haproxy 随机响应状态码 503

Question

我知道这个标题有很多问题，但我尝试了所有解决方案，但没有任何运气。 我在 2 apache 前面有 haproxy，在 debian 9 中有另一个第三个独立服务器。 当我使用 https 尝试 mysite.com（配置文件中的 backend_g1）时，它总是响应 200。但是当我使用 http 访问它时（我在 haproxy 配置文件中将其替换为 https），有 503 随机回复！这是我的 haproxy.cfg：

global
    log /dev/log local0 notice
    log /dev/log local1 notice
    log 127.0.0.1   local2 notice
    chroot /var/lib/haproxy
    stats socket /run/haproxy/admin.sock mode 660 level admin
    stats timeout 30s
    user haproxy
    group haproxy
    maxconn 512 
    daemon

    # Default SSL material locations
    ca-base /etc/ssl/certs
    crt-base /etc/ssl/private

    ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS
    ssl-default-bind-options no-sslv3
    tune.ssl.default-dh-param 2048

defaults
    log global
    mode http
    option httplog
    option dontlognull
    maxconn 512
    timeout connect 5000
    timeout client  600000
    timeout server  600000
    errorfile 400 /etc/haproxy/errors/400.http
    errorfile 403 /etc/haproxy/errors/403.http
    errorfile 408 /etc/haproxy/errors/408.http
    errorfile 500 /etc/haproxy/errors/500.http
    errorfile 502 /etc/haproxy/errors/502.http
    errorfile 503 /etc/haproxy/errors/503.http
    errorfile 504 /etc/haproxy/errors/504.http

# HTTP Auth
userlist basic-auth-list
  group is-admin
  # Plaintext password
  user admin password $5$GnrqkuBdodw$./ groups is-admin

frontend stats
    bind *:8404
    stats enable
    stats uri /stats
    stats refresh 10s
    stats admin if LOCALHOST

frontend http-in
    bind *:80
    bind *:443 ssl crt /etc/ssl/mysite.com/mysite.com.pem
    mode http

    acl no_https ssl_fc,not
    http-request redirect scheme https code 307 if no_https

    acl g0_path path -i str /265952.txt
    acl g0_path path -i str /registerInfo.php
    acl g0_path path -i str /register
    acl g0_path path -i str /register/
    acl g0_path path_beg /icon/g0/
    acl g0_path path_beg /css/g0/
    acl g0_path path_beg /image/g0/
    acl g0_path path_beg /icon/favicon/
    acl g0_path path_beg /tool/
    acl g0_path path_beg /lib/
    acl g0_path path_beg /libs/
    acl g0_path path_beg /asset/
    acl g0_path path_beg /.well-known/
    acl g0_path path_beg /pay/
    acl g0_path path -i str /testing987.php

    acl mysite_shop_id path,map_str(/etc/haproxy/maps/mysite_shop_id.map) -m found
    http-request set-path /page?id=%[path,map(/etc/haproxy/maps/mysite_shop_id.map)] if { ssl_fc } mysite_shop_id 

    acl app_android_myshop path -i str /app/android/mysite-myshop.apk
    http-request set-path /download/mobile/android/mysite-myshop.apk if app_android_myshop
    acl g0_path path_beg /download/

    acl mysite_admin1234567890 path_beg /mysite_admin1234567890/

    use_backend backend_g0 if g0_path || app_android_myshop
    # use_backend backend_nama if nama_path
    use_backend backend_mysite_admin1234567890 if mysite_admin1234567890

    default_backend backend_g1

backend backend_g0
    balance roundrobin
    cookie SERVERID insert
    option http-keep-alive    
    timeout http-keep-alive 10s
    option forwardfor
    http-request set-header X-Forwarded-Port %[dst_port]
    http-request add-header X-Forwarded-Proto https if { ssl_fc }
    server g0 127.0.0.1:800 cookie g0

backend backend_mysite_admin1234567890
    acl devops-auth http_auth_group(basic-auth-list) is-admin
    http-request auth realm mysite_admin1234567890 unless devops-auth

    option      forwardfor
    server      mysite_admin1234567890    127.0.0.1:19999

    http-request set-path %[path,regsub(^/mysite_admin1234567890/,/)]

    http-request set-header Host %[src]
    http-request set-header X-Forwarded-For %[src]
    http-request set-header X-Forwarded-Port %[dst_port]
    http-request set-header Connection "keep-alive"

backend backend_g1
    cookie SERVERID insert
    option http-keep-alive    
    timeout http-keep-alive 20s
    option forwardfor
    http-request set-header X-Forwarded-Port %[dst_port]
    http-request add-header X-Forwarded-Proto https if { ssl_fc }
    server g1 127.0.0.1:8080 cookie g1

Answer 1

也许是个错误：

...
backend backend_g0
    balance roundrobin        # only on app at the end of this block
    cookie SERVERID insert
    option http-keep-alive    
    timeout http-keep-alive 10s
    option forwardfor
    http-request set-header X-Forwarded-Port %[dst_port]
    http-request add-header X-Forwarded-Proto https if { ssl_fc }
    server g0 127.0.0.1:800 cookie g0         # only one app
...

如果你之后只有一个应用，也许你应该删除balance roundrobin

然后

server g0 127.0.0.1:800 cookie g0 # wrong  port ?
server g1 127.0.0.1:8080 cookie g1