bluebluesodaandCommandCodeBot
4c93ae4be3
The panel now fronts user domains with HAProxy 3.4 LTS (official performance packages) instead of Traefik: about 100 MB of RSS and 200 MB of disk saved for a feature set that never used more than Host routing on :80 and SNI passthrough on :443. - hpx: publish the proxy configuration as immutable GENERATIONS. Every domain mutation renders the whole set from the DB, validates it with the pinned `haproxy -c`, and only then repoints the `current` symlink, so a rejected candidate leaves the running proxy untouched and a stale domain can never survive into a later generation. Routing is carried by two map files (Host -> backend, SNI -> backend): per-domain frontend rules cannot work from a second file because HAProxy rejects duplicate section names since 3.3 and attaches bare directives to the section opened last. - mgr: republish and reload (SIGUSR2, i.e. `systemctl reload`) after every domain change, so a change takes effect without dropping established HTTP or TLS connections. Rollback semantics (DB first, then publish) are unchanged. - cfg,db: `net.traefik` is renamed to `net.haproxy` with identical values. A pre-rename config.yaml key and the legacy VPSMGR_TRAEFIK env var are still read (new name wins), and schema migration v18 moves the settings mirror from `traefik` to `haproxy`, keeping a newer value when both rows exist. - 30-haproxy.sh: install the pinned branch from the vendor repository and migrate a Traefik host in one run — install and validate HAProxy first, then remove Traefik's binary, unit, service account and dynamic rules (only its config file is kept, inert). No fallback keeps both proxies alive. - upgrade-haproxy.sh: follow the pinned branch to its newest patch, with a configuration check and a graceful reload; `install.sh --update` runs it. - tests: generation publish/rollback, map rendering, config-key and settings migrations, plus real-binary tests (skipped unless VPSMGR_TEST_HAPROXY_BIN is set) that run the generated configuration through `haproxy -c` and start it in a network namespace. Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
42 lines
1.7 KiB
Desktop File
42 lines
1.7 KiB
Desktop File
# Managed by vpsmgr — installed file, do not edit by hand.
|
|
# Changes are overwritten on the next install.
|
|
#
|
|
# Installed to /etc/systemd/system/haproxy.service, which takes precedence over
|
|
# the unit the distribution's haproxy package ships in /lib/systemd/system.
|
|
# Exactly one unit may own 80/443.
|
|
[Unit]
|
|
Description=HAProxy domain proxy (vpsmgr)
|
|
Documentation=https://docs.haproxy.org/3.4/management.html
|
|
Wants=network-online.target
|
|
After=network-online.target
|
|
# The panel publishes generations under /etc/haproxy and reloads the service
|
|
# after a successful validation, so start after it if both are enabled.
|
|
After=vps.service
|
|
|
|
[Service]
|
|
# -Ws = master-worker mode speaking the systemd notify protocol:
|
|
# * the master process stays alive and owns the workers,
|
|
# * a reload (SIGUSR2 to the master) starts a new worker with the re-read
|
|
# configuration and lets the old one DRAIN established connections, which
|
|
# is why a published generation never drops a live HTTP or TLS connection,
|
|
# * `systemctl reload` therefore never has to restart the process.
|
|
# The configuration is the stable entry file, which includes
|
|
# /etc/haproxy/current/proxy.cfg — the generation the panel last published.
|
|
Type=notify
|
|
ExecStart=/usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy/haproxy.pid
|
|
ExecReload=/bin/kill -USR2 $MAINPID
|
|
# Send SIGUSR1 (graceful stop) to the master on `systemctl stop`: established
|
|
# connections are allowed to finish; hard-stop-after (see haproxy.cfg) is the
|
|
# upper bound. KillMode=mixed keeps systemd from SIGKILLing the workers while
|
|
# they drain.
|
|
KillSignal=SIGUSR1
|
|
KillMode=mixed
|
|
Restart=on-failure
|
|
RestartSec=3
|
|
RuntimeDirectory=haproxy
|
|
RuntimeDirectoryMode=0750
|
|
LimitNOFILE=65536
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|