|
2 | 2 | <html lang="en"> |
3 | 3 | <head> |
4 | 4 | <meta charset="utf-8" /> |
5 | | - <title>HAProxy version 3.2.8-4 - Configuration Manual</title> |
| 5 | + <title>HAProxy version 3.2.9 - Configuration Manual</title> |
6 | 6 | <link href="https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/css/bootstrap.min.css" rel="stylesheet" /> |
7 | 7 | <link href="https://raw.githubusercontent.com/thomaspark/bootswatch/v3.3.7/cerulean/bootstrap.min.css" rel="stylesheet" /> |
8 | 8 | <link href="../css/page.css?0.4.2-15" rel="stylesheet" /> |
|
4622 | 4622 | You can use <strong>left</strong> and <strong>right</strong> arrow keys to navigate between chapters.<br> |
4623 | 4623 | </p> |
4624 | 4624 | <p class="text-right"> |
4625 | | - <small>Converted with <a href="https://github.com/cbonte/haproxy-dconv">haproxy-dconv</a> v<b>0.4.2-15</b> on <b>2025/11/17</b></small> |
| 4625 | + <small>Converted with <a href="https://github.com/cbonte/haproxy-dconv">haproxy-dconv</a> v<b>0.4.2-15</b> on <b>2025/11/21</b></small> |
4626 | 4626 | </p> |
4627 | 4627 | </div> |
4628 | 4628 | <!-- /.sidebar --> |
|
4633 | 4633 | <div class="text-center"> |
4634 | 4634 | <h1><a href="http://www.haproxy.org/" title="HAProxy"><img src="../img/HAProxyCommunityEdition_60px.png?0.4.2-15" /></a></h1> |
4635 | 4635 | <h2>Configuration Manual</h2> |
4636 | | - <p><strong>version 3.2.8-4</strong></p> |
| 4636 | + <p><strong>version 3.2.9</strong></p> |
4637 | 4637 | <p> |
4638 | | - 2025/11/07<br> |
| 4638 | + 2025/11/21<br> |
4639 | 4639 |
|
4640 | 4640 | </p> |
4641 | 4641 | </div> |
@@ -6338,6 +6338,8 @@ <h3 id="chapter-1.4.1" data-target="1.4.1"><small><a class="small" href="#1.4.1" |
6338 | 6338 | 408 when the request timeout strikes before the request is complete |
6339 | 6339 | 410 when the requested resource is no longer available and will not |
6340 | 6340 | be available again |
| 6341 | + 413 when a HTTP/1.0 GET/HEAD/DELETE requests has a payload, also see |
| 6342 | + the "<a href="#h1-accept-payload-with-any-method">h1-accept-payload-with-any-method</a>" option |
6341 | 6343 | 500 when HAProxy encounters an unrecoverable internal error, such as a |
6342 | 6344 | memory allocation failure, which should never happen |
6343 | 6345 | 501 when HAProxy is unable to satisfy a client request because of an |
@@ -6958,26 +6960,51 @@ <h2 id="chapter-2.4" data-target="2.4"><small><a class="small" href="#2.4">2.4.< |
6958 | 6960 | in the features list reported by "haproxy -vv" |
6959 | 6961 | (which means a <name> appears after a '+') |
6960 | 6962 |
|
6961 | | - - streq(<str1>,<str2>) : returns true only if the two strings are equal |
6962 | | - - strneq(<str1>,<str2>) : returns true only if the two strings differ |
6963 | | - - strstr(<str1>,<str2>) : returns true only if the second string is found in |
6964 | | - the first one. |
| 6963 | + - openssl_version_atleast(<ver>) : returns true if the current openssl |
| 6964 | + version is at least as recent as <ver> otherwise |
| 6965 | + false. |
| 6966 | + Libraries like LibreSSL, AWS-LC and WolfSSL also |
| 6967 | + provide a pseudo OpenSSL version. |
| 6968 | +</pre><div class="separator"> |
| 6969 | +<span class="label label-success">Example:</span> |
| 6970 | +<pre class="prettyprint"> |
| 6971 | +<code>ssllib_name_startswith(OpenSSL) && openssl_version_atleast(1.1.1) |
| 6972 | +</code></pre> |
| 6973 | +</div><pre class="text">- openssl_version_before(<ver>) : returns true if the current openssl |
| 6974 | + version is strictly older than <ver> otherwise |
| 6975 | + false. |
| 6976 | + Libraries like LibreSSL, AWS-LC and WolfSSL also |
| 6977 | + provide a pseudo OpenSSL version. |
| 6978 | +</pre><div class="separator"> |
| 6979 | +<span class="label label-success">Example:</span> |
| 6980 | +<pre class="prettyprint"> |
| 6981 | +<div class="example-desc">openssl_version_before(3.5.0)</div><code></code></pre> |
| 6982 | +</div><pre class="text">- ssllib_name_startswith(<name>) : return true if the SSL library name |
| 6983 | + HAProxy was linked with, starts with <name>. |
| 6984 | +</pre><div class="separator"> |
| 6985 | +<span class="label label-success">Example:</span> |
| 6986 | +<pre class="prettyprint"> |
| 6987 | +<div class="example-desc">ssllib_name_startswith(wolfSSL)</div><code></code></pre> |
| 6988 | +</div><pre class="text">- streq(<str1>,<str2>) : returns true only if the two strings are equal |
| 6989 | +- strneq(<str1>,<str2>) : returns true only if the two strings differ |
| 6990 | +- strstr(<str1>,<str2>) : returns true only if the second string is found in |
| 6991 | + the first one. |
6965 | 6992 |
|
6966 | | - - version_atleast(<ver>): returns true if the current haproxy version is |
6967 | | - at least as recent as <ver> otherwise false. The |
6968 | | - version syntax is the same as shown by "haproxy -v" |
6969 | | - and missing components are assumed as being zero. |
| 6993 | +- version_atleast(<ver>): returns true if the current haproxy version is |
| 6994 | + at least as recent as <ver> otherwise false. The |
| 6995 | + version syntax is the same as shown by "haproxy -v" |
| 6996 | + and missing components are assumed as being zero. |
6970 | 6997 |
|
6971 | | - - version_before(<ver>) : returns true if the current haproxy version is |
6972 | | - strictly older than <ver> otherwise false. The |
6973 | | - version syntax is the same as shown by "haproxy -v" |
6974 | | - and missing components are assumed as being zero. |
| 6998 | +- version_before(<ver>) : returns true if the current haproxy version is |
| 6999 | + strictly older than <ver> otherwise false. The |
| 7000 | + version syntax is the same as shown by "haproxy -v" |
| 7001 | + and missing components are assumed as being zero. |
6975 | 7002 |
|
6976 | | - - enabled(<opt>) : returns true if the option <opt> is enabled at |
6977 | | - run-time. Only a subset of options are supported: |
6978 | | - POLL, EPOLL, KQUEUE, EVPORTS, SPLICE, |
6979 | | - GETADDRINFO, REUSEPORT, FAST-FORWARD, |
6980 | | - SERVER-SSL-VERIFY-NONE |
| 7003 | +- enabled(<opt>) : returns true if the option <opt> is enabled at |
| 7004 | + run-time. Only a subset of options are supported: |
| 7005 | + POLL, EPOLL, KQUEUE, EVPORTS, SPLICE, |
| 7006 | + GETADDRINFO, REUSEPORT, FAST-FORWARD, |
| 7007 | + SERVER-SSL-VERIFY-NONE |
6981 | 7008 | </pre><div class="separator"> |
6982 | 7009 | <span class="label label-success">Example:</span> |
6983 | 7010 | <pre class="prettyprint"> |
@@ -8244,7 +8271,8 @@ <h2 id="chapter-3.1" data-target="3.1"><small><a class="small" href="#3.1">3.1.< |
8244 | 8271 | </div><div class="page-header"><b>See also:</b> hard-stop-after, monitor</div> |
8245 | 8272 | <a class="anchor" name="group"></a><a class="anchor" name="3-group"></a><a class="anchor" name="3.1-group"></a><a class="anchor" name="group (Global section)"></a><a class="anchor" name="group (Process management and security)"></a><div class="keyword"><b><a class="anchor" name="group"></a><a href="#3.1-group">group</a></b> <span style="color: #080"><group name></span></div><pre class="text">Similar to "<span class="dropdown"><a class="dropdown-toggle" data-toggle="dropdown" href="#">gid<span class="caret"></span></a><ul class="dropdown-menu"><li class="dropdown-header">This keyword is available in sections :</li><li><a href="#gid%20%28Process%20management%20and%20security%29">Process management and security</a></li><li><a href="#gid%20%28Bind%20options%29">Bind options</a></li></ul></span>" but uses the GID of group name <group name> from /etc/group. |
8246 | 8273 | See also "<span class="dropdown"><a class="dropdown-toggle" data-toggle="dropdown" href="#">gid<span class="caret"></span></a><ul class="dropdown-menu"><li class="dropdown-header">This keyword is available in sections :</li><li><a href="#gid%20%28Process%20management%20and%20security%29">Process management and security</a></li><li><a href="#gid%20%28Bind%20options%29">Bind options</a></li></ul></span>" and "<span class="dropdown"><a class="dropdown-toggle" data-toggle="dropdown" href="#">user<span class="caret"></span></a><ul class="dropdown-menu"><li class="dropdown-header">This keyword is available in sections :</li><li><a href="#user%20%28Userlists%29">Userlists</a></li><li><a href="#user%20%28Programs%20%28deprecated%29%29">Programs (deprecated)</a></li><li><a href="#user%20%28Process%20management%20and%20security%29">Process management and security</a></li><li><a href="#user%20%28Bind%20options%29">Bind options</a></li></ul></span>". |
8247 | | -</pre><a class="anchor" name="h1-accept-payload-with-any-method"></a><a class="anchor" name="3-h1-accept-payload-with-any-method"></a><a class="anchor" name="3.1-h1-accept-payload-with-any-method"></a><a class="anchor" name="h1-accept-payload-with-any-method (Global section)"></a><a class="anchor" name="h1-accept-payload-with-any-method (Process management and security)"></a><div class="keyword"><b><a class="anchor" name="h1-accept-payload-with-any-method"></a><a href="#3.1-h1-accept-payload-with-any-method">h1-accept-payload-with-any-method</a></b></div><pre class="text">Does not reject HTTP/1.0 GET/HEAD/DELETE requests with a payload. |
| 8274 | +</pre><a class="anchor" name="h1-accept-payload-with-any-method"></a><a class="anchor" name="3-h1-accept-payload-with-any-method"></a><a class="anchor" name="3.1-h1-accept-payload-with-any-method"></a><a class="anchor" name="h1-accept-payload-with-any-method (Global section)"></a><a class="anchor" name="h1-accept-payload-with-any-method (Process management and security)"></a><div class="keyword"><b><a class="anchor" name="h1-accept-payload-with-any-method"></a><a href="#3.1-h1-accept-payload-with-any-method">h1-accept-payload-with-any-method</a></b></div><pre class="text">Does not reject HTTP/1.0 GET/HEAD/DELETE requests with a payload with a |
| 8275 | +413 Payload Too Large HTTP response. |
8248 | 8276 |
|
8249 | 8277 | While It is explicitly allowed in HTTP/1.1, HTTP/1.0 is not clear on this |
8250 | 8278 | point and some old servers don't expect any payload and never look for body |
@@ -9889,7 +9917,8 @@ <h2 id="chapter-3.2" data-target="3.2"><small><a class="small" href="#3.2">3.2.< |
9889 | 9917 | the polling system. The default value is adapted to the operating system. It |
9890 | 9918 | has been noticed that reducing it below 200 tends to slightly decrease |
9891 | 9919 | latency at the expense of network bandwidth, and increasing it above 200 |
9892 | | -tends to trade latency for slightly increased bandwidth. |
| 9920 | +tends to trade latency for slightly increased bandwidth. The configured value |
| 9921 | +must be lower than or equal to 1000000. |
9893 | 9922 | </pre><a class="anchor" name="tune.maxrewrite"></a><a class="anchor" name="3-tune.maxrewrite"></a><a class="anchor" name="3.2-tune.maxrewrite"></a><a class="anchor" name="tune.maxrewrite (Global section)"></a><a class="anchor" name="tune.maxrewrite (Performance tuning)"></a><div class="keyword"><b><a class="anchor" name="tune.maxrewrite"></a><a href="#3.2-tune.maxrewrite">tune.maxrewrite</a></b> <span style="color: #080"><number></span></div><pre class="text">Sets the reserved buffer space to this size in bytes. The reserved space is |
9894 | 9923 | used for header rewriting or appending. The first reads on sockets will never |
9895 | 9924 | fill more than bufsize-maxrewrite. Historically it has defaulted to half of |
@@ -33038,13 +33067,21 @@ <h2 id="chapter-12.8" data-target="12.8"><small><a class="small" href="#12.8">12 |
33038 | 33067 | is experimental meaning that "<a href="#expose-experimental-directives">expose-experimental-directives</a>" must be in the |
33039 | 33068 | global section so this can be used. |
33040 | 33069 |
|
33041 | | -Current limitations as of 3.2: The feature is limited to the HTTP-01 challenge |
33042 | | -for now. The current HAProxy architecture is a non-blocking model, access to |
33043 | | -the disk is not supposed to be done after the configuration is loaded, because |
33044 | | -it could block the event loop, blocking the traffic on the same thread. Meaning |
33045 | | -that the certificates and keys generated from HAProxy will need to be dumped |
33046 | | -from outside HAProxy using "dump ssl cert" on the stats socket. |
33047 | | -External Account Binding (EAB) is not supported. |
| 33070 | +Current limitations as of 3.2: |
| 33071 | +- The feature is limited to the HTTP-01 or DNS-01 challenges for now. HTTP-01 |
| 33072 | + is completely handled by HAProxy, but DNS-01 needs either the dataplaneAPI or |
| 33073 | + another 3rd party tool to talk to a DNS provider API. |
| 33074 | +- Configuring acme needs a configuration with a crt, it's currently not |
| 33075 | + possible to start without this crt on the disk, a key-pair must already exist |
| 33076 | + to start haproxy. It is recommanded to use an expired certificate for that. |
| 33077 | +- The current HAProxy architecture is a non-blocking model, access to the disk |
| 33078 | + is not supposed to be done after the configuration is loaded, because it |
| 33079 | + could block the event loop, blocking the traffic on the same thread. Meaning |
| 33080 | + that the certificates and keys generated from HAProxy will need to be dumped |
| 33081 | + from outside HAProxy using "dump ssl cert" on the stats socket. It's possible |
| 33082 | + to automate the dump of the certificates by using the dataplaneAPI or the |
| 33083 | + haproxy-dump-certs script provided in the admin/cli/ directory. |
| 33084 | +- External Account Binding (EAB) is not supported. |
33048 | 33085 |
|
33049 | 33086 | The ACME scheduler starts at HAProxy startup, it will loop over the |
33050 | 33087 | certificates and start an ACME renewal task when the notAfter task is past |
@@ -33179,8 +33216,8 @@ <h2 id="chapter-12.9" data-target="12.9"><small><a class="small" href="#12.9">12 |
33179 | 33216 | <br> |
33180 | 33217 | <hr> |
33181 | 33218 | <div class="text-right"> |
33182 | | - HAProxy 3.2.8-4 – Configuration Manual<br> |
33183 | | - <small>, 2025/11/07</small> |
| 33219 | + HAProxy 3.2.9 – Configuration Manual<br> |
| 33220 | + <small>, 2025/11/21</small> |
33184 | 33221 | </div> |
33185 | 33222 | </div> |
33186 | 33223 | <!-- /.col-lg-12 --> |
|
0 commit comments