haproxy module

Tim Koop commented

2026-07-10 21:50:31 +02:00

Owner

This is a very WIP state.
I've configured options according to the documentation. Most of the names and optionalities are matched, but some have been tweaked according to our needs and best practices.
Example configuration to test all options:

elbforge.haproxy = {
  enabled = true;
  config = {
    global = {
      maxconn = 1000;
      h2WorkaroundBogusWebsocketClients = true;
    };
    defaults = {
      maxconn = 10;
      h2WorkaroundBogusWebsocketClients = true;
      log = "global";
    };
    frontend = {
      frontend_http = {
        bind = [
          { ip = "::"; port = 80; addressFamily = "v4v6"; networkNamespace = "public"; }
          { ip = "::"; port = 443; addressFamily = "v4v6"; networkNamespace = "public"; sslCertificates = certs; alpnProtocols = "h2,http/1.1"; }
          { protocolPrefix = "quic4"; port = 443; networkNamespace = "public"; sslCertificates = certs; alpnProtocols = "h3"; }
          { ip = "::"; protocolPrefix = "quic6"; port = 443; networkNamespace = "public"; sslCertificates = certs; alpnProtocols = "h3"; }
        ];
        mode = "http";
        httpRequest = "redirect scheme https unless { ssl_fc }";
        httpResponse = [ "set-header alt-svc \"h3=\\\":443\\\"; ma=86400\"" ];
        acl = {
          is_auth_elbforge_test_ws = {
            criterion = "path_beg";
            value = "/ws/";
          };
          is_auth_elbforge_test = {
            criterion = "hdr(host)";
            flags = "-i";
            value = "auth.elbforge.test";
          };
          is_elbforge_test = {
            criterion = "hdr(host)";
            flags = "-i";
            value = "elbforge.test";
          };
          is_www = {
            criterion = "hdr(host)";
            flags = "-i";
            value = "www.elbforge.test";
          };
        };
        redirect = [
          { type = "prefix"; value = "https://elbforge.test"; code = 301; operator = "if"; condition = "is_www"; }
        ];
        useBackend = [
          { backend = "backend_elf_idp01_ws"; operator = "if"; condition = [ "is_auth_elbforge_test" "is_auth_elbforge_test_ws" ]; }
          { backend = "backend_elf-idp01"; operator = "if"; condition = [ "is_auth_elbforge_test" ]; }
          { backend = "backend_elf-forge01"; operator = "if"; condition = [ "is_elbforge_test" ]; }
        ];
        errorfiles = "elf-httperrors";
      };
      frontend_tcp_elf-forge01_22_8022 = {
        mode = "tcp";
      };
    };
    backend = {
      backend_elf-idp01 = {
        mode = "http";
        server = {
          elf-idp01 = {
            address = "fd00::61b7:41c6:6fe7:0a7f";
            port = 8080;
            check = {
              interval = "10s";
              rise = 2;
              fall = 3;
              initState = "up";
            };
            sendProxy = true;
          }; 
        };
        check = {
          checkMode = "http";
          checkHttpPath = "/-/health/ready/";
          checkMatch = "status";
          checkPattern = "200";
        };
        httpResponse = [
          "return status 502 content-type \"text/html\" file /nix/store/xyz-502.html if { status 502 }"
          "return status 504 content-type \"text/html\" file /nix/store/abc-504.html if { status 504 }"
        ];
      };
      backend_elf_ssh = {
        mode = "tcp";
        timeoutCheck = "10s";
        timeoutClient = "60s";
        timeoutServer = "60s";
        server = {
          elf-forge01_ssh = {
            address = "fd00::1161:9fc6:18d5:3dd7";
            port = 8022;
            check = {
              interval = "10s";
              rise = 2;
              fall = 3;
              initState = "up";
            };
            sendProxy = true;
          };
        };
        check = {
          checkMode = "tcp";
          checkMatch = "rstring";
          checkPattern = "SSH-2\\.0-Go";
        };
      };
    };
    httpErrors = {
      "elf-httperrors" = [
        { code = 503; file = "abc"; }
        { code = 504; file = "def"; }
      ];
      "elf-httperrors2" = [
        { code = 503; file = "ttt"; }
        { code = 504; file = "zzz"; }
      ];
    };
  };
};

This is a very WIP state. I've configured options according to the [documentation](https://www.haproxy.com/documentation/haproxy-configuration-manual/latest/). Most of the names and optionalities are matched, but some have been tweaked according to our needs and best practices. Example configuration to test all options: ```nix elbforge.haproxy = { enabled = true; config = { global = { maxconn = 1000; h2WorkaroundBogusWebsocketClients = true; }; defaults = { maxconn = 10; h2WorkaroundBogusWebsocketClients = true; log = "global"; }; frontend = { frontend_http = { bind = [ { ip = "::"; port = 80; addressFamily = "v4v6"; networkNamespace = "public"; } { ip = "::"; port = 443; addressFamily = "v4v6"; networkNamespace = "public"; sslCertificates = certs; alpnProtocols = "h2,http/1.1"; } { protocolPrefix = "quic4"; port = 443; networkNamespace = "public"; sslCertificates = certs; alpnProtocols = "h3"; } { ip = "::"; protocolPrefix = "quic6"; port = 443; networkNamespace = "public"; sslCertificates = certs; alpnProtocols = "h3"; } ]; mode = "http"; httpRequest = "redirect scheme https unless { ssl_fc }"; httpResponse = [ "set-header alt-svc \"h3=\\\":443\\\"; ma=86400\"" ]; acl = { is_auth_elbforge_test_ws = { criterion = "path_beg"; value = "/ws/"; }; is_auth_elbforge_test = { criterion = "hdr(host)"; flags = "-i"; value = "auth.elbforge.test"; }; is_elbforge_test = { criterion = "hdr(host)"; flags = "-i"; value = "elbforge.test"; }; is_www = { criterion = "hdr(host)"; flags = "-i"; value = "www.elbforge.test"; }; }; redirect = [ { type = "prefix"; value = "https://elbforge.test"; code = 301; operator = "if"; condition = "is_www"; } ]; useBackend = [ { backend = "backend_elf_idp01_ws"; operator = "if"; condition = [ "is_auth_elbforge_test" "is_auth_elbforge_test_ws" ]; } { backend = "backend_elf-idp01"; operator = "if"; condition = [ "is_auth_elbforge_test" ]; } { backend = "backend_elf-forge01"; operator = "if"; condition = [ "is_elbforge_test" ]; } ]; errorfiles = "elf-httperrors"; }; frontend_tcp_elf-forge01_22_8022 = { mode = "tcp"; }; }; backend = { backend_elf-idp01 = { mode = "http"; server = { elf-idp01 = { address = "fd00::61b7:41c6:6fe7:0a7f"; port = 8080; check = { interval = "10s"; rise = 2; fall = 3; initState = "up"; }; sendProxy = true; }; }; check = { checkMode = "http"; checkHttpPath = "/-/health/ready/"; checkMatch = "status"; checkPattern = "200"; }; httpResponse = [ "return status 502 content-type \"text/html\" file /nix/store/xyz-502.html if { status 502 }" "return status 504 content-type \"text/html\" file /nix/store/abc-504.html if { status 504 }" ]; }; backend_elf_ssh = { mode = "tcp"; timeoutCheck = "10s"; timeoutClient = "60s"; timeoutServer = "60s"; server = { elf-forge01_ssh = { address = "fd00::1161:9fc6:18d5:3dd7"; port = 8022; check = { interval = "10s"; rise = 2; fall = 3; initState = "up"; }; sendProxy = true; }; }; check = { checkMode = "tcp"; checkMatch = "rstring"; checkPattern = "SSH-2\\.0-Go"; }; }; }; httpErrors = { "elf-httperrors" = [ { code = 503; file = "abc"; } { code = 504; file = "def"; } ]; "elf-httperrors2" = [ { code = 503; file = "ttt"; } { code = 504; file = "zzz"; } ]; }; }; }; ```

Tim Koop added 3 commits

2026-07-10 21:50:31 +02:00

haproxy: add module 9576343a6e

haproxy: acl has to be defined before useBackend 82f6287840

elbforge-rpx: migrate to haproxy module 838286d091

Tim Koop requested review from Marcel

2026-07-10 21:51:07 +02:00

This pull request has changes conflicting with the target branch.

modules/elbforge/default.nix

View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Merge commit title

Merge pull request 'haproxy module' (#10) from haproxy into main

Merge commit body

Reviewed-on: https://elbforge.org/elbforge/elf-infra/pulls/10

Merge pull request 'haproxy module' (#10) from haproxy into main

Reviewed-on: https://elbforge.org/elbforge/elf-infra/pulls/10

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin haproxy:haproxy

git switch haproxy

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff haproxy

git switch haproxy

git rebase main

git switch main

git merge --ff-only haproxy

git switch haproxy

git rebase main

git switch main

git merge --no-ff haproxy

git switch main

git merge --squash haproxy

git switch main

git merge --ff-only haproxy

git switch main

git merge haproxy

git push origin main

Rows
Columns

haproxy module #10

Manual merge helper

Checkout

Merge