RepoMirrors
/
haproxy
mirror of http://git.haproxy.org/git/haproxy.git/
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
haproxy/admin/systemd/haproxy.service.in

38 lines
1.3 KiB
SYSTEMD
Raw Normal View History

MEDIUM: add systemd service Signed-off-by: Marc-Antoine Perennou <Marc-Antoine@Perennou.com>
2013-02-13 08:28:50 +00:00
[Unit]
Description=HAProxy Load Balancer
BUG/MINOR: systemd: Wait for network to be online Change systemd service file to wait for network to be completely online. This solves two problems: If haproxy is configured to bind to IP address(es) that are not yet assigned, haproxy would previously fail. The workaround is to use "option transparent". If haproxy us configured to use a resolver to resolve servers via DNS, haproxy would previously fail due to the fact that the network is not fully online yet. This is the most compelling reason for this patch. Signed-off-by: Ryan O'Hara <rohara@redhat.com> Acked-by: Lukas Tribus <lukas@ltri.eu>
2020-06-15 16:34:54 +00:00
After=network-online.target
Wants=network-online.target
MEDIUM: add systemd service Signed-off-by: Marc-Antoine Perennou <Marc-Antoine@Perennou.com>
2013-02-13 08:28:50 +00:00
[Service]
MINOR: systemd: Use the variables from /etc/default/haproxy This will allow seamless upgrades from the sysvinit system while respecting any changes the users may have made. It will also make local configuration easier than overriding the systemd unit file. Note by Tim: This GPL-2 licensed patch was taken from the Debian project at [1]. It was slightly modified to cleanly apply, because HAProxy's default unit file does not include rsyslog.service as an 'After' dependency. Also the subject line was modified to include the proper subsystem and severity. This patch may be backported to 1.9. [1] https://salsa.debian.org/haproxy-team/haproxy/blob/master/debian/patches/haproxy.service-use-environment-variables.patch Co-authored-by: Tim Duesterhus <tim@bastelstu.be>
2019-05-06 11:00:52 +00:00
EnvironmentFile=-/etc/default/haproxy
MINOR: systemd: support /etc/sysconfig/ for redhat based distrib The patch "MINOR: systemd: Make use of master socket in systemd unit" introduces an environment file in /etc/default. Unfortunatly this is not supported on redhat-based system, so we add /etc/sysconfig/haproxy for that.
2019-05-07 12:00:33 +00:00
EnvironmentFile=-/etc/sysconfig/haproxy
MINOR: systemd: Make use of master socket in systemd unit Unless the EXTRAOPTS variable is overriden in /etc/default/haproxy the unit file will use the master socket by default. This patch may be backported to 1.9 and depends on MINOR: systemd: Use the variables from /etc/default/haproxy.
2019-05-06 11:00:53 +00:00
Environment="CONFIG=/etc/haproxy/haproxy.cfg" "PIDFILE=/run/haproxy.pid" "EXTRAOPTS=-S /run/haproxy-master.sock"
MINOR: systemd: Use the variables from /etc/default/haproxy This will allow seamless upgrades from the sysvinit system while respecting any changes the users may have made. It will also make local configuration easier than overriding the systemd unit file. Note by Tim: This GPL-2 licensed patch was taken from the Debian project at [1]. It was slightly modified to cleanly apply, because HAProxy's default unit file does not include rsyslog.service as an 'After' dependency. Also the subject line was modified to include the proper subsystem and severity. This patch may be backported to 1.9. [1] https://salsa.debian.org/haproxy-team/haproxy/blob/master/debian/patches/haproxy.service-use-environment-variables.patch Co-authored-by: Tim Duesterhus <tim@bastelstu.be>
2019-05-06 11:00:52 +00:00
ExecStart=@SBINDIR@/haproxy -Ws -f $CONFIG -p $PIDFILE $EXTRAOPTS
MEDIUM: systemd: be more verbose about the reload When the `haproxy -c` check during the reload fails, no error is output in the logs, this can be quite bothersome to understand what's going on. This patch removes the -q option on the check so we can see the error with `journalctl -u haproxy` or `systemctl status haproxy` This will change the behavior when the check works, and will display "Configuration file is valid" Note that in some case this test could be completely removed, because the master process loads the configuration itself and is able to keep the previous workers running when the reload failed. This is interesting to disable the test when there are a lot of certificates of files to load, to divide the reload time by 2. No need to backport.
2023-10-31 17:59:29 +00:00
ExecReload=@SBINDIR@/haproxy -Ws -f $CONFIG -c $EXTRAOPTS
MEDIUM: add systemd service Signed-off-by: Marc-Antoine Perennou <Marc-Antoine@Perennou.com>
2013-02-13 08:28:50 +00:00
ExecReload=/bin/kill -USR2 $MAINPID
BUG/MEDIUM: systemd: set KillMode to 'mixed' By default systemd will send SIGTERM to all processes in the service's control group. In our case, this includes the wrapper, the master process and all worker processes. Since commit c54bdd2a the wrapper actually catches SIGTERM and survives to see the master process getting killed by systemd and regard this as an error, placing the unit in a failed state during "systemctl stop". Since the wrapper now handles SIGTERM by itself, we switch the kill mode to 'mixed', which means that systemd will deliver the initial SIGTERM to the wrapper only, and if the actual haproxy processes don't exit after a given amount of time (default: 90s), a SIGKILL is sent to all remaining processes in the control group. See systemd.kill(5) for more information. This should also be backported to 1.5.
2014-10-08 12:14:41 +00:00
KillMode=mixed
MEDIUM: add systemd service Signed-off-by: Marc-Antoine Perennou <Marc-Antoine@Perennou.com>
2013-02-13 08:28:50 +00:00
Restart=always
MINOR: systemd: consider exit status 143 as successful The master process will exit with the status of the last worker. When the worker is killed with SIGTERM, it is expected to get 143 as an exit status. Therefore, we consider this exit status as normal from a systemd point of view. If it happens when not stopping, the systemd unit is configured to always restart, so it has no adverse effect. This has mostly a cosmetic effect. Without the patch, stopping HAProxy leads to the following status: ● haproxy.service - HAProxy Load Balancer Loaded: loaded (/lib/systemd/system/haproxy.service; disabled; vendor preset: enabled) Active: failed (Result: exit-code) since Fri 2018-06-22 20:35:42 CEST; 8min ago Docs: man:haproxy(1) file:/usr/share/doc/haproxy/configuration.txt.gz Process: 32715 ExecStart=/usr/sbin/haproxy -Ws -f $CONFIG -p $PIDFILE $EXTRAOPTS (code=exited, status=143) Process: 32714 ExecStartPre=/usr/sbin/haproxy -f $CONFIG -c -q $EXTRAOPTS (code=exited, status=0/SUCCESS) Main PID: 32715 (code=exited, status=143) After the patch: ● haproxy.service - HAProxy Load Balancer Loaded: loaded (/lib/systemd/system/haproxy.service; disabled; vendor preset: enabled) Active: inactive (dead) Docs: man:haproxy(1) file:/usr/share/doc/haproxy/configuration.txt.gz
2018-06-22 18:57:03 +00:00
SuccessExitStatus=143
MEDIUM: mworker: Add systemd `Type=notify` support This patch adds support for `Type=notify` to the systemd unit. Supporting `Type=notify` improves both starting as well as reloading of the unit, because systemd will be let known when the action completed. See this quote from `systemd.service(5)`: > Note however that reloading a daemon by sending a signal (as with the > example line above) is usually not a good choice, because this is an > asynchronous operation and hence not suitable to order reloads of > multiple services against each other. It is strongly recommended to > set ExecReload= to a command that not only triggers a configuration > reload of the daemon, but also synchronously waits for it to complete. By making systemd aware of a reload in progress it is able to wait until the reload actually succeeded. This patch introduces both a new `USE_SYSTEMD` build option which controls including the sd-daemon library as well as a `-Ws` runtime option which runs haproxy in master-worker mode with systemd support. When haproxy is running in master-worker mode with systemd support it will send status messages to systemd using `sd_notify(3)` in the following cases: - The master process forked off the worker processes (READY=1) - The master process entered the `mworker_reload()` function (RELOADING=1) - The master process received the SIGUSR1 or SIGTERM signal (STOPPING=1) Change the unit file to specify `Type=notify` and replace master-worker mode (`-W`) with master-worker mode with systemd support (`-Ws`). Future evolutions of this feature could include making use of the `STATUS` feature of `sd_notify()` to send information about the number of active connections to systemd. This would require bidirectional communication between the master and the workers and thus is left for future work.
2017-11-20 14:58:35 +00:00
Type=notify
MEDIUM: add systemd service Signed-off-by: Marc-Antoine Perennou <Marc-Antoine@Perennou.com>
2013-02-13 08:28:50 +00:00
MINOR: systemd: Add section for SystemD sandboxing to unit file This commit adds a warning for settings that possibly provide better sandboxing and explains their tradeoffs.
2018-02-27 19:19:03 +00:00
# The following lines leverage SystemD's sandboxing options to provide
# defense in depth protection at the expense of restricting some flexibility
# in your setup (e.g. placement of your configuration files) or possibly
# reduced performance. See systemd.service(5) and systemd.exec(5) for further
# information.
MINOR: systemd: Add SystemD's Protect*= options to the unit file While the haproxy workers usually are running chrooted the master process is not. This patch is a pretty safe defense in depth measure to ensure haproxy cannot touch sensitive parts of the file system. ProtectSystem takes non-boolean arguments in newer SystemD versions, but setting those would leave older systems such as Ubuntu Xenial unprotected. Distro maintainers and system administrators could adapt the ProtectSystem value to the SystemD version they ship.
2018-02-27 19:19:04 +00:00
# NoNewPrivileges=true
# ProtectHome=true
# If you want to use 'ProtectSystem=strict' you should whitelist the PIDFILE,
# any state files and any other files written using 'ReadWritePaths' or
# 'RuntimeDirectory'.
# ProtectSystem=true
# ProtectKernelTunables=true
# ProtectKernelModules=true
# ProtectControlGroups=true
MINOR: systemd: Add SystemD's SystemCallFilter option to the unit file This option takes away system calls that are unneeded for haproxy's operation and thus is a good defense in depth measure.
2018-02-27 19:19:05 +00:00
# If your SystemD version supports them, you can add: @reboot, @swap, @sync
# SystemCallFilter=~@cpu-emulation @keyring @module @obsolete @raw-io
MINOR: systemd: Add SystemD's Protect*= options to the unit file While the haproxy workers usually are running chrooted the master process is not. This patch is a pretty safe defense in depth measure to ensure haproxy cannot touch sensitive parts of the file system. ProtectSystem takes non-boolean arguments in newer SystemD versions, but setting those would leave older systems such as Ubuntu Xenial unprotected. Distro maintainers and system administrators could adapt the ProtectSystem value to the SystemD version they ship.
2018-02-27 19:19:04 +00:00
MEDIUM: add systemd service Signed-off-by: Marc-Antoine Perennou <Marc-Antoine@Perennou.com>
2013-02-13 08:28:50 +00:00
[Install]
WantedBy=multi-user.target