haproxy-1.4.24.ermine)