Skip to content

SigSci Haproxy SPOE module

Introduction

SPOE is a feature introduced in Haproxy 1.7. SPOE feature can be used to communicate with SigSci agent and block the requests using ACLs based on the SigSci agent response.

Requirements

Haproxy 1.8 or higher

Module installation

Install the module using package manager

SigSci Agent configuration

Add haproxy-spoe-enable=true to /etc/sigsci/agent.conf to enable Haproxy SPOE support in SigSci agent.

SigSci agent socket file /var/run/sigsci-ha.sock is inaccessible to Haproxy configured with chroot path. SigSci agent's spoe-address should be set to path/var/run/sigsci-ha.sock to make it accessible to Haproxy.

  sudo mkdir -p path/var/run/

Then, add the following line to /etc/sigsci/agent.conf to specify the new socket file location under chroot path.

  haproxy-spoa-address=unix:path/var/run/sigsci-ha.sock

Haproxy configuration

Add SPOA backend

Append the content of /opt/signalsciences/haproxy-spoe/backend.txt to Haproxy configuration.

sed "-i.`date +%F`" -e '$/opt/signalsciences/haproxy-spoe/backend.txt' /etc/haproxy/haproxy.cfg

Update frontend section

  • Haproxy v2.2 and above

    Copy the content of /opt/signalsciences/haproxy-spoe/frontend-2.2.txt to each HTTP frontend section of Haproxy configuration

    sed -i -e '/frontend/r/opt/signalsciences/haproxy-spoe/frontend-2.2.txt' /etc/haproxy/haproxy.cfg

  • Haproxy v1.8 and v2.0

    Copy the content of /opt/signalsciences/haproxy-spoe/frontend-1.8.txt to each HTTP frontend section of Haproxy configuration

    sed -i -e '/frontend/r/opt/signalsciences/haproxy-spoe/frontend-1.8.txt' /etc/haproxy/haproxy.cfg

References

SPOE

Haproxy ACLs