blob: dd80b64852cf4f2f75479fa22b9209c480eb86fc [file] [log] [blame]
Willy Tarreau7f332732018-12-16 22:27:15 +01001Installation instructions for HAProxy
2=====================================
3
Willy Tarreaua2913be2019-06-17 13:35:23 +02004This is a development version, so it is expected to break from time to time,
5to add and remove features without prior notification and it should not be used
6in production. If you are not used to build from sources or if you are not used
7to follow updates then it is recommended that instead you use the packages
8provided by your software vendor or Linux distribution. Most of them are taking
9this task seriously and are doing a good job at backporting important fixes. If
10for any reason you'd prefer to use a different version than the one packaged
11for your system, you want to be certain to have all the fixes or to get some
12commercial support, other choices are available at http://www.haproxy.com/.
Willy Tarreau7f332732018-12-16 22:27:15 +010013
14
15Areas covered in this document
16==============================
17
181) Quick build & install
192) Basic principles
203) Build environment
214) Dependencies
225) Advanced build options
236) How to install HAProxy
24
25
261) Quick build & install
27========================
28
29If you've already built HAProxy and are just looking for a quick reminder, here
30are a few build examples :
31
32 - recent Linux system with all options, make and install :
33 $ make clean
Willy Tarreaud254aa82019-06-14 18:40:48 +020034 $ make -j $(nproc) TARGET=linux-glibc \
Willy Tarreau7f332732018-12-16 22:27:15 +010035 USE_OPENSSL=1 USE_ZLIB=1 USE_LUA=1 USE_PCRE=1 USE_SYSTEMD=1
36 $ sudo make install
37
38 - FreeBSD and OpenBSD, build with all options :
39 $ gmake -j 4 TARGET=freebsd USE_OPENSSL=1 USE_ZLIB=1 USE_LUA=1 USE_PCRE=1
40
41 - embedded Linux, build using a cross-compiler :
Willy Tarreaud254aa82019-06-14 18:40:48 +020042 $ make -j $(nproc) TARGET=linux-glibc USE_OPENSSL=1 USE_SLZ=1 USE_PCRE=1 \
43 CC=/opt/cross/gcc730-arm/bin/gcc ADDLIB=-latomic
Willy Tarreau7f332732018-12-16 22:27:15 +010044
45 - Build with static PCRE on Solaris / UltraSPARC :
46 $ make TARGET=solaris CPU=ultrasparc USE_STATIC_PCRE=1
47
48For more advanced build options or if a command above reports an error, please
49read the following sections.
50
51
522) Basic principles
53===================
54
55HAProxy uses a single GNU Makefile which supports options on the command line,
56so that there is no need to hack a "configure" file to work on your system. The
57makefile totally supports parallel build using "make -j <jobs>" where <jobs>
58matches the number of usable processors, which on some platforms is returned by
59the "nproc" utility. The explanations below may occasionally refer to some
60options, usually in the form "name=value", which have to be passed to the
61command line. This means that the option has to be passed after the "make"
62command. For example :
63
64 $ make -j $(nproc) TARGET=generic USE_GZIP=1
65
66One required option is TARGET, it must be set to a target platform name, which
67provides a number of presets. The list of known platforms is displayed when no
68target is specified. It is not strictly required to use the exact target, you
69can use a relatively similar one and adjust specific variables by hand.
70
71Most configuration variables are in fact booleans. Some options are detected and
72enabled by default if available on the target platform. This is the case for all
73those named "USE_<feature>". These booleans are enabled by "USE_<feature>=1"
74and are disabled by "USE_<feature>=" (with no value). The last occurrence on the
75command line overrides any previous one. Example :
76
77 $ make TARGET=generic USE_THREAD=
78
79In case of error or missing TARGET, a help screen is displayed. It is also
80possible to display a list of all known options using "make help".
81
82
833) Build environment
84====================
85
86HAProxy requires a working GCC or Clang toolchain and GNU make :
87
88 - GNU make >= 3.80. Note that neither Solaris nor OpenBSD's make work with
89 the GNU Makefile. If you get many syntax errors when running "make", you
90 may want to retry with "gmake" which is the name commonly used for GNU make
91 on BSD systems.
92
93 - GCC >= 3.4 (up to 8.1 tested). Older versions can be made to work with a
94 few minor adaptations if really needed. Newer versions may sometimes break
95 due to compiler regressions or behaviour changes. The version shipped with
96 your operating system is very likely to work with no trouble. Clang >= 3.0
97 is also known to work as an alternative solution. Recent versions may emit
98 a bit more warnings that are worth reporting.
99
100 - GNU ld (binutils package), with no particular version. Other linkers might
101 work but were not tested.
102
103On debian or Ubuntu systems and their derivatives, you may get all these tools
104at once by issuing the two following commands :
105
106 $ sudo apt-get update
107 $ sudo apt-get install build-essential
108
109On Fedora, CentOS, RHEL and derivatives, you may get the equivalent packages
110with the following command :
111
112 $ sudo yum groupinstall "Development Tools"
113
114Please refer to your operating system's documentation for other systems.
115
116It is also possible to build HAProxy for another system or platform using a
117cross-compiler but in this case you probably already have installed these
118tools.
119
120Building HAProxy may require between 10 and 40 MB of free space in the
121directory where the sources have been extracted, depending on the debugging
122options involved.
123
124
1254) Dependencies
126===============
127
128HAProxy in its basic form does not depend on anything beyond a working libc.
129However a number of options are enabled by default, or are highly recommended,
130and these options will typically involve some external components or libraries,
131depending on the targetted platform.
132
133Optional dependencies may be split into several categories :
134
135 - memory allocation
136 - regular expressions
137 - multi-threading
138 - password encryption
139 - cryptography
140 - compression
141 - lua
142 - device detection
143 - miscellaneous
144
145
1464.1) Memory allocation
147----------------------
148By default, HAProxy uses the standard malloc() call provided by the libc. It
Willy Tarreauc3643512019-03-27 14:20:43 +0100149may also be built to use jemalloc, which is fast and thread-safe. In order to
150use it, please add "-ljemalloc" to the ADDLIB variable. You may possibly also
151need to append "-lpthread" and/or "-ldl" depending on the operating system.
Willy Tarreau7f332732018-12-16 22:27:15 +0100152
153
1544.2) Regular expressions
155------------------------
156HAProxy may make use regular expressions (regex) to match certain patterns. The
157regex engine is provided by default in the libc. On some operating systems, it
158might happen that the original regex library provided by the libc is too slow,
159too limited or even bogus. For example, on older Solaris versions up to 8, the
160default regex used not to properly extract group references, without reporting
161compilation errors. Also, some early versions of the GNU libc used to include a
162regex engine which could be slow or even crash on certain patterns.
163
164If you plan on importing a particularly heavy configuration involving a lot of
165regex, you may benefit from using some alternative regex implementations sur as
166PCRE. HAProxy natively supports PCRE and PCRE2, both in standard and JIT
167flavors (Just In Time). The following options are available depending on the
168library version provided on your system :
169
170 - "USE_PCRE=1" : enable PCRE version 1, dynamic linking
171 - "USE_STATIC_PCRE=1" : enable PCRE version 1, static linking
172 - "USE_PCRE_JIT=1" : enable PCRE version 1 in JIT mode
173 - "USE_PCRE2=1" : enable PCRE version 2, dynamic linking
174 - "USE_STATIC_PCRE2=1" : enable PCRE version 2, static linking
175 - "USE_PCRE2_JIT=1" : enable PCRE version 2 in JIT mode
176
177Both of these libraries may be downloaded from https://www.pcre.org/.
178
179By default, the include and library paths are figured from the "pcre-config"
180and "pcre2-config" utilities. If these ones are not installed or inaccurate
181(for example when cross-compiling), it is possible to force the path to include
182files using "PCRE_INC" and "PCRE2_INC" respectively, and the path to library
183files using "PCRE_LIB" and "PCRE2_LIB" respectively. For example :
184
185 $ make TARGET=generic \
186 USE_PCRE2_JIT=1 PCRE2_INC=/opt/cross/include PCRE2_LIB=/opt/cross/lib
187
188
1894.3) Multi-threading
190--------------------
191On some systems for which positive feedback was reported, multi-threading will
192be enabled by default. When multi-threading is used, the libpthread library
193(POSIX threading) will be used. If the target system doesn't contain such a
194library, it is possible to forcefully disable multi-threading by adding
195"USE_THREAD=" on the command line.
196
197
1984.4) Password encryption
199------------------------
200Many systems provide password encryption functions used for authentication. On
201some systems these functions are part of the libc. On others, they're part of a
202separate library called "libcrypt". The default targets are pre-configured
203based on which system needs the library. It is possible to forcefully disable
204the linkage against libcrypt by adding "USE_LIBCRYPT=" on the command line, or
205to forcefully enable it using "USE_LIBCRYPT=1".
206
207
2084.5) Cryptography
209-----------------
210For SSL/TLS, it is necessary to use a cryptography library. HAProxy currently
211supports the OpenSSL library, and is known to build ant work with branches
2120.9.8, 1.0.0, 1.0.1, 1.0.2, 1.1.0 and 1.1.1. OpenSSL follows a long-term
213support cycle similar to HAProxy's, and each of the branches above receives its
214own fixes, without forcing you to upgrade to another branch. There is no excuse
215for staying vulnerable by not applying a fix available for your version. There
216is always a small risk of regression when jumping from one branch to another
217one, especially when it's very new, so it's preferable to observe for a while
218if you use a different version than your system's defaults.
219
220Two OpenSSL derivatives called LibreSSL and BoringSSL are reported to work as
221well. While there are some efforts from the community to ensure they work well,
222OpenSSL remains the primary target and this means that in case of conflicting
223choices, OpenSSL support will be favored over other options.
224
225In order to enable SSL/TLS support, simply pass "USE_OPENSSL=1" on the command
226line and the default library present on your system will be used :
227
228 $ make TARGET=generic USE_OPENSSL=1
229
230If you want to use a different version from the one provided by your system
231(which is not recommended due to the risk of missing security fixes), it is
232possible to indicate the path to the SSL include files using SSL_INC, and the
233SSL library files using SSL_LIB. Example :
234
235 $ make TARGET=generic \
236 USE_OPENSSL=1 SSL_INC=/opt/ssl-1.1.1/include SSL_LIB=/opt/ssl-1.1.1/lib
237
238In order to link OpenSSL statically against HAProxy, first download OpenSSL
239from https://www.openssl.org/ then build it with the "no-shared" keyword and
240install it to a local directory, so your system is not affected :
241
242 $ export STATICLIBSSL=/tmp/staticlibssl
243 $ ./config --prefix=$STATICLIBSSL no-shared
244 $ make && make install_sw
245
246Then when building haproxy, pass that path via SSL_INC and SSL_LIB :
247
248 $ make TARGET=generic \
249 USE_OPENSSL=1 SSL_INC=$STATICLIBSSL/include SSL_LIB=$STATICLIBSSL/lib
250
251When building with OpenSSL on some systems, you may also need to enable support
252for the "libz" library, which is visible if the linker complains about function
253"deflateInit()" not being found. In this case, simply append "ADDLIB=-lz" to
254the command line.
255
256It is worth mentioning that asynchronous cryptography engines are supported on
257OpenSSL 1.1.0 and above. Such engines are used to access hardware cryptography
258acceleration that might be present on your system.
259
260
2614.6) Compression
262----------------
263HAProxy can compress HTTP responses before delivering them to clients, in order
264to save network bandwidth. Two compression options are available. The first one
265involves the widely known zlib library, which is very likely installed on your
266system. In order to use zlib, simply pass "USE_ZLIB=1" to the command line. If
267the library is not installed in your default system's path, it is possible to
268specify the path to the include files using ZLIB_INC, and the path to the
269library files using ZLIB_LIB :
270
271 $ make TARGET=generic \
272 USE_ZLIB=1 ZLIB_INC=/opt/zlib-1.2.11/include ZLIB_LIB=/opt/zlib-1.2.11/lib
273
274However, zlib maintains an in-memory context for each compressed stream, which
275is not always welcome when dealing with large sites. An alternative solution is
276to use libslz instead, which doesn't consume memory, which is much faster, but
277compresses slightly less efficiently. For this, please use "USE_SLZ=1", and
278optionally make "SLZ_INC" and "SLZ_LIB" point to the library's include and
279library paths, respectively.
280
281Zlib is commonly found on most systems, otherwise updates can be retrieved from
282http://www.zlib.net/. It is easy and fast to build, and new versions sometimes
283provide better performance so it might be worth using an up-to-date one. Libslz
284can be downloaded http://libslz.org/ and is even easier to build.
285
286
2874.7) Lua
288--------
289Lua is an embedded programming langage supported by HAProxy to provide more
290advanced scripting capabilities. Only versions 5.3 and above are supported.
291In order to enable Lua support, please specify "USE_LUA=1" on the command line.
292Some systems provide this library under various names to avoid conflicts with
293previous versions. By default, HAProxy looks for "lua5.3", "lua53", "lua". If
294your system uses a different naming, you may need to set the library name in
295the "LUA_LIB_NAME" variable.
296
297If Lua is not provided on your system, it can be very simply built locally. It
298can be downloaded from https://www.lua.org/, extracted and built, for example :
299
300 $ cd /opt/lua-5.3.5
301 $ make linux
302
303The path to the include files and library files may be set using "LUA_INC" and
304"LUA_LIB" respectively. For example :
305
306 $ make TARGET=generic \
307 USE_LUA=1 LUA_INC=/opt/lua-5.3.5/src LUA_LIB=/opt/lua-5.3.5/src
308
309
3104.8) Device detection
311---------------------
312HAProxy supports several device detection modules relying on third party
313products. Some of them may provide free code, others free libs, others free
314evaluation licenses. Please read about their respective details in the
315following files :
316
317 doc/DeviceAtlas-device-detection.txt for DeviceAtlas
318 doc/51Degrees-device-detection.txt for 51Degrees
Willy Tarreaub3cc9f22019-04-19 16:03:32 +0200319 doc/WURFL-device-detection.txt for Scientiamobile WURFL
Willy Tarreau7f332732018-12-16 22:27:15 +0100320
321
3224.9) Miscellaneous
323------------------
324Some systems have specificities. Usually these specificities are known and/or
325detected and properly set for you. If you need to adjust the behaviour, here
326are the extra libraries that may be referenced at build time :
327
328 - USE_RT=1 build with librt, which is sometimes needed on some systems
329 when using threads. It is set by default on Linux platforms,
330 and may be disabled using "USE_RT=" if your system doesn't
Willy Tarreau4703fdd2019-06-16 19:39:44 +0200331 have one. You may have to set it as well if you face an error
332 indicating that clock_gettime() was not found.
Willy Tarreau7f332732018-12-16 22:27:15 +0100333
334 - USE_DL=1 build with libdl, which is usually needed for Lua and OpenSSL
335 on Linux. It is automatically detected and may be disabled
336 using "USE_DL=", though it should never harm.
337
338 - USE_SYSTEMD=1 enables support for the sdnotify features of systemd,
339 allowing better integration with systemd on Linux systems
340 which come with it. It is never enabled by default so there
341 is no need to disable it.
342
Willy Tarreau4703fdd2019-06-16 19:39:44 +02003434.10) Common errors
344-------------------
345Some build errors may happen depending on the options combinations or the
346selected target. When facing build errors, if you know that your system is a
347bit special or particularly old, start from TARGET=generic, it is easier to
348start from there and fix the remaining issues than trying to degrade another
349target. Common issues may include:
350
351 - clock_gettime() not found
352 => your system needs USE_RT=1
353
354 - __sync_sub_and_fetch undefined in cache.o
355 => your system needs either USE_PTHREAD_PSHARED=1 or USE_PRIVATE_CACHE=1
356
357 - many __sync_<something> errors in many files
358 => your gcc is too old, build without threads and with private cache.
359
360 - many openssl errors
361 => your OpenSSL version really is too old, do not enable OpenSSL
362
Willy Tarreau7f332732018-12-16 22:27:15 +0100363
3645) How to build HAProxy
365=======================
366
367This section assumes that you have already read section 2 (basic principles)
368and section 3 (build environment). It often refers to section 4 (dependencies).
369
370To build haproxy, you have to choose your target OS amongst the following ones
371and assign it to the TARGET variable :
372
Willy Tarreaud254aa82019-06-14 18:40:48 +0200373 - linux-glibc for Linux kernel 2.6.28 and above
Willy Tarreau7f332732018-12-16 22:27:15 +0100374 - solaris for Solaris 8 or 10 (others untested)
375 - freebsd for FreeBSD 5 to 12 (others untested)
376 - netbsd for NetBSD
377 - osx for Mac OS/X
378 - openbsd for OpenBSD 5.7 and above
379 - aix51 for AIX 5.1
380 - aix52 for AIX 5.2
381 - cygwin for Cygwin
382 - haiku for Haiku
383 - generic for any other OS or version.
384 - custom to manually adjust every setting
385
386You may also choose your CPU to benefit from some optimizations. This is
387particularly important on UltraSparc machines. For this, you can assign
388one of the following choices to the CPU variable :
389
390 - i686 for intel PentiumPro, Pentium 2 and above, AMD Athlon (32 bits)
391 - i586 for intel Pentium, AMD K6, VIA C3.
392 - ultrasparc : Sun UltraSparc I/II/III/IV processor
393 - native : use the build machine's specific processor optimizations. Use with
394 extreme care, and never in virtualized environments (known to break).
395 - generic : any other processor or no CPU-specific optimization. (default)
396
397Alternatively, you may just set the CPU_CFLAGS value to the optimal GCC options
398for your platform. A second variable named SMALL_OPTS also supports passing a
399number of defines and compiler options usually for small systems. For better
400clarity it's recommended to pass the options which result in a smaller binary
401(like memory limits or -Os) into this variable.
402
403If you are building for a different system than the one you're building on,
404this is called "cross-compiling". HAProxy supports cross-compilation pretty
405well and tries to ease it by letting you adjust paths to all libraries (please
406read section 4 on dependencies for more details). When cross-compiling, you
407just need to pass the path to your compiler in the "CC" variable, and the path
408to the linker in the "LD" variable. Most of the time, setting the CC variable
409is enough since LD points to it by default.
410
411By default the build process runs in quiet mode and hide the details of the
412commands that are executed. This allows to more easily catch build warnings
413and see what is happening. However it is not convenient at all to observe what
414flags are passed to the compiler nor what compiler is involved. Simply append
415"V=1" to the "make" command line to switch to verbose mode and display the
416details again. It is recommended to use this option when cross-compiling to
417verify that the paths are correct and that /usr/include is never invovled.
418
419You may want to build specific target binaries which do not match your native
420compiler's target. This is particularly true on 64-bit systems when you want
421to build a 32-bit binary. Use the ARCH variable for this purpose. Right now
422it only knows about a few x86 variants (i386,i486,i586,i686,x86_64), two
423generic ones (32,64) and sets -m32/-m64 as well as -march=<arch> accordingly.
424This variable is only used to set ARCH_FLAGS to preset values, so if you know
425the arch-specific flags that your system needs, you may prefer to set
426ARCH_FLAGS instead. Note that these flags are passed both to the compiler and
427to the linker. For example, in order to build a 32-bit binary on an x86_64
428Linux system with SSL support without support for compression but when OpenSSL
429requires ZLIB anyway :
430
Willy Tarreaud254aa82019-06-14 18:40:48 +0200431 $ make TARGET=linux-glibc ARCH=i386 USE_OPENSSL=1 ADDLIB=-lz
Willy Tarreau7f332732018-12-16 22:27:15 +0100432
433Recent systems can resolve IPv6 host names using getaddrinfo(). This primitive
434is not present in all libcs and does not work in all of them either. Support in
435glibc was broken before 2.3. Some embedded libs may not properly work either,
436thus, support is disabled by default, meaning that some host names which only
437resolve as IPv6 addresses will not resolve and configs might emit an error
438during parsing. If you know that your OS libc has reliable support for
439getaddrinfo(), you can add USE_GETADDRINFO=1 on the make command line to enable
440it. This is the recommended option for most Linux distro packagers since it's
441working fine on all recent mainstream distros. It is automatically enabled on
442Solaris 8 and above, as it's known to work.
443
444If your system supports PCRE (Perl Compatible Regular Expressions), then you
445really should build with libpcre which is between 2 and 10 times faster than
446other libc implementations. Regex are used for header processing (deletion,
447rewriting, allow, deny). Please see section 4 about dependencies to figure
448how to build with PCRE support.
449
450It is possible to add native support for SSL, by passing "USE_OPENSSL=1" on the
451make command line. The libssl and libcrypto will automatically be linked with
452HAProxy. Some systems also require libz, so if the build fails due to missing
453symbols such as deflateInit(), then try again with "ADDLIB=-lz". Please check
454section 4 about dependencies for more information on how to build with OpenSSL.
455
456HAProxy can compress HTTP responses to save bandwidth. Please see section 4
457about dependencies to see the available libraries and associated options.
458
459By default, the DEBUG variable is set to '-g' to enable debug symbols. It is
460not wise to disable it on uncommon systems, because it's often the only way to
461get a usable core when you need one. Otherwise, you can set DEBUG to '-s' to
462strip the binary.
463
464If the ERR variable is set to any non-empty value, then -Werror will be added
465to the compiler so that any build warning will trigger an error. This is the
466recommended way to build when developing, and it is expected that contributed
467patches were tested with ERR=1.
468
469The SSL stack supports session cache synchronization between all running
470processes. This involves some atomic operations and synchronization operations
471which come in multiple flavors depending on the system and architecture :
472
473 Atomic operations :
474 - internal assembler versions for x86/x86_64 architectures
475
476 - gcc builtins for other architectures. Some architectures might not
477 be fully supported or might require a more recent version of gcc.
478 If your architecture is not supported, you willy have to either use
479 pthread if supported, or to disable the shared cache.
480
481 - pthread (posix threads). Pthreads are very common but inter-process
482 support is not that common, and some older operating systems did not
483 report an error when enabling multi-process mode, so they used to
484 silently fail, possibly causing crashes. Linux's implementation is
485 fine. OpenBSD doesn't support them and doesn't build. FreeBSD 9 builds
486 and reports an error at runtime, while certain older versions might
487 silently fail. Pthreads are enabled using USE_PTHREAD_PSHARED=1.
488
489 Synchronization operations :
490 - internal spinlock : this mode is OS-independent, light but will not
491 scale well to many processes. However, accesses to the session cache
492 are rare enough that this mode could certainly always be used. This
493 is the default mode.
494
495 - Futexes, which are Linux-specific highly scalable light weight mutexes
496 implemented in user-space with some limited assistance from the kernel.
497 This is the default on Linux 2.6 and above and is enabled by passing
498 USE_FUTEX=1
499
500 - pthread (posix threads). See above.
501
502If none of these mechanisms is supported by your platform, you may need to
503build with USE_PRIVATE_CACHE=1 to totally disable SSL cache sharing. Then it
504is better not to run SSL on multiple processes. Note that you don't need these
505features if you only intend to use multi-threading and never multi-process.
506
507If you need to pass other defines, includes, libraries, etc... then please
508check the Makefile to see which ones will be available in your case, and
509use/override the USE_* variables from the Makefile.
510
511AIX 5.3 is known to work with the generic target. However, for the binary to
512also run on 5.2 or earlier, you need to build with DEFINE="-D_MSGQSUPPORT",
513otherwise __fd_select() will be used while not being present in the libc, but
514this is easily addressed using the "aix52" target. If you get build errors
515because of strange symbols or section mismatches, simply remove -g from
516DEBUG_CFLAGS.
517
518You can easily define your own target with the GNU Makefile. Unknown targets
519are processed with no default option except USE_POLL=default. So you can very
520well use that property to define your own set of options. USE_POLL can even be
521disabled by setting USE_POLL="". For example :
522
523 $ gmake TARGET=tiny USE_POLL="" TARGET_CFLAGS=-fomit-frame-pointer
524
525If you need to pass some defines to the preprocessor or compiler, you may pass
526them all in the DEFINE variable. Example:
527
528 $ make TARGET=generic DEFINE="-DDEBUG_DONT_SHARE_POOLS -DDEBUG_MEMORY_POOLS"
529
530The ADDINC variable may be used to add some extra include paths; this is
531sometimes needed when cross-compiling. Similarly the ADDLIB variable may be
532used to specifify extra paths to library files. Example :
533
534 $ make TARGET=generic ADDINC=-I/opt/cross/include ADDLIB=-L/opt/cross/lib64
535
536
5376) How to install HAProxy
538=========================
539
540To install haproxy, you can either copy the single resulting binary to the
541place you want, or run :
542
543 $ sudo make install
544
545If you're packaging it for another system, you can specify its root directory
546in the usual DESTDIR variable.
547
548-- end