Configuration¶

This page shows where HAProxy's configuration lives, how to check and apply a change, and how to replace the sample backends with your own servers.

Where configuration lives¶

Path	What it is
`/etc/haproxy/haproxy.cfg`	The live configuration, written on first boot. Owned by `root:haproxy`, mode 0640.
`/var/lib/haproxy/stats.password`	The stats password for user `pilot`. Owned by `root:haproxy`, mode 0640.
`/opt/sushi/etc/haproxy/haproxy.cfg.tmpl`	The template first boot starts from.
`/opt/sushi/etc/haproxy/backend-a.env`, `backend-b.env`	Name and port of each sample backend.

First boot writes haproxy.cfg only if it does not exist yet. Your edits are kept across reboots.

The default configuration has:

frontend sushi_http: binds 127.0.0.1:8080, refuses paths that start with /stats, and sends everything else to backend sushi_app.
backend sushi_app: round-robin across 127.0.0.1:18081 and 127.0.0.1:18082, with an HTTP health check of GET /health that expects status 200, every 500 ms.
listen sushi_stats: the stats page on 127.0.0.1:8404/stats, protected with stats auth pilot:<password>.

Apply a change¶

Edit the file:
```
sudo nano /etc/haproxy/haproxy.cfg
```

Check it:

sudo haproxy -c -f /etc/haproxy/haproxy.cfg

Reload HAProxy. The reload checks the file again and applies it without stopping the service:
```
sudo systemctl reload haproxy
```

Use your own backend servers¶

Replace the two server lines in backend sushi_app with your own servers, for example two application instances in your VPC:

backend sushi_app
    balance roundrobin
    option httpchk GET /health
    http-check expect status 200
    default-server inter 500ms fall 2 rise 2
    server app1 10.0.1.10:8080 check
    server app2 10.0.1.11:8080 check

The health check calls GET /health on each server and expects HTTP 200. If your application uses a different health path, change the option httpchk line to match. A server that fails the check is taken out of rotation.

Allow HAProxy's traffic to reach your servers in their security groups.

Turn off the sample backends¶

Once your own servers are in place, stop the two sample backends and keep them from starting again. haproxy.service asks for them at startup, so mask them rather than only disabling them:

sudo systemctl mask --now sushi-haproxy-backend@a.service sushi-haproxy-backend@b.service

To bring them back, run sudo systemctl unmask with the same unit names, then start them.

Accept traffic from your network¶

The frontend and the stats page bind to 127.0.0.1, so nothing outside the instance can reach them. To serve clients in your VPC:

Change the frontend's bind line to the instance's private address, for example bind 10.0.1.5:8080.
Check the file and reload HAProxy.
In the security group, open that port only to the client address ranges that need it.

Warning

Keep the stats page on 127.0.0.1 and reach it through Session Manager port forwarding. Do not bind the stats page or the frontend to 0.0.0.0 behind an open security group.

Change the stats password¶

The password appears in plain text on the stats auth line of haproxy.cfg. To change it, edit that line, check the file and reload. Update /var/lib/haproxy/stats.password too, if you rely on it to look the password up later. The password cannot contain a colon.