sigsci-module-haproxy

Development Environment and Procedures

See DEVELOPMENT.md

Release Package Procedures

See RELEASE.md

Troubleshooting Tips and FAQs

See TROUBLESHOOTING.md

Links

haproxy 1.8 lua doco
luasocket
Official Docker Images probably use tags 1.6-alpine or 1.7-alpine or 1.8-alpine. They are all based on alpine.
RedHat and OpenShift Docker Images Not clear if they work or if you need a key.
Debian/Ubuntu. They have special site just for configuring HA-Proxy.
Example Configurations for 1.8 Part of the config doco.
Some OpenStack Auth example
Example measuring backend latency using secret headers
Mailing List -- development and patches appears to be done on this list.
Question on socket timeouts

Requirements

Minimum version seems to be 1.7.2 Note the current version is 1.8.3

It does not work on HAProxy 1.6.X. Unclear if it can be made to work.

It does not work on HAProxy 1.5. It will never work on 1.5

The OS should not matter.

Out of the box:

CentOS/RedHat 7 uses HAProxy 1.5 and does not work. Unclear how to upgrade.
Ubuntu 16.04, 16.10 does not work, since it uses haproxy 1.6. However there is backport-1.7 and backport-1.8
Ubuntu 17.04 should work (but it's one of the weird Ubuntu releases).
Debian 9 should work
Alpine 3.6 should work

Installation and Configuration

The lua module is available on our usual repositories and at dl.signalsciences.net.

The haproxy config file needs to be modified in a few places:

add to `global`

global
   ... existing ...
   lua-load /usr/local/lib/lua/5.3/sigsci/SignalSciences.lua

add to `frontend`

frontend http-in
    ... existing...
    http-request lua.sigsci_prerequest
    http-response lua.sigsci_postrequest

    # for haproxy-1.9 and above, add the following line
    http-request use-service lua.sigsci_send_block if { var(txn.sigsci_block) -m bool }

TODO: May need to add http-buffer-request if http POSTs data is not completely being send to the agent.

Configuration

Add a lua-load after the loading the SignalSciences.lua file

global
   ... existing ...
   lua-load /usr/local/lib/lua/5.3/sigsci/SignalSciences.lua
   lua-load /your/file/override.lua

where override.lua can contain any or none of the following lines (if you just wish to change the sigsci_agenthost you can just have one line).

-- location of signal sciences agent.
-- can be
-- * "unix@/path or /path for unix domain sockets"
-- * or 8.8.8.8:8080 for TCP/IP
--
sigsci.sigsci_agenthost = "/var/run/sigsci.sock"

-- if true, log internal errors
sigsci.sigsci_log_internal_errors = true

-- if true, log verbosely
sigsci.sigsci_log_debug = false

-- if true, log socket connection errors.
-- may wish to turn off to prevent DoS problems.
sigsci.sigsci_log_network_errors = true

-- user supplied response header will be added to 406 responses if set
-- default is no extra header
sigsci.extra_blocking_resp_hdr="Access-Control-Allow-Origin: https://my-company.com"

-- More advanced example for setting multiple extra headers, note the \r\n between headers
sigsci.extra_blocking_resp_hdr="Access-Control-Allow-Origin: https://my-company.com\r\nVary: Origin"

Notes

It appears if HAProxy can't connect to the backend servers, the postrequest is not called.

The total bytes sent back to the client (response size) is only estimated from Content-Length http header. There is no way in HAProxy to get the actual response given the existing APIs.

The timeout to the agent can only specified in whole seconds. You cannot specify millisecond timeouts.