Re: Syslog with systemd

2018-03-01 Thread Vincent Bernat
❦ 2 mars 2018 09:49 +1100, Igor Cicimov  : > $ ls -l /var/log/haproxy.log > -rw-r- 1 syslog adm 48939 Mar 1 20:17 /var/log/haproxy.log > > ​and I'm sure this file was automatically created ​(by rsyslog I guess?). > I'm sure this has always been the case hence the reason I was confused when

Re: What is a nice way to bypass the maintenance mode for certain IP's?

2018-03-01 Thread Willy Tarreau
Hi Cyril, On Thu, Mar 01, 2018 at 08:50:55PM +0100, Cyril Bonté wrote: > Well, I think your issue will be resolved by moving "force-persist" on the > backend side instead of the frontend one. > > The issue seems to exist from the first day of "force-persist", where the > code and the documentatio

Re: TLS termination with 2 certs on same IP

2018-03-01 Thread Lukas Tribus
Hello Dave, On 2 March 2018 at 01:09, Dave Cottlehuber wrote: > I have 2 TLS cert bundles that I'd like to serve off haproxy, using a single > IP. Both certs have multiple SANs in them. > > - our main production site: api,beta,www.example.com using EV cert > - a lets-encrypt cert bundle for old

Re: Syslog with systemd

2018-03-01 Thread deoren
On 2/27/2018 10:28 PM, Igor Cicimov wrote: Hi all, I have haproxy 1.7.10-1ppa1~xenial installed on Ubuntu-16.04 and struggling to enable rsyslog-ing for the service. I have rsyslog running and the following haproxy related config: # cat /etc/rsyslog.d/49-haproxy.conf # Create an additional s

TLS termination with 2 certs on same IP

2018-03-01 Thread Dave Cottlehuber
I have 2 TLS cert bundles that I'd like to serve off haproxy, using a single IP. Both certs have multiple SANs in them. - our main production site: api,beta,www.example.com using EV cert - a lets-encrypt cert bundle for old DNS names that we only need to redirect https: back to the main site I

Re: Syslog with systemd

2018-03-01 Thread Igor Cicimov
On Thu, Mar 1, 2018 at 5:08 PM, Vincent Bernat wrote: > ❦ 1 mars 2018 09:53 +1100, Igor Cicimov > : > > >> > ​Same, no logging:​ > >> [...] > >> > >> Could you strace rsyslogd and check if it is receiving the messages? > > > > > > ​Sure: > > > > # pidof rsyslogd > > 4145 > > # strace -p 4145 >

Re: What is a nice way to bypass the maintenance mode for certain IP's?

2018-03-01 Thread Cyril Bonté
Hi Pieter and Willy, Le 01/03/2018 à 16:09, Pieter Vogelaar a écrit : Hi Willy, Yes I'm absolutely certain that the cookie is present in the browser request when I get the 503. I changed the JSESSIONID line to "cookie SERVERID insert indirect nocache", but that didn't make a difference. Log

Re: What is a nice way to bypass the maintenance mode for certain IP's?

2018-03-01 Thread Pieter Vogelaar
Hi Willy, Yes I'm absolutely certain that the cookie is present in the browser request when I get the 503. I changed the JSESSIONID line to "cookie SERVERID insert indirect nocache", but that didn't make a difference. Log line when both servers in backend are in maintenance mode: 172.30.214.13

Re: [PATCH v2 0/3] Add SystemD's sandboxing options

2018-03-01 Thread Willy Tarreau
Hi guys, On Thu, Mar 01, 2018 at 03:53:25PM +0100, Tim Düsterhus wrote: > Pavlos, > > Am 27.02.2018 um 22:50 schrieb Pavlos Parissis: > > BTW: The commit message is a bit misleading because If I don't read the > > code I will > > think that those options are enabled, which isn't true. So, you ma

Re: [PATCH v2 0/3] Add SystemD's sandboxing options

2018-03-01 Thread Tim Düsterhus
Pavlos, Am 27.02.2018 um 22:50 schrieb Pavlos Parissis: > BTW: The commit message is a bit misleading because If I don't read the code > I will > think that those options are enabled, which isn't true. So, you may want to > mention they aren't > enabled by default. > I'm not sure how I could pu

Re: What is a nice way to bypass the maintenance mode for certain IP's?

2018-03-01 Thread Willy Tarreau
On Thu, Mar 01, 2018 at 02:29:57PM +, Pieter Vogelaar wrote: > Hi Willy, > > We use Memcached Session Manager that stores the Tomcat sessions to a > Couchbase cluster. It suffixes the session ID with "-n1" like: > > JSESSIONID=s01~1C7985929CDF981D9ACC79EBD8A3293D-n1 > > Could this JSESSIONI

Re: What is a nice way to bypass the maintenance mode for certain IP's?

2018-03-01 Thread Pieter Vogelaar
Hi Willy, We use Memcached Session Manager that stores the Tomcat sessions to a Couchbase cluster. It suffixes the session ID with "-n1" like: JSESSIONID=s01~1C7985929CDF981D9ACC79EBD8A3293D-n1 Could this JSESSIONID format somehow have impact on HAProxy? Best regards, Pieter Vogelaar Op

Re: What is a nice way to bypass the maintenance mode for certain IP's?

2018-03-01 Thread Willy Tarreau
Hi Pieter, On Thu, Mar 01, 2018 at 01:16:36PM +, Pieter Vogelaar wrote: > Hi Willy, > > I have the following (stripped down) configuration: > > --- > > defaults > log global > maxconn 8000 > option redispatch > option allbackups > retries 3 > stats enable > timeo

Re: What is a nice way to bypass the maintenance mode for certain IP's?

2018-03-01 Thread Pieter Vogelaar
Hi Willy, I have the following (stripped down) configuration: --- defaults log global maxconn 8000 option redispatch option allbackups retries 3 stats enable timeout http-request 10s timeout queue 1m timeout connect 10s timeout client 1m timeout server 1m

Re: http/2 PUT's without content-length fail to http 1.1 backend

2018-03-01 Thread Willy Tarreau
On Thu, Mar 01, 2018 at 09:38:10AM +, Robert Samuel Newson wrote: > Yup, agreed, the frame-only transfers are only really implied in the spec > (8.1.2.6's, "A request or response that includes a payload body _can_ include > a content-length header field", my emphasis). The http 2 spec does > sp

Re: [PATCH] proxy-v2-options ssl-cipher,cert-sig,cert-key,authority

2018-03-01 Thread Willy Tarreau
On Thu, Mar 01, 2018 at 11:21:15AM +0100, Emmanuel Hocdet wrote: > > I can merge it after applying the small changes above, unless you have > > a different idea. Just let me know. > > > Good for me. > Thanks. OK now merged. Thanks. Willy

Re: [PATCH] proxy-v2-options ssl-cipher,cert-sig,cert-key,authority

2018-03-01 Thread Emmanuel Hocdet
Hi Willy, > Le 1 mars 2018 à 07:00, Willy Tarreau a écrit : > > Hi Manu, > > this series is giving me two build warnings : > > src/ssl_sock.c: In function 'ssl_sock_load_multi_cert': > src/ssl_sock.c:3143:3: warning: ISO C90 forbids mixed declarations and code > [-Wdeclaration-after-statement

Re: http/2 PUT's without content-length fail to http 1.1 backend

2018-03-01 Thread Robert Samuel Newson
Hi, Yup, agreed, the frame-only transfers are only really implied in the spec (8.1.2.6's, "A request or response that includes a payload body _can_ include a content-length header field", my emphasis). The http 2 spec does specifically prohibit the transfer-encoding: chunked header, again imply