How Dashboard Gateway works

• You connect to Dashboard Gateway using the Real-Time Dashboard Web application. You can use HTTP BASIC authentication, which is secure enough when going through a SSL encrypted channel.

• The Dashboard Gateway connects to configured HAProxy instance(s) using either the Runtime API or the Dashboard Module running on the instance.

• The Gateway transfers statistics and other data to your browser from the instances, and it also relays any administrative actions you send from the Web application to the instances.

Setting up HAProxy instances

Each HAProxy instance that the Dashboard Gateway must access requires an admin socket interface exposed on a TCP port that is additionally protected by TLS encryption and network access control rules.

1. Enable stats socket in the global section, as follows:

   global
     stats socket {{ admin_unix_socket_path }} mode 660 level admin

   The default for admin_unix_socket_path is /run/haproxy/admin.sock.

2. Add a listener:

   listen admin_sock
       mode tcp
       bind {{ haproxy_ip }}:{{ admin_socket_port }} # additionally add: ssl crt {{ path_to_pem_file }}
       # for ACL add: acl  allow_admin_sock src {{ gateway_host_ip }}
       # for ACL add: tcp-request connection rejectif !allow_admin_sock
       server admin_sock1 unix@{{ admin_unix_socket_path }}

where:

• haproxy_ip and admin_socket_port are the address and port where the admin socket listens for TCP socket connections from Dashboard Gateway. The 'pem' file is a concatenated certificate and key file (in that order).

• gateway_host_ip is the IP address of the host running the node gateway as seen from the HAProxy server.

• admin_unix_socket_path is the same socket path given in the global section above.

Installing Dashboard Gateway

You obtain the Dashboard Gateway through the HAProxy Enterprise package repositories. You can consult the installation instructions on: User Guide and browse to the User Guide and then the installation instructions for your Linux distribution. The Dashboard Gateway is in the hapee-plus repository.

After you set up the repositories, you install hapee-1.9-lb-dashboard-gateway.

$ apt-get install hapee-1.9-lb-dashboard-gateway

$ yum install hapee-1.9-lb-dashboard-gateway

$ unzip hapee-rt-dashboard-gateway-{{ version }}-{{ commit_hash }}.zip
$ cp -fr ./dist/* /some/directory/

Running Dashboard Gateway

After you install Dashboard Gateway, you can run it from the application directory (typically, it is installed into /opt/hapee-1.9/dashboard/dashboard-gateway):

$ ./haproxy-dashboard-gateway

Since Dashboard Gateway is not a daemon, you can run it as a systemd service as shown below:

[Unit]
Description=HAProxy Enterprise Dashboard Gateway
After=network.target

[Service]
Type=simple
User=root
ExecStart=/opt/hapee-1.9/dashboard/dashboard-gateway/haproxy-dashboard-gateway
WorkingDirectory=/opt/hapee-1.9/dashboard/dashboard-gateway
Restart=on-failure

[Install]
WantedBy=multi-user.target

Configuring Dashboard Gateway

You configure the main Dashboard Gateway instance in the 'conf/config.json' file.

You can configure the following options:

[
  {
    "host": "{{ hostname_or_ip }}",
    "port": "{{ portnumber }}",
    "handler": "module" | "socket"
    "ssl": {{ true | false }},
    "user": "{{ username }}",
    "password": "{{ password }}"
  },
  ...
]

Using environment variables as alternative configuration

Aside from editing the file 'config.json', you can also configure Dashboard Gateway using environment variables. Detailed explanation of available environment variables is given in the .env.example file.

There are several ways to set environment variables for a specific program on the system:

$ cp conf/.env.example conf/.env

Authenticating Dashboard Gateway

You configure the HTTP BASIC authentication and authorization setup in the 'conf/htpasswd.json' file.

The 'htpasswd.json' file has the following options:

{
  "{{ username_1 }}": {
    "password": "{{ sha256_password_hash }}",
  },
  "{{ username_2 }}": {
    // . . .
  },
  // . . .
}

The "username" defined in the RT Dashboard UI gives all access control options for a given user.

You can generate the password hash with the following command:

$ echo -n "{{ password }}" | sha256sum