Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.Sign up
Why Use a Proxy
If your network configuration restricted outbound traffic, you can proxy all agent traffic through one or several hosts that have more permissive outbound policies.
You have a few options to send traffic to StackState over SSL/TLS for hosts that are not directly connected to the internet.
- Using the agent as a proxy (for up to 16 agents per proxy)
- Using a web proxy (e.g. Squid, Microsoft Web Proxy) that is already deployed in your network
- Using HAProxy (if you want to proxy more than 16-20 agents through the same proxy)
Using the Agent as a Proxy
Designate one node that runs stackstate-agent as the proxy. In this example assume that the proxy name is
proxy-node. This node must be able to reach StackState on the location where you installed StackState.
Allow non-local traffic on
proxy-nodeby changing the following line in
# non_local_traffic: noshould read
proxy-nodecan be reached from the other nodes over port 17123. Start the agent on the
proxy-nodeand run on the other nodes:
curl -v http://proxy-node:17123/status 2>&1 | grep "200 OK"
Update non-proxy nodes to forward to
proxy-node. Simply change the following line in
Using a Web Proxy as Proxy
Traditional web proxies are supported natively by the agent. Simply
stackstate.conf with your proxy information.
# If you need a proxy to connect to the Internet, provide the settings here proxy_host: my-proxy.example.com proxy_port: 3128 proxy_user: my_user proxy_password: my_password
Do not forget to restart the agent for the new settings to take effect.
Using HAProxy as a Proxy
HAProxy is a free, very fast and reliable solution offering proxying for TCP and HTTP applications. While HAProxy is usually used as a load balancer to distribute incoming requests to pools servers, you can also use it to proxy agent traffic to StackState from hosts that have no outside connectivity.
This is the best option if you do not have a web proxy readily available in your network and you wish to proxy a large number of agents. In some cases a single HAProxy instance will be sufficient to handle local agent traffic in your network - each proxy can accommodate upwards of 1000 agents (be aware that this figure is a conservative estimate based on the performance of m3.xl instances specifically. Numerous network-related variables can influence load on proxies. As always, deploy under a watchful eye. Visit http://www.haproxy.org/#perf for additional information).
agent ---> haproxy ---> StackState
We assume that HAProxy is installed on a host that has connectivity to StackState. You can use the following configuration file if you do not already have it configured.
# Basic configuration global log 127.0.0.1 local0 maxconn 4096 stats socket /tmp/haproxy # Some sane defaults defaults log global option dontlognull retries 3 option redispatch timeout client 5s timeout server 5s timeout connect 5s # This declares a view into HAProxy statistics, on port 3835 # You do not need credentials to view this page and you can # turn it off once you are done with setup. listen stats :3835 mode http stats enable stats uri / # This declares the endpoint where your agents will connect. # In this example we use port 3834 but you can use any other # free port. frontend forwarder bind *:3834 # DTDG mode tcp default_backend stackstate # This is the StackState server. In effect any TCP request coming # to the forwarder frontend defined above will be proxied to # StackState's public endpoints. backend stackstate balance roundrobin mode tcp option tcplog server mothership haproxy-app.agent.stackstate.com:443 check port 80
Once the HAProxy configuration is in place, you can reload it or restart HAProxy.
We recommend having a
cron job that reloads HAProxy every 10 minutes (usually doing something like
service haproxy reload) to force a refresh of HAProxy's DNS cache, in case
StackState fails over to another IP.
Then edit each agent to point to HAProxy by setting its
the address of HAProxy (e.g. haproxy.example.com). This
setting can be found in
Before you restart the agent you will need to edit your supervisor configuration to disable SSL certificate verification. This is needed to prevent python from complaining about the discrepancy between the hostname on the SSL certificate and your HAProxy hostname.
You need to edit the supervisor configuration found at:
/etc/sts-agent/supervisor_stsagent.confon debian-based systems
/etc/sts-agent/supervisor.confon redhat-based systems
Assuming that file is found at
sed -i 's/stsagent.py/stsagent.py --sslcheck=0/' SUP_FILE
On Windows (Starting from agent 3.9.2):
You need to edit your configuration file (stackstate.conf) and add this option:
Finally restart the agent.
To verify that everything is working properly, you can review the HAProxy statistics at http://haproxy.example.com:3835