global
log /dev/log local0
log /dev/log local1 notice
chroot /var/lib/haproxy
stats socket /var/lib/haproxy/stats mode 660 level admin
stats timeout 30s
user haproxy
group haproxy
daemon
maxconn 65535
pidfile /var/run/haproxy.pid
nbproc 1
nbthread 4
cpu-map auto:1/1-4 0-3
tune.ssl.default-dh-param 2048
ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
ssl-default-bind-options ssl-min-ver TLSv1.2

defaults
log global
mode http
option httplog
option dontlognull
option http-server-close
option forwardfor except 127.0.0.0/8
option redispatch
retries 3
timeout connect 10s
timeout client 300s
timeout server 300s
timeout http-keep-alive 10s
timeout http-request 10s
timeout queue 1m
timeout check 5s
maxconn 3000

frontend http_front
bind *:80
mode http

# HTTP重定向到HTTPS
redirect scheme https code 301 if !{ ssl_fc }

# ACL规则
acl is_api path_beg /api
acl is_admin path_beg /admin

# 后端选择
use_backend api_servers if is_api
use_backend admin_servers if is_admin

frontend https_front
bind *:443 ssl crt /etc/haproxy/ssl/fgedu.pem alpn h2,http/1.1
mode http
option http-use-htx

# 安全头部
http-response set-header Strict-Transport-Security “max-age=31536000; includeSubDomains”
http-response set-header X-Frame-Options “SAMEORIGIN”
http-response set-header X-XSS-Protection “1; mode=block”
http-response set-header X-Content-Type-Options “nosniff”

# ACL规则
acl is_api path_beg /api
acl is_admin path_beg /admin
acl is_allowed src 192.168.1.0/24 10.0.0.0/8

# 访问控制
http-request deny if is_admin !is_allowed

# 后端选择
use_backend api_servers if is_api
use_backend admin_servers if is_admin
default_backend web_servers

backend web_servers
mode http
balance roundrobin
option httpchk GET /health HTTP/1.1\r\nHost:\ localhost
cookie SERVERID insert indirect nocache
server web01 192.168.1.53:80 check cookie s1 weight 3
server web02 192.168.1.54:80 check cookie s2 weight 2
server web03 192.168.1.55:80 check cookie s3 weight 1 backup

backend api_servers
mode http
balance roundrobin
option httpchk GET /api/health HTTP/1.1\r\nHost:\ localhost
server api01 192.168.1.53:8080 check weight 3
server api02 192.168.1.54:8080 check weight 2

backend admin_servers
mode http
balance roundrobin
option httpchk GET /admin/health HTTP/1.1\r\nHost:\ localhost
server admin01 192.168.1.53:9090 check
server admin02 192.168.1.54:9090 check backup

frontend stats
bind *:8404
mode http
stats enable
stats uri /haproxy-stats
stats refresh 10s
stats admin if LOCALHOST
stats auth admin:admin123
stats show-legends
stats show-node

! Configuration File for keepalived

global_defs {
router_id HAPROXY_MASTER
}

vrrp_script check_haproxy {
script “killall -0 haproxy”
interval 2
weight -20
fall 3
rise 2
}

vrrp_instance VI_1 {
state MASTER
interface eth0
virtual_router_id 51
priority 100
advert_int 1
authentication {
auth_type PASS
auth_pass fgedu2026
}
virtual_ipaddress {
192.168.1.100/24 dev eth0 label eth0:0
}
track_script {
check_haproxy
}
}

# Keepalived配置（Backup节点）
# vi /etc/keepalived/keepalived.conf

! Configuration File for keepalived

global_defs {
router_id HAPROXY_BACKUP
}

vrrp_script check_haproxy {
script “killall -0 haproxy”
interval 2
weight -20
fall 3
rise 2
}

vrrp_instance VI_1 {
state BACKUP
interface eth0
virtual_router_id 51
priority 90
advert_int 1
authentication {
auth_type PASS
auth_pass fgedu2026
}
virtual_ipaddress {
192.168.1.100/24 dev eth0 label eth0:0
}
track_script {
check_haproxy
}
}

# 启动Keepalived
# systemctl start keepalived
# systemctl enable keepalived

# 输出示例：
Server Software: nginx/1.24.0
Server Hostname: 192.168.1.100
Server Port: 80

Concurrency Level: 1000
Time taken for tests: 10.000 seconds
Complete requests: 100000
Failed requests: 0
Requests per second: 10000.00 [#/sec] (mean)
Time per request: 100.000 [ms] (mean)

# 查看HAProxy统计
$ curl -u admin:admin123 http://192.168.1.51:8404/haproxy-stats

# 输出示例：
# HAProxy Statistics Report
# pid: 12345
# uptime: 1d 2h 3m
# Total sessions: 100000
# Total bytes in: 5000000
# Total bytes out: 25000000