Re: patch: nested acl evaluation

2009-04-02 Thread Jeffrey 'jf' Lim
On Fri, Apr 3, 2009 at 1:00 PM, Willy Tarreau wrote: > On Fri, Apr 03, 2009 at 08:55:11AM +0800, Jeffrey 'jf' Lim wrote: > (...) >> >> Having said that, there are blocks already in the standard config >> (like "backend", with multiple "server" lines) - but the difference is >> they don't need an e

Re: patch: nested acl evaluation

2009-04-02 Thread Willy Tarreau
On Fri, Apr 03, 2009 at 08:55:11AM +0800, Jeffrey 'jf' Lim wrote: (...) > > This is the first statement which introduces the notion > >    of a block, with a beginning and a mandatory end. I don't like that > >    for the same reason I don't like config languages with braces. It's > >    harder to

Re: patch: nested acl evaluation

2009-04-02 Thread Jeffrey 'jf' Lim
On Fri, Apr 3, 2009 at 5:20 AM, Willy Tarreau wrote: > Hi Jeffrey, > > On Thu, Apr 02, 2009 at 02:23:44PM +0800, Jeffrey 'jf' Lim wrote: > (...) >> Ok perhaps "combinatorial" was not the word that i should have used, >> but... I hope you can see the point/s with the explanation that i >> gave. The

Re: patch: nested acl evaluation

2009-04-02 Thread Willy Tarreau
Hi Jeffrey, On Thu, Apr 02, 2009 at 02:23:44PM +0800, Jeffrey 'jf' Lim wrote: (...) > Ok perhaps "combinatorial" was not the word that i should have used, > but... I hope you can see the point/s with the explanation that i > gave. The "head" acl only gets checked once - thereafter which it goes >

Re: Forcing SSL encryption (a.k.a. 'redirect' keyword not recognised)

2009-04-02 Thread Willy Tarreau
On Wed, Apr 01, 2009 at 12:57:36PM +0300, John Doe wrote: > I am perplexed as HAproxy 1.3.15.8 doesn't recognise the 'redirect' keyword. And it's right because 1.3.15.8 does not have it. This was implemented in 1.3.16 (use 1.3.17 instead, 1.3.16 is buggy). Also, be careful, there's a small mistak

Re: Dynamic configuration changes.

2009-04-02 Thread Willy Tarreau
Hi Brian, On Mon, Mar 30, 2009 at 09:34:09PM -0400, Brian Gupta wrote: > Willy, > > A while back we had discussed adding a control socket to haproxy to > take such actions are manually marking nodes as down, adding new > nodes, and other dynamic state changes. > > Have you thought about this any

Re: First time setup

2009-04-02 Thread Jan-Frode Myklebust
On 2009-04-01, Jan-Frode Myklebust wrote: > This could be a lot of IP-adresses if you have many virtual hosts. So > you might want to consider running a loadbalancer that support SSL > instead of HAProxy, f.ex. apache's mod_proxy_balancer. Then only your > loadbalancer will need to talk SSL, while