[{"_1":2,"_183":-5,"_184":-5},"loaderData",{"_3":4,"_17":18,"_25":26,"_162":163},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7,"_13":14,"_15":16},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","theme","system","contrast","normal","routes/_layout",{"_19":-5,"_20":21,"_22":21,"_23":11,"_24":21},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_27":28,"_29":-5,"_30":11,"_31":11,"_32":33,"_34":35,"_36":-5,"_37":11,"_38":39,"_88":89,"_111":112,"_151":-5,"_152":11,"_153":21,"_154":11,"_155":-5,"_156":11,"_157":-5,"_158":159,"_160":113,"_161":-7},"canonicalUrl","https://hub.docker.com/r/impulsecloud/ic-haproxy/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","impulsecloud","reponame","ic-haproxy","cloudBuildSource","isAutobuildsAvailable","repo",{"_40":41,"_42":43,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":55,"_57":35,"_32":33,"_58":59,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":74,"_79":21,"_80":81,"_85":33,"_86":87},"categories",[],"content_types",[44],"image","date_registered","2015-06-24T23:43:52.611182Z","description","","is_private","last_updated","2015-08-31T03:59:00.385078Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[56],"application/vnd.docker.distribution.manifest.v1+prettyjws","name","pull_count",1150,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","tutum/haproxy\n=============\n\n[![Deploy to Tutum](https://s.tutum.co/deploy-to-tutum.svg)](https://dashboard.tutum.co/stack/deploy/)\n\nHAProxy image that balances between linked containers and, if launched in Tutum,\nreconfigures itself when a linked cluster member redeploys, joins or leaves\n\nTag\n---\n\n tutum/haproxy:latest github branch master\n tutum/haproxy:0.1 github tag 0.1\n\nNote: tag `latest` is updated with new futures, like `virtual host`, `multiple ssl`, `multiple frontend`. tag `0.1` is the current stable version, with less features.\nUsage\n-----\n\nLaunch your application container that exposes port 80:\n\n docker run -d --name web1 tutum/hello-world\n docker run -d --name web2 tutum/hello-world\n\nThen, run `tutum/haproxy` linking it to the target containers:\n\n docker run -d -p 80:80 --link web1:web1 --link web2:web2 tutum/haproxy\n\nThe `tutum/haproxy` container will listen in port 80 and forward requests to both `web1` and `web2` backends using a `roundrobin` algorithm.\n\n\nConfiguration\n-------------\n\n###Global and default settings of HAProxy###\n\nSettings in this part is immutable, you have to redeploy HAProxy service to make the changes take effects\n\n|env var|default|description|\n|:-----:|:-----:|:----------|\n|DEFAULT_SSL_CERT||Default ssl cert, a pem file with private key followed by public certificate, '\\n'(two chars) as the line separator.|\n|BALANCE|roundrobin|load balancing algorithm to use. Possible values include: `roundrobin`, `static-rr`, `source`, `leastconn`|\n|MODE|http|mode of load balancing for HAProxy. Possible values include: `http`, `tcp`, `health`|\n|MAXCONN|4096|sets the maximum per-process number of concurrent connections.|\n|OPTION|redispatch|comma-separated list of HAProxy `option` entries to the `default` section.|\n|RSYSLOG_DESTINATION|127.0.0.1|the rsyslog destination to where HAProxy logs are sent|\n|SSL_BIND_OPTIONS|no-sslv3|explicitly set which SSL bind options will be used for the SSL server. This sets the HAProxy `ssl-default-bind-options` configuration setting. The default will allow only TLSv1.0+ to be used on the SSL server.|\n|SSL_BIND_CIPHERS||explicitly set which SSL ciphers will be used for the SSL server. This sets the HAProxy `ssl-default-bind-ciphers` configuration setting.|\n|STATS_PORT|1936|port for the HAProxy stats section. If this port is published, stats can be accessed at `http://:/`\n|STATS_AUTH|stats:stats|username and password required to access the Haproxy stats.|\n|TIMEOUT|connect 5000,client 50000,server 50000|comma-separated list of HAProxy `timeout` entries to the `default` section.|\n\n###Settings in linked application services###\n\nSettings here can overwrite the settings in HAProxy, which are only applied to the linked services. If run in Tutum, when the service redeploys, joins or leaves HAProxy service, HAProxy service will automatically update itself to apply the changes\n\n|env var|description|\n|:-----:|:----------|\n|APPSESSION|sticky session option. possible value `JSESSIONID len 52 timeout 3h`|\n|COOKIE|sticky session option. possible value `SRV insert indirect nocache`|\n|SSL_CERT|ssl cert, a pem file with private key followed by public certificate, '\\n'(two chars) as the line separator|\n|DEFAULT_SSL_CERT|similar to SSL_CERT, but stores the pem file at `/certs/cert0.pem` as the default ssl certs. If multiple `DEFAULT_SSL_CERT` are specified in linked services and HAProxy, the behavior is undefined|\n|EXCLUDE_PORTS|comma separated port numbers(e.g. 3306, 3307). By default, HAProxy will add all the ports exposed by the application services to the backend routes. You can exclude the ports that you don't want to be routed, like database port|\n|BALANCE|load balancing algorithm to use. Possible values include: `roundrobin`, `static-rr`, `source`, `leastconn`|\n|FORCE_SSL|if set(any value) together with ssl termination enabled. HAProxy will redirect HTTP request to HTTPS request.\n|VIRTUAL_HOST|specify virtual host and virtual path. Format: `[scheme://]domain[:port][/path], ...`. wildcard `*` can be used in `domain` and `path` part|\n\nCheck [the HAProxy configuration manual](http://cbonte.github.io/haproxy-dconv/configuration-1.5.html) for more information on the above.\n\nVirtual host and virtual path\n-----------------------------\n\nBoth virtual host and virtual path can be specified in environment variable `VIRTUAL_HOST`, which is a set of comma separated urls with the format of `[scheme://]domain[:port][/path]`.\n\n |item|default|description|\n |:---:|:-----:|:---------|\n |scheme|http|possible values: `http`, `https`, `wss`|\n |domain||virtual host. `*` can be used as the wildcard|\n |port|80/433|port number of the virtual host. When the scheme is `https` `wss`, the default port will be to `443`|\n |/path||virtual path, starts with `/`. `*` can be used as the wildcard|\n\n###examples of matching\n\n|virtual host|match|not match|\n|:-----------|:----|:--------|\n|http://example.com|example.com|www.example.com|\n|example.com|example.com|www.example.com|\n|example.com:90|example.com:90|example.com|\n|https://example.com|https://example.com|example.com|\n|https://example.com:444|https://example.com|https://example.com|\n|\\*.example.com|www.example.com|example.com|\n|\\*example.com|www.example.com, example.com, anotherexample.com|www.abc.com|\n|www.e\\*e.com|www.example.com, www.exxe.com|www.axxa.com|\n|www.example.\\*|www.example.com, www.example.org|example.com|\n|\\*|any website with HTTP||\n|https://\\*|any website with HTTPS||\n|\\*/path|example.com/path, example.org/path?u=user|example.com/path/|\n|\\*/path/|example.com/path/, example.org/path/?u=user|example.com/path, example.com/path/abc|\n|\\*/path/\\*|example.com/path/, example.org/path/abc|example.com/abc/path/\n|\\*/\\*/path/\\*|example.com/path/, example.org/abc/path/, example.net/abc/path/123|example.com/path|\n|\\*/\\*.js|example.com/abc.js, example.org/path/abc.js|example.com/abc.css|\n|\\*/\\*.do/|example.com/abc.do/, example.org/path/abc.do/|example.com/abc.do|\n|\\*/path/\\*.php|example.com/path/abc.php|example/abc.php, example.com/root/abc.php|\n|\\*.example.com/\\*.jpg|www.example.com/abc.jpg, abc.exampe.com/123.jpg|example.com/abc.jpg|\n|\\*/path, \\*/path/|example.com/path, example.org/path/||\n|example.com:90, https://example.com|example.com:90, https://example.com||\n\nSSL termination\n---------------\n\n`tutum/haproxy` supports ssl termination on multiple certificates. For each application that you want ssl terminates, simply set `SSL_CERT` and `VIRTUAL_HOST`. HAProxy, then, reads the certificate from the link environment and sets the ssl termination up.\n\n**Attention**: there was a bug that if an environment variable value contains \"=\", which is common in the `SSL_CERT`, docker skips that environment variable. As a result, multiple ssl termination only works on docker 1.7.0 or higher, or in Tutum\n\nSSL termination is enabled when:\n\n1. at least one SSL certificate is set, and\n2. either `VIRTUAL_HOST` is not set, or it is set with \"https\" as the scheme.\n\nTo set SSL certificate, you can either:\n\n1. set `DEFAULT_SSL_CERT` in `tutum/haprox`, or\n2. set `SSL_CERT` and/or `DEFAULT_SSL_CERT` in the application services linked to HAProxy\n\nThe difference between `SSL_CERT` and `DEFAULT_SSL_CERT` is that, the multiple certificates specified by `SSL_CERT` are stores in as cert1.pem, cert2.pem, ..., whereas the one specified by `DEFAULT_SSL_CERT` is always stored as cert0.pem. In that case, HAProxy will use cert0.pem as the default certificate when there is no SNI match. However, when multiple `DEFAULT_SSL_CERTICATE` is provided, only one of the certificates can be stored as cert0.pem, others are discarded.\n\nThe certificate specified in `tutum/haproxy` or in the linked application services is a pem file, containing a private key followed by a public certificate(private key must be put before the public certificate, order matters). You can run the following script to generate a self-signed certificate:\n\n\topenssl req -x509 -newkey rsa:2048 -keyout key.pem -out ca.pem -days 1080 -nodes -subj '/CN=*/O=My Company Name LTD./C=US'\n\tcp key.pem cert.pem\n\tcat ca.pem >> cert.pem\n\nOnce you have the pem file, you can run:\n\n\tawk 1 ORS='\\\\n' cert.pem\n\nCopy the output and set it as the value of `SSL_CERT` or `DEFAULT_SSL_CERT`.\n\nAffinity and session stickiness\n-----------------------------------\n\nThere are tree method to setup affinity and sticky session:\n\n1. set `BALANCE=source` in your application service. When setting `source` method of balance, HAProxy will hash the client IP address and make sure that the same IP always goes to the same server.\n2. set `APPSESSION=`. use application session to determine which server a client should connect to. Possible value of `` could be `JSESSIONID len 52 timeout 3h`\n2. set `COOKIE=`. use application cookie to determine which server a client should connect to. Possible value of `` could be `SRV insert indirect nocache`\n\nCheck [HAProxy:appsession](http://cbonte.github.io/haproxy-dconv/configuration-1.5.html#4-appsession) and [HAProxy:cookie](http://cbonte.github.io/haproxy-dconv/configuration-1.5.html#4-cookie) for more information.\n\n\nUsage within Tutum\n------------------\n\nLaunch the service you want to load-balance using Tutum.\n\nThen, launch the load balancer. To do this, select \"Jumpstarts\", \"Proxies\" and select `tutum/haproxy`. During the \"Environment variables\" step of the wizard, link to the service created earlier (the name of the link is not important), and add \"Full Access\" API role (this will allow HAProxy to be updated dynamically by querying Tutum's API). If you are using `tutumcli`, or `stackfile`, please set `role` to `global`\n\nThat's it - the proxy container will start querying Tutum's API for an updated list of containers in the service and reconfigure itself automatically, including:\n\n* start/stop/terminate containers in the linked application services\n* start/stop/terminate/scale up/scale down/redeploy the linked application services\n* add new links to HAProxy\n* remove old links from HAProxy\n\nUse case scenarios\n------------------\n\n#### My webapp container exposes port 8080(or any other port), and I want the proxy to listen in port 80\n\nUse the following:\n\n docker run -d --link webapp:webapp -p 80:80 tutum/haproxy\n\n#### My webapp container exposes port 8080 and database ports 8083/8086, and I want the proxy to listen in port 80 without my database ports added to haproxy\n\n\tdocker run -d --link webapp:webapp -e EXCLUDE_PORTS 8803,8806 -p 80:80 tutum/haproxy\n\n#### My webapp container exposes port 8080(or any other port), and I want the proxy to listen in port 8080\n\nUse the following:\n\n docker run -d --link webapp:webapp -p 8080:80 tutum/haproxy\n\n#### I want the proxy to terminate SSL connections and forward plain HTTP requests to my webapp to port 8080(or any port)\n\nUse the following:\n\n\tdocker run -d -e SSL_CERT=\"YOUR_CERT_TEXT\" --name webapp tutum/hello-world\n\tdocker run -d --link webapp:webapp -p 443:443 -p 80:80 tutum/haproxy\n\nor\n\n docker run -d --link webapp:webapp -p 443:443 -p 80:80 -e DEFAULT_SSL_CERT=\"YOUR_CERT_TEXT\" tutum/haproxy\n\nThe certificate in `YOUR_CERT_TEXT` is a combination of private key followed by public certificate. Remember to put `\\n` between each line of the certificate. A way to do this, assuming that your certificate is stored in `~/cert.pem`, is running the following:\n\n docker run -d --link webapp:webapp -p 443:443 -p 80:80 -e DEFAULT_SSL_CERT=\"$(awk 1 ORS='\\\\n' ~/cert.pem)\" tutum/haproxy\n\n#### I want the proxy to terminate SSL connections and redirect HTTP requests to HTTPS\n\nUse the following:\n\n\tdocker run -d -e FORCE_SSL=yes -e SSL_CERT=\"YOUR_CERT_TEXT\" --name webapp tutum/hello-world\n\tdocker run -d --link webapp:webapp -p 443:443 tutum/haproxy\n\n#### I want to set up virtual host routing by domain\n\nVirtual hosts can be configured by the proxy reading linked container environment variables (`VIRTUAL_HOST`). Here is an example:\n\n docker run -d -e VIRTUAL_HOST=\"www.webapp1.com, www.webapp1.org\" --name webapp1 tutum/hello-world\n docker run -d -e VIRTUAL_HOST=www.webapp2.com --name webapp2 your/webapp2\n docker run -d --link webapp1:webapp1 --link webapp2:webapp2 -p 80:80 tutum/haproxy\n\nIn the example above, when you access `http://www.webapp1.com` or `http://www.webapp1.org`, it will show the service running in container `webapp1`, and `http://www.webapp2.com` will go to container `webapp2`.\n\nIf you use the following:\n\n docker run -d -e VIRTUAL_HOST=www.webapp1.com --name webapp1 tutum/hello-world\n docker run -d -e VIRTUAL_HOST=www.webapp2.com --name webapp2-1 tutum/hello-world\n docker run -d -e VIRTUAL_HOST=www.webapp2.com --name webapp2-2 tutum/hello-world\n docker run -d --link webapp1:webapp1 --link webapp2-1:webapp2-1 --link webapp2-2:webapp2-2 -p 80:80 tutum/haproxy\n\nWhen you access `http://www.webapp1.com`, it will show the service running in container `webapp1`, and `http://www.webapp2.com` will go to both containers `webapp2-1` and `webapp2-2` using round robin (or whatever is configured in `BALANCE`).\n\n#### I want all my `*.node.io` domains point to my service\n\n docker run -d -e VIRTUAL_HOST=\"*.node.io\" --name webapp tutum/hello-world\n docker run -d --link webapp:webapp -p 80:80 tutum/haproxy\n\n##### I want all the requests to path `/path` point to my service\n\n\tdocker run -d -e VIRTUAL_HOST=\"*/path, */path/*\" --name webapp tutum/hello-world\n docker run -d --link webapp:webapp -p 80:80 tutum/haproxy\n\n##### I want all the static html request point to my service\n\n\tdocker run -d -e VIRTUAL_HOST=\"*/*.htm, */*.html\" --name webapp tutum/hello-world\n docker run -d --link webapp:webapp -p 80:80 tutum/haproxy\n\n#### I want to see stats of HAProxy\n\n\tdocker run -d --link webapp:webapp -e STATS_AUTH=\"auth:auth\" -e STATS_PORT=1936 -p 80:80 -p 1936:1936 tutum/haproxy\n\n#### I want to send all my logs to papertrailapp\n\nReplace `` and `` with your the values matching your papertrailapp account:\n\n docker run -d --name web1 tutum/hello-world\n docker run -d --name web2 tutum/hello-world\n docker run -it --env RSYSLOG_DESTINATION='.papertrailapp.com:' -p 80:80 --link web1:web1 --link web2:web2 tutum/haproxy\n\nTopologies using virtual hosts\n------------------------------\n\nWithin Tutum:\n\n |---- container 1\n |----- service 1 ----- |---- container 2\n | (virtual host 1) |---- container 3\n internet --- tutum/haproxy--- |\n | |---- container a\n |----- service 2 ----- |---- container b\n (virtual host 2) |---- container c\n\n\nOutside Tutum (any Docker server):\n\n |---- container 1 (virtual host 1)\n |---- container 2 (virtual host 1)\n |---- container 3 (virtual host 1)\n internet --- tutum/haproxy--- |\n |---- container a (virtual host 2)\n |---- container b (virtual host 2)\n |---- container c (virtual host 2)\n","has_starred","hub_user","immutable_tags_settings",{"_75":11,"_76":77},"enabled","rules",[78],".*","is_automated","permissions",{"_82":21,"_83":11,"_84":11},"read","write","admin","user","storage_size",913554387,"orgData",{"_90":91,"_92":93,"_94":95,"_96":33,"_97":98,"_99":100,"_101":102,"_103":104,"_105":106,"_107":48,"_108":48,"_109":48,"_110":21},"id","6c5f0d63653f4cb484a3e9601e918e33","uuid","6c5f0d63-653f-4cb4-84a3-e9601e918e33","type","organization","orgname","full_name","Impulse Cloud","location","Australia","company","Impulse Cloud Pty Ltd","profile_url","http://impulsecloud.com.au","date_joined","2015-06-24T02:22:41.882649Z","gravatar_url","gravatar_email","badge","is_active","recentTags",[113],{"_114":44,"_115":116,"_117":118,"_119":120,"_90":121,"_122":123,"_50":138,"_139":140,"_141":142,"_143":56,"_57":144,"_145":146,"_147":129,"_148":138,"_149":66,"_150":21},"content_type","creator",346993,"digest","sha256:ea7e672d824f99be91bd8900d43904ab2526fd9d9cab4fc0380e40e88342df05","full_size",213517682,440621,"images",[124],{"_125":126,"_117":118,"_127":48,"_128":129,"_130":131,"_132":48,"_133":48,"_134":-5,"_135":136,"_63":66,"_137":-5},"architecture","amd64","features","last_pulled","2026-10-13T21:18:27.329378648Z","last_pushed","2015-08-31T03:57:24Z","os","os_features","os_version","size",213518226,"variant","2015-08-31T03:57:25Z","last_updater",347067,"last_updater_username","gavinhodge","media_type","latest","repository",237603,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"selectedTag","attestationsUrl","routes/_layout.r.$namespace.$reponame.tags",{"_38":164,"_171":172,"_158":181,"_182":11},{"_40":165,"_42":166,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":167,"_57":35,"_32":33,"_58":59,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":168,"_79":21,"_80":170,"_85":33,"_86":87},[],[44],[56],{"_75":11,"_76":169},[78],{"_82":21,"_83":11,"_84":11},"tags",{"_173":64,"_174":-5,"_175":-5,"_176":177},"count","next","previous","results",[178],{"_114":44,"_115":116,"_117":118,"_119":120,"_90":121,"_122":179,"_50":138,"_139":140,"_141":142,"_143":56,"_57":144,"_145":146,"_147":129,"_148":138,"_149":66,"_150":21},[180],{"_125":126,"_117":118,"_127":48,"_128":129,"_130":131,"_132":48,"_133":48,"_134":-5,"_135":136,"_63":66,"_137":-5},[],"canDeleteTags","actionData","errors"]

impulsecloud/ic-haproxy

Tags for impulsecloud/ic-haproxy