{"id":6061,"date":"2020-06-06T00:26:41","date_gmt":"2020-06-05T21:26:41","guid":{"rendered":"https:\/\/kifarunix.com\/?p=6061"},"modified":"2024-03-14T21:55:45","modified_gmt":"2024-03-14T18:55:45","slug":"install-and-setup-haproxy-on-ubuntu-20-04","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/install-and-setup-haproxy-on-ubuntu-20-04\/","title":{"rendered":"Install and Setup HAProxy on Ubuntu 20.04"},"content":{"rendered":"\n
Welcome to our guide on how to install and setup HAProxy on Ubuntu 20.04. HAProxy<\/a> (H<\/strong>igh A<\/strong>vailability Proxy), as you might already be aware, is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world’s most visited ones. <\/p>\n\n\n\n It features connection persistence through HTTP cookies, load balancing, header addition, modification, deletion both ways. It has request blocking capabilities and provides interface to display server status.<\/p>\n\n\n\n HAProxy is available on the default Ubuntu 20.04 repos. However, the available package might not be up-to-date.<\/p>\n\n\n\n As you can see, the HAProxy package available on the default repos is version 2.0.13 while the current stable release is version 2.1.5.<\/p>\n\n\n\n There are however, PPA repos that provides the latest stable release versions of HAProxy maintained by Vincent Bernat<\/a>. These PPA repos can be installed as follows;<\/p>\n\n\n\n Once the PPA repos are added to system, update your system package cache;<\/p>\n\n\n\n You can now be able to install the latest stable version of HAProxy;<\/p>\n\n\n\n Note the versions provided by individual repos.<\/p>\n\n\n\n You can now install HAProxy;<\/p>\n\n\n\n To check the version of installed HAProxy, run the command below;<\/p>\n\n\n\n With HAProxy, you can define multiple proxy services and configure HAProxy to load balance the traffic for the defined proxies. Proxies are made up of frontend system and one or more back-end systems. The front-end system defines the IP address and port on which the proxy listens as well as the back-end systems to use for a particular proxy.<\/p>\n\n\n\n The main configuration file for HAProxy is The HAProxy configuration file is made up of four sections;<\/p>\n\n\n\n The Read more about these sections on Essential Sections of an HAProxy Configuration<\/a>.<\/p>\n\n\n\n The default HAProxy file configuration looks like as shown below;<\/p>\n\n\n\n In our configuration file, we will modify the above to include the Before you can proceed, make a backup of the default config file;<\/p>\n\n\n\n As stated above, the NOTE: <\/p>\n\n\n\n In this demo, our proxied backends uses SSL\/TLS certificates. As such, instead of configuring each backend application to terminate its SSL\/TLS connection ( If you are not using SSL\/TLS termination, remove the SSL part of the bind line, In this section, we will, in the basic form, define the HAProxy Scheduling Algorithms and the backend servers whose requests are being proxied\/load balanced.<\/p>\n\n\n\n According to HAProxy Stats page<\/a>, HAProxy ships with a dashboard called the HAProxy Stats page<\/strong> that shows an abundance of metrics covering the health of the servers, current request rates, response times, and more. These metrics gives granular data on a per-frontend, backend, and server basis. This can be enabled using the Note that the line, Save and exit the file once done with configuration.<\/p>\n\n\n\n In general, this is how our configuration is like<\/a>. NOTE<\/strong> that we added the line, Once done with configuration, run the command below to verify the HAProxy config syntax validation before you can start it;<\/p>\n\n\n\n If all is well, you should get the output;<\/p>\n\n\n\n Otherwise, you will get errors on stdout. Be sure to fix before you can proceed.<\/p>\n\n\n\n When installed, HAProxy is started and enabled to run on system boot by default. You can restart it by running the command below<\/p>\n\n\n\n To check the status;<\/p>\n\n\n\n If UFW is running, Open port 443 as well as the statistics port;<\/p>\n\n\n\n You can now access your HAProxy from browser to confirm your LB setup. Use the address, The first page shows content from the first defined backend, in this demo, app01. Remember the LB algorithm used here, If you reload the url, the content from the second app shows;<\/p>\n\n\n\n You can also check the statistics of your HAProxy, And there you got your statistics.<\/p>\n\n\n\n That brings us to the end of our tutorial on how to installing HAProxy on Ubuntu 20.04.<\/p>\n\n\n\n HAProxy Configuration Manual<\/a><\/p>\n\n\n\n Install and Setup HAProxy on CentOS 8<\/a><\/p>\n\n\n\n Setup HAProxy Load Balancer on Fedora 30\/Fedora 29<\/a><\/p>\n\n\n\nInstalling HAProxy on Ubuntu 20.04<\/h2>\n\n\n\n
apt show haproxy<\/code><\/pre>\n\n\n\n
Package: haproxy\nVersion: 2.0.13-2\nPriority: optional\nSection: net\nOrigin: Ubuntu\nMaintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>\nOriginal-Maintainer: Debian HAProxy Maintainers <haproxy@tracker.debian.org>\nBugs: https:\/\/bugs.launchpad.net\/ubuntu\/+filebug\nInstalled-Size: 3,287 kB\nPre-Depends: dpkg (>= 1.17.14)\nDepends: libc6 (>= 2.17), libcrypt1 (>= 1:4.1.0), libgcc-s1 (>= 3.0), liblua5.3-0, libpcre2-8-0 (>= 10.22), libssl1.1 (>= 1.1.1), libsystemd0, zlib1g (>= 1:1.1.4), adduser, lsb-base (>= 3.0-6)\nSuggests: vim-haproxy, haproxy-doc\nHomepage: http:\/\/www.haproxy.org\/\nDownload-Size: 1,519 kB\nAPT-Sources: http:\/\/ke.archive.ubuntu.com\/ubuntu focal\/main amd64 Packages<\/code><\/pre>\n\n\n\n
Create HAProxy PPA Repository for Ubuntu<\/a><\/h3>\n\n\n\n
install software-properties-common<\/code><\/pre>\n\n\n\n
add-apt-repository ppa:vbernat\/haproxy-2.1 --yes<\/code><\/pre>\n\n\n\n
Run system update<\/h3>\n\n\n\n
apt update<\/code><\/pre>\n\n\n\n
Install HAProxy on Ubuntu 20.04<\/a><\/h3>\n\n\n\n
apt-cache policy haproxy<\/code><\/pre>\n\n\n\n
haproxy:\n Installed: (none)\n Candidate: 2.1.5-1ppa1~focal\n Version table:\n 2.1.5-1ppa1~focal 500<\/strong>\n 500 http:\/\/ppa.launchpad.net\/vbernat\/haproxy-2.1\/ubuntu focal\/main amd64 Packages\n 2.0.13-2 500\n<\/strong> 500 http:\/\/ke.archive.ubuntu.com\/ubuntu focal\/main amd64 Packages<\/code><\/pre>\n\n\n\n
apt install haproxy<\/code><\/pre>\n\n\n\n
haproxy -v<\/code><\/pre>\n\n\n\n
HA-Proxy version 2.1.5-1ppa1~focal 2020\/06\/01 - https:\/\/haproxy.org\/\nStatus: stable branch - will stop receiving fixes around Q1 2021.\nKnown bugs: http:\/\/www.haproxy.org\/bugs\/bugs-2.1.5.html\nRunning on: Linux 5.4.0-33-generic #37-Ubuntu SMP Thu May 21 12:53:59 UTC 2020 x86_64<\/code><\/pre>\n\n\n\n
Configure HAProxy Load Balancer on Ubuntu 20.04<\/a><\/h3>\n\n\n\n
\/etc\/haproxy\/haproxy.cfg<\/code><\/strong>.<\/p>\n\n\n\n
\n
global<\/code>: The global section defines process-wide security and performance tunings that affect HAProxy at a low level.<\/li>\n\n\n\n
defaults<\/code>: The global section defines the configuration settings that are applied to all of the
frontend<\/code> and
backend<\/code> sections. You can define multiple default sections but the sub-sequent defaults sections override that came before it.<\/li>\n\n\n\n
frontend<\/code>: When HAProxy is placed as a reverse proxy, the
frontend<\/code> section defines the IP addresses and ports that clients can connect to.<\/li>\n\n\n\n
backend<\/code>: The backend section defines the group of servers that will be load balanced and assigned to handle requests.<\/li>\n<\/ul>\n\n\n\n
frontend<\/code> and
backend<\/code> sections can be combined using the
listen<\/code> section. It can also be used to server HAProxy statistics page<\/a>.<\/p>\n\n\n\n
grep -v '^\\s*#' \/etc\/haproxy\/haproxy.cfg<\/code><\/pre>\n\n\n\n
global\n\tlog \/dev\/log\tlocal0\n\tlog \/dev\/log\tlocal1 notice\n\tchroot \/var\/lib\/haproxy\n\tstats socket \/run\/haproxy\/admin.sock mode 660 level admin expose-fd listeners\n\tstats timeout 30s\n\tuser haproxy\n\tgroup haproxy\n\tdaemon\n\n\tca-base \/etc\/ssl\/certs\n\tcrt-base \/etc\/ssl\/private\n\n ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384\n ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256\n ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets\n\ndefaults\n\tlog\tglobal\n\tmode\thttp\n\toption\thttplog\n\toption\tdontlognull\n timeout connect 5000\n timeout client 50000\n timeout server 50000\n\terrorfile 400 \/etc\/haproxy\/errors\/400.http\n\terrorfile 403 \/etc\/haproxy\/errors\/403.http\n\terrorfile 408 \/etc\/haproxy\/errors\/408.http\n\terrorfile 500 \/etc\/haproxy\/errors\/500.http\n\terrorfile 502 \/etc\/haproxy\/errors\/502.http\n\terrorfile 503 \/etc\/haproxy\/errors\/503.http\n\terrorfile 504 \/etc\/haproxy\/errors\/504.http<\/code><\/pre>\n\n\n\n
frontend<\/strong><\/code> and
backend<\/strong><\/code> sections.<\/p>\n\n\n\n
cp \/etc\/haproxy\/haproxy.cfg{,.factory}<\/code><\/pre>\n\n\n\n
Define HAProxy Frontend Configuration Settings<\/a><\/h3>\n\n\n\n
frontend<\/code> section defines the IP addresses and ports that clients can connect to (The IP address and ports on the HAProxy server itself). Therefore, this is how our frontend configuration is like;<\/p>\n\n\n\n
frontend\n bind 192.168.57.8:443 ssl crt \/etc\/ssl\/certs\/haproxy.pem\n default_backend webapps\n option forwardfor<\/code><\/pre>\n\n\n\n
\n
bind<\/code><\/strong>: Define one or more listening addresses and\/or ports in a frontend server.<\/li>\n\n\n\n
ssl<\/strong> crt<\/strong><\/code>: Configures HAProxy SSL Termination and specifies the path to SSL\/TLS certificate.<\/li>\n\n\n\n
default_backend<\/strong><\/code>: Specifies the backend to use when no “use_backend” rule has been matched.<\/li>\n\n\n\n
option forwardfor<\/strong><\/code>: HAProxy operates in reverse-proxy mode. This option enable the backend servers to see the IP addresses of the clients instead of the IP address for HAProxy server.<\/li>\n<\/ul>\n\n\n\n
SSL Pass through<\/code>), we will configure HAProxy as an SSL\/TLS certificate termination point (
SSL Termination<\/code>).<\/p>\n\n\n\n
ssl crt \/etc\/ssl\/certs\/haproxy.pem<\/strong><\/code>.<\/p>\n\n\n\n
Define HAProxy Backend Configuration Settings<\/a><\/h3>\n\n\n\n
backend webapps\n balance roundrobin\n server app01 192.168.59.6:80 check\n server app02 192.168.60.4:80 check<\/code><\/pre>\n\n\n\n
\n
\n
\n
Define HAProxy Statistics Configuration Settings<\/a><\/h3>\n\n\n\n
stats enable<\/code> directive, which can be added to either frontend or listen section. We used a listen section in this tutorial.<\/p>\n\n\n\n
listen stats\n bind 192.168.57.8:8443 ssl crt \/etc\/ssl\/certs\/haproxy.pem\n stats enable # enable statistics reports \n stats hide-version # Hide the version of HAProxy\n stats refresh 30s # HAProxy refresh time\n stats show-node # Shows the hostname of the node\n stats auth haadmin:P@ssword # Enforce Basic authentication for Stats page\n stats uri \/stats # Statistics URL<\/code><\/pre>\n\n\n\n
bind 192.168.57.8:8443 ssl crt \/etc\/ssl\/certs\/haproxy.pem<\/code>, defines the frontend IP and port to access the HAProxy stats as well as the SSL\/TLS cert to use.<\/p>\n\n\n\n
tune.ssl.default-dh-param 2048<\/code>, to SSL\/TLS configuration options section.<\/p>\n\n\n\n
global\n\tlog \/dev\/log\tlocal0\n\tlog \/dev\/log\tlocal1 notice\n\tchroot \/var\/lib\/haproxy\n\tstats socket \/run\/haproxy\/admin.sock mode 660 level admin expose-fd listeners\n\tstats timeout 30s\n\tuser haproxy\n\tgroup haproxy\n\tdaemon\n\n\tca-base \/etc\/ssl\/certs\n\tcrt-base \/etc\/ssl\/private\n\n ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384\n ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256\n ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets\n
tune.ssl.default-dh-param 2048<\/strong><\/code>\n\ndefaults\n\tlog\tglobal\n\tmode\thttp\n\toption\thttplog\n\toption\tdontlognull\n timeout connect 5000\n timeout client 50000\n timeout server 50000\n\terrorfile 400 \/etc\/haproxy\/errors\/400.http\n\terrorfile 403 \/etc\/haproxy\/errors\/403.http\n\terrorfile 408 \/etc\/haproxy\/errors\/408.http\n\terrorfile 500 \/etc\/haproxy\/errors\/500.http\n\terrorfile 502 \/etc\/haproxy\/errors\/502.http\n\terrorfile 503 \/etc\/haproxy\/errors\/503.http\n\terrorfile 504 \/etc\/haproxy\/errors\/504.http\nfrontend kifarunixlb\n bind 192.168.57.8:443 ssl crt \/etc\/ssl\/certs\/haproxy.pem\n default_backend webapps\n option forwardfor\nbackend webapps\n balance roundrobin\n server app01 192.168.59.6:80 check\n server app02 192.168.60.4:80 check\nlisten stats\n bind 192.168.57.8:8443 ssl crt \/etc\/ssl\/certs\/haproxy.pem\n stats enable # enable statistics reports \n stats hide-version # Hide the version of HAProxy\n stats refresh 30s # HAProxy refresh time\n stats show-node # Shows the hostname of the node\n stats auth haadmin:P@ssword # Enforce Basic authentication for Stats page\n stats uri \/stats # Statistics URL<\/strong><\/code><\/pre>\n\n\n\n
Validate HAProxy Configuration Syntax<\/a><\/h3>\n\n\n\n
haproxy -f \/etc\/haproxy\/haproxy.cfg -c -V<\/code><\/pre>\n\n\n\n
Configuration file is valid<\/code><\/pre>\n\n\n\n
Running HAProxy<\/h4>\n\n\n\n
systemctl restart haproxy<\/code><\/pre>\n\n\n\n
systemctl status haproxy<\/code><\/pre>\n\n\n\n
\u25cf haproxy.service - HAProxy Load Balancer\n Loaded: loaded (\/lib\/systemd\/system\/haproxy.service; enabled; vendor preset: enabled)\n Active: active (running) since Fri 2020-06-05 20:45:33 UTC; 7s ago\n Docs: man:haproxy(1)\n file:\/usr\/share\/doc\/haproxy\/configuration.txt.gz\n Process: 21423 ExecStartPre=\/usr\/sbin\/haproxy -f $CONFIG -c -q $EXTRAOPTS (code=exited, status=0\/SUCCESS)\n Main PID: 21425 (haproxy)\n Tasks: 3 (limit: 2282)\n Memory: 39.5M\n CGroup: \/system.slice\/haproxy.service\n \u251c\u250021425 \/usr\/sbin\/haproxy -Ws -f \/etc\/haproxy\/haproxy.cfg -p \/run\/haproxy.pid -S \/run\/haproxy-master.sock\n \u2514\u250021440 \/usr\/sbin\/haproxy -Ws -f \/etc\/haproxy\/haproxy.cfg -p \/run\/haproxy.pid -S \/run\/haproxy-master.sock\n\nJun 05 20:45:33 haproxy.kifarunix-demo.com systemd[1]: Starting HAProxy Load Balancer...\nJun 05 20:45:33 haproxy.kifarunix-demo.com haproxy[21425]: Proxy kifarunixlb started.\nJun 05 20:45:33 haproxy.kifarunix-demo.com haproxy[21425]: Proxy kifarunixlb started.\nJun 05 20:45:33 haproxy.kifarunix-demo.com haproxy[21425]: Proxy webapps started.\nJun 05 20:45:33 haproxy.kifarunix-demo.com haproxy[21425]: Proxy webapps started.\nJun 05 20:45:33 haproxy.kifarunix-demo.com haproxy[21425]: Proxy stats started.\nJun 05 20:45:33 haproxy.kifarunix-demo.com haproxy[21425]: Proxy stats started.\nJun 05 20:45:33 haproxy.kifarunix-demo.com haproxy[21425]: [NOTICE] 156\/204533 (21425) : New worker #1 (21440) forked\nJun 05 20:45:33 haproxy.kifarunix-demo.com systemd[1]: Started HAProxy Load Balancer.<\/code><\/pre>\n\n\n\n
ufw allow 443\/tcp<\/code><\/pre>\n\n\n\n
ufw allow 8443\/tcp<\/code><\/pre>\n\n\n\n
Verify HAProxy Load Balancing Setup on Ubuntu 20.04<\/a><\/h3>\n\n\n\n
https[s]:\/\/lb-server-IP-or-hostname<\/strong><\/code>.<\/p>\n\n\n\n
roundrobin<\/strong><\/code>.<\/p>\n\n\n\n
<\/figure>\n\n\n\n
<\/figure>\n\n\n\n
http[s]:\/\/lb-server-IP-or-hostname[:port]\/stats<\/strong><\/code>. If you enabled basic authentication, you are prompted to authenticate.<\/p>\n\n\n\n
<\/figure>\n\n\n\n
<\/figure>\n\n\n\n
Further Reading<\/h3>\n\n\n\n
Related Tutorials<\/h3>\n\n\n\n