Home / server / Questions / 1007306
Accepted
SunSparc
Asked: 2020-03-18 12:30:03 +0800 CST

haproxy: Can I annotate an IP whitelist file?

  • 772

In my "/etc/haproxy/haproxy.cfg" file, I specify a whitelist file that contains IP addresses that are permitted to access a frontend.

frontend default-frontend
    <snip>

    tcp-request connection reject if ! { src -f /etc/haproxy/templates/ip-whitelist.txt }

    <snip>

The contents of "/etc/haproxy/templates/ip-whitelist.txt" look like this:

192.45.21.89/32
123.34.33.7/32
56.23.12.77/32
78.12.66.3/32

This works great! Until I want to clean up the file and remove IPs for people who no longer need access.

Question: Is it possible to add comments to an haproxy template file?

I have tried this:

192.45.21.89/32 # Dylan Reeve
123.34.33.7/32 # Jane Doe
56.23.12.77/32 # Priscilla Ahmed
78.12.66.3/32 # Sayed Salas

... which returns errors similar to:

[ALERT] : parsing [/etc/haproxy/haproxy.cfg:123] : 'tcp-request connection reject' :
    error detected in frontend 'default-frontend' while parsing 'if' condition : 
    '192.45.21.89/32 # Dylan Reeve' is not a valid IPv4 or IPv6 address
    at line 1 of file '/etc/haproxy/templates/ip-whitelist.txt'
[ALERT] : Error(s) found in configuration file : /etc/haproxy/haproxy.cfg
[ALERT] : Fatal errors found in configuration.

Worst case scenario: I have to keep separate list in another location to match IPs with names.

configuration haproxy

1 Answers

  1. Best Answer

    As per HAProxy v1.8 documentation, this should work:

    # Dylan Reeve
192.45.21.89/32
# Jane Doe
123.34.33.7/32
...

    Taken from 1.8 docs (I've been doing this on 1.6 as well):

    The "-f" flag is followed by the name of a file from which all lines will be read as individual values. It is even possible to pass multiple "-f" arguments if the patterns are to be loaded from multiple files. Empty lines as well as lines beginning with a sharp ('#') will be ignored. All leading spaces and tabs will be stripped. If it is absolutely necessary to insert a valid pattern beginning with a sharp, just prefix it with a space so that it is not taken for a comment.

    Or you could try using HAProxy maps which I think are complete overkill for your use case.

    • 2