shrpx client mode and haproxy's health check

[nutinshell]

Configured haproxy like below:

backend nas mode http option httpchk GET / HTTP/1.1\r\nHost:\ www http-check expect rstatus 404|400|407 server test 127.0.0.1:89 #shrpx client

but when shrpx SPDY proxy server dead, client side still return 400 error code to haproxy, so the health check failed.

Is it correct to returen 5XX instead of 4XX when server side error, for example, server's shrpx or squid exit unexpected.

[tatsuhiro-t]

(Assuming -p/--client-proxy is used,) 400 error code is returned because the request-line does not contain absolute URI. It is syntax error and shrpx does not process the request and just returns 400 error code, without accessing backend. Therefore shrpx does not know the status of backend. If you want to forward request to backend, use absolute URI instead of just a path.

[nutinshell]

You mean config like:

option httpchk GET http://127.0.0.1:89/ HTTP/1.1\r\nHost:\ www

this will return " layer 7 invalid response - protocol error " when backend dead, return " layer 7 response error " when backend became alive back.

Anything I missed? Thanks.

[tatsuhiro-t]

Use 127.0.0.1:89 instead of www in Host header field like this:

option httpchk GET http://127.0.0.1:89/ HTTP/1.1\r\nHost:\ 127.0.0.1:89

The thing is shrpx uses host in Host header field to forward request to the backend squid

[nutinshell]

Thanks for the hint, that's a problem if haproxy had multiple backend servers like:

server test 127.0.0.1:89 #shrpx client
server test 127.0.0.1:90 #shrpx client2

so the

option httpchk GET http://127.0.0.1:89/ HTTP/1.1\r\nHost:\ 127.0.0.1:89

config could not check multiple servers, any idea?

[tatsuhiro-t]

I'm not squid master, but it seems squid returns 403 to well-known ports other than 80 (or possibly 443?), so you can specify those ports in httpchk. For example, (assuming port 999 is not used),

option httpchk GET http://127.0.0.1:999/ HTTP/1.1\r\nHost:\ 127.0.0.1:999

Please note that the above line is NOT check the status of 127.0.0.1:999. So I think it will work for multiple backend servers.

[nutinshell]

Thanks, that's really did the trick.