Assigns a default directory to fetch SSL CA certificates and CRLs from when a
relative path is used with "ca-file" or "crl-file" directives. Absolute
locations specified in "ca-file" and "crl-file" prevail and ignore "ca-base".
chroot
Changes current directory to and performs a chroot() there before
dropping privileges. This increases the security level in case an unknown
vulnerability would be exploited, since it would make it very hard for the
attacker to exploit the system. This only works when the process is started
with superuser privileges. It is important to ensure that is both
empty and unwritable to anyone.
cpu-map <"all"|"odd"|"even"|process_num> ...
On Linux 2.6 and above, it is possible to bind a process to a specific CPU
set. This means that the process will never run on other CPUs. The "cpu-map"
directive specifies CPU sets for process sets. The first argument is the
process number to bind. This process must have a number between 1 and 32 or
64, depending on the machine's word size, and any process IDs above nbproc
are ignored. It is possible to specify all processes at once using "all",
only odd numbers using "odd" or even numbers using "even", just like with the
"bind-process" directive. The second and forthcoming arguments are CPU sets.
Each CPU set is either a unique number between 0 and 31 or 63 or a range with
two such numbers delimited by a dash ('-'). Multiple CPU numbers or ranges
may be specified, and the processes will be allowed to bind to all of them.
Obviously, multiple "cpu-map" directives may be specified. Each "cpu-map"
directive will replace the previous ones when they overlap.
crt-base
Assigns a default directory to fetch SSL certificates from when a relative
path is used with "crtfile" directives. Absolute locations specified after
"crtfile" prevail and ignore "crt-base".
daemon
Makes the process fork into background. This is the recommended mode of
operation. It is equivalent to the command line "-D" argument. It can be
disabled by the command line "-db" argument.
deviceatlas-json-file
Sets the path of the DeviceAtlas JSON data file to be loaded by the API.
The path must be a valid JSON data file and accessible by Haproxy process.
deviceatlas-log-level
Sets the level of informations returned by the API. This directive is
optional and set to 0 by default if not set.
deviceatlas-separator
Sets the character separator for the API properties results. This directive
is optional and set to | by default if not set.
deviceatlas-properties-cookie
Sets the client cookie's name used for the detection if the DeviceAtlas
Client-side component was used during the request. This directive is optional
and set to DAPROPS by default if not set.
external-check
Allows the use of an external agent to perform health checks.
This is disabled by default as a security precaution.
See "option external-check".
gid
Changes the process' group ID to . It is recommended that the group
ID is dedicated to HAProxy or to a small set of similar daemons. HAProxy must
be started with a user belonging to this group, or with superuser privileges.
Note that if haproxy is started from a user having supplementary groups, it
will only be able to drop these groups if started with superuser privileges.
See also "group" and "uid".
group
Similar to "gid" but uses the GID of group name from /etc/group.
See also "gid" and "user".
log [len ] [format ] [max level [min level]]
Adds a global syslog server. Up to two global servers can be defined. They
will receive logs for startups and exits, as well as all logs from proxies
configured with "log global".
can be one of:
- An IPv4 address optionally followed by a colon and a UDP port. If
no port is specified, 514 is used by default (the standard syslog
port).
- An IPv6 address followed by a colon and optionally a UDP port. If
no port is specified, 514 is used by default (the standard syslog
port).
- A filesystem path to a UNIX domain socket, keeping in mind
considerations for chroot (be sure the path is accessible inside
the chroot) and uid/gid (be sure the path is appropriately
writeable).
You may want to reference some environment variables in the address
parameter, see section 2.3 about environment variables.
is an optional maximum line length. Log lines larger than this value
will be truncated before being sent. The reason is that syslog
servers act differently on log line length. All servers support the
default value of 1024, but some servers simply drop larger lines
while others do log them. If a server supports long lines, it may
make sense to set this value here in order to avoid truncating long
lines. Similarly, if a server drops long lines, it is preferable to
truncate them before sending them. Accepted values are 80 to 65535
inclusive. The default value of 1024 is generally fine for all
standard usages. Some specific cases of long captures or
JSON-formated logs may require larger values.
is the log format used when generating syslog messages. It may be
one of the following :
An optional level can be specified to filter outgoing messages. By default,
all messages are sent. If a maximum level is specified, only messages with a
severity at least as important as this level will be sent. An optional minimum
level can be specified. If it is set, logs emitted with a more severe level
than this one will be capped to this level. This is used to avoid sending
"emerg" messages on all terminals on some default syslog configurations.
Eight levels are known :
emerg alert crit err warning notice info debug
log-send-hostname []
Sets the hostname field in the syslog header. If optional "string" parameter
is set the header is set to the string contents, otherwise uses the hostname
of the system. Generally used if one is not relaying logs through an
intermediate syslog server or for simply customizing the hostname printed in
the logs.
log-tag
Sets the tag field in the syslog header to this string. It defaults to the
program name as launched from the command line, which usually is "haproxy".
Sometimes it can be useful to differentiate between multiple processes
running on the same host. See also the per-proxy "log-tag" directive.
lua-load
This global directive loads and executes a Lua file. This directive can be
used multiple times.
nbproc
Creates processes when going daemon. This requires the "daemon"
mode. By default, only one process is created, which is the recommended mode
of operation. For systems limited to small sets of file descriptors per
process, it may be needed to fork multiple daemons. USING MULTIPLE PROCESSES
IS HARDER TO DEBUG AND IS REALLY DISCOURAGED. See also "daemon".
pidfile
Writes pids of all daemons into file . This option is equivalent to
the "-p" command line argument. The file must be accessible to the user
starting the process. See also "daemon".
presetenv
Sets environment variable to value . If the variable exists, it
is NOT overwritten. The changes immediately take effect so that the next line
in the configuration file sees the new value. See also "setenv", "resetenv",
and "unsetenv".
resetenv [ ...]
Removes all environment variables except the ones specified in argument. It
allows to use a clean controlled environment before setting new values with
setenv or unsetenv. Please note that some internal functions may make use of
some environment variables, such as time manipulation functions, but also
OpenSSL or even external checks. This must be used with extreme care and only
after complete validation. The changes immediately take effect so that the
next line in the configuration file sees the new environment. See also
"setenv", "presetenv", and "unsetenv".
stats bind-process [ all | odd | even | [-] ] ...
Limits the stats socket to a certain set of processes numbers. By default the
stats socket is bound to all processes, causing a warning to be emitted when
nbproc is greater than 1 because there is no way to select the target process
when connecting. However, by using this setting, it becomes possible to pin
the stats socket to a specific set of processes, typically the first one. The
warning will automatically be disabled when this setting is used, whatever
the number of processes used. The maximum process ID depends on the machine's
word size (32 or 64). A better option consists in using the "process" setting
of the "stats socket" line to force the process on each line.
server-state-base
Specifies the directory prefix to be prepended in front of all servers state
file names which do not start with a '/'. See also "server-state-file",
"load-server-state-from-file" and "server-state-file-name".
server-state-file
Specifies the path to the file containing state of servers. If the path starts
with a slash ('/'), it is considered absolute, otherwise it is considered
relative to the directory specified using "server-state-base" (if set) or to
the current directory. Before reloading HAProxy, it is possible to save the
servers' current state using the stats command "show servers state". The
output of this command must be written in the file pointed by . When
starting up, before handling traffic, HAProxy will read, load and apply state
for each server found in the file and available in its current running
configuration. See also "server-state-base" and "show servers state",
"load-server-state-from-file" and "server-state-file-name"
setenv
Sets environment variable to value . If the variable exists, it
is overwritten. The changes immediately take effect so that the next line in
the configuration file sees the new value. See also "presetenv", "resetenv",
and "unsetenv".
ssl-default-bind-ciphers
This setting is only available when support for OpenSSL was built in. It sets
the default string describing the list of cipher algorithms ("cipher suite")
that are negotiated during the SSL/TLS handshake for all "bind" lines which
do not explicitly define theirs. The format of the string is defined in
"man 1 ciphers" from OpenSSL man pages, and can be for instance a string such
as "AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH" (without quotes). Please check the
"bind" keyword for more information.
ssl-default-bind-options [
All parameters supported by "bind" lines are supported, for instance to
restrict access to some users or their access rights. Please consult
section 5.1 for more information.
stats timeout
The default timeout on the stats socket is set to 10 seconds. It is possible
to change this value with "stats timeout". The value must be passed in
milliseconds, or be suffixed by a time unit among { us, ms, s, m, h, d }.
stats maxconn
By default, the stats socket is limited to 10 concurrent connections. It is
possible to change this value with "stats maxconn".
uid
Changes the process' user ID to . It is recommended that the user ID
is dedicated to HAProxy or to a small set of similar daemons. HAProxy must
be started with superuser privileges in order to be able to switch to another
one. See also "gid" and "user".
ulimit-n
Sets the maximum number of per-process file-descriptors to . By
default, it is automatically computed, so it is recommended not to use this
option.
unix-bind [ prefix ] [ mode ] [ user ] [ uid ]
[ group ] [ gid ]
Fixes common settings to UNIX listening sockets declared in "bind" statements.
This is mainly used to simplify declaration of those UNIX sockets and reduce
the risk of errors, since those settings are most commonly required but are
also process-specific. The setting can be used to force all socket
path to be relative to that directory. This might be needed to access another
component's chroot. Note that those paths are resolved before haproxy chroots
itself, so they are absolute. The , , , and
all have the same meaning as their homonyms used by the "bind" statement. If
both are specified, the "bind" statement has priority, meaning that the
"unix-bind" settings may be seen as process-wide default settings.
unsetenv [ ...]
Removes environment variables specified in arguments. This can be useful to
hide some sensitive information that are occasionally inherited from the
user's environment during some operations. Variables which did not exist are
silently ignored so that after the operation, it is certain that none of
these variables remain. The changes immediately take effect so that the next
line in the configuration file will not see these variables. See also
"setenv", "presetenv", and "resetenv".
user
Similar to "uid" but uses the UID of user name from /etc/passwd.
See also "uid" and "group".
node
Only letters, digits, hyphen and underscore are allowed, like in DNS names.
This statement is useful in HA configurations where two or more processes or
servers share the same IP address. By setting a different node-name on all
nodes, it becomes easy to immediately spot what server is handling the
traffic.
description
Add a text that describes the instance.
Please note that it is required to escape certain characters (# for example)
and this text is inserted into a html page so you should avoid using
"<" and ">" characters.
51degrees-data-file
The path of the 51Degrees data file to provide device detection services. The
file should be unzipped and accessible by HAProxy with relevavnt permissions.
Please note that this option is only available when haproxy has been
compiled with USE_51DEGREES.
51degrees-property-name-list [ ...]
A list of 51Degrees property names to be load from the dataset. A full list
of names is available on the 51Degrees website:
https://51degrees.com/resources/property-dictionary
Please note that this option is only available when haproxy has been
compiled with USE_51DEGREES.
51degrees-property-separator
A char that will be appended to every property value in a response header
containing 51Degrees results. If not set that will be set as ','.
Please note that this option is only available when haproxy has been
compiled with USE_51DEGREES.
51degrees-cache-size
Sets the size of the 51Degrees converter cache to entries. This
is an LRU cache which reminds previous device detections and their results.
By default, this cache is disabled.
Please note that this option is only available when haproxy has been
compiled with USE_51DEGREES.
wurfl-data-file
The path of the WURFL data file to provide device detection services. The
file should be accessible by HAProxy with relevant permissions.
Please note that this option is only available when haproxy has been compiled
with USE_WURFL=1.
wurfl-information-list []*
A space-delimited list of WURFL capabilities, virtual capabilities, property
names we plan to use in injected headers. A full list of capability and
virtual capability names is available on the Scientiamobile website :
https://www.scientiamobile.com/wurflCapability
Valid WURFL properties are:
wurfl_id Contains the device ID of the matched device.
wurfl_root_id Contains the device root ID of the matched
device.
wurfl_isdevroot Tells if the matched device is a root device.
Possible values are "TRUE" or "FALSE".
wurfl_useragent The original useragent coming with this
particular web request.
wurfl_api_version Contains a string representing the currently
used Libwurfl API version.
wurfl_engine_target Contains a string representing the currently
set WURFL Engine Target. Possible values are
"HIGH_ACCURACY", "HIGH_PERFORMANCE", "INVALID".
wurfl_info A string containing information on the parsed
wurfl.xml and its full path.
wurfl_last_load_time Contains the UNIX timestamp of the last time
WURFL has been loaded successfully.
wurfl_normalized_useragent The normalized useragent.
wurfl_useragent_priority The user agent priority used by WURFL.
Please note that this option is only available when haproxy has been compiled
with USE_WURFL=1.
wurfl-information-list-separator
A char that will be used to separate values in a response header containing
WURFL results. If not set that a comma (',') will be used by default.
Please note that this option is only available when haproxy has been compiled
with USE_WURFL=1.
wurfl-patch-file []
A list of WURFL patch file paths. Note that patches are loaded during startup
thus before the chroot.
Please note that this option is only available when haproxy has been compiled
with USE_WURFL=1.
wurfl-engine-mode { accuracy | performance }
Sets the WURFL engine target. You can choose between 'accuracy' or
'performance' targets. In performance mode, desktop web browser detection is
done programmatically without referencing the WURFL data. As a result, most
desktop web browsers are returned as generic_web_browser WURFL ID for
performance. If either performance or accuracy are not defined, performance
mode is enabled by default.
Please note that this option is only available when haproxy has been compiled
with USE_WURFL=1.
wurfl-cache-size [,]
Sets the WURFL caching strategy. Here is the Useragent cache size, and
is the internal device cache size. There are three possibilities here :
"0" : no cache is used.
: the Single LRU cache is used, the size is expressed in elements.
, : the Double LRU cache is used, both sizes are in elements. This is
the highest performing option.
Please note that this option is only available when haproxy has been compiled
with USE_WURFL=1.
wurfl-useragent-priority { plain | sideloaded_browser }
Tells WURFL if it should prioritize use of the plain user agent ('plain')
over the default sideloaded browser user agent ('sideloaded_browser').
Please note that this option is only available when haproxy has been compiled
with USE_WURFL=1.