Merge pull request #1474 from vyos/mergify/bp/sagitta/pr-1472

reverse-proxy: T6434: Support additional health-check protocols (backport #1472)

1 files changed, 44 insertions, 17 deletions

diff --git a/docs/configuration/loadbalancing/reverse-proxy.rst b/docs/configuration/loadbalancing/reverse-proxy.rst
index 3edc4283..9cb49a7f 100644
--- a/docs/configuration/loadbalancing/reverse-proxy.rst
+++ b/docs/configuration/loadbalancing/reverse-proxy.rst
@@ -161,8 +161,34 @@ Backend
   Set custom HTTP headers to be included in all responses using the backend
 
 
-HTTP health check
-^^^^^^^^^^^^^^^^^
+Global
+-------
+
+Global parameters
+
+.. cfgcmd:: set load-balancing reverse-proxy global-parameters max-connections
+   <num>
+
+  Limit maximum number of connections
+
+.. cfgcmd:: set load-balancing reverse-proxy global-parameters ssl-bind-ciphers
+   <ciphers>
+
+  Limit allowed cipher algorithms used during SSL/TLS handshake
+
+.. cfgcmd:: set load-balancing reverse-proxy global-parameters tls-version-min
+   <version>
+
+  Specify the minimum required TLS version 1.2 or 1.3
+
+
+Health checks
+=============
+
+
+HTTP checks
+-----------
+
 For web application providing information about their state HTTP health
 checks can be used to determine their availability.
 
@@ -185,31 +211,32 @@ checks can be used to determine their availability.
    expect <condition>
 
   Sets the expected result condition for considering a server healthy.
+
   Some possible examples are:
    * ``status 200`` Expecting a 200 response code
    * ``status 200-399`` Expecting a non-failure response code
    * ``string success`` Expecting the string `success` in the response body
 
 
-Global
--------
-
-Global parameters
-
-.. cfgcmd:: set load-balancing reverse-proxy global-parameters max-connections
-   <num>
-
-  Limit maximum number of connections
+TCP checks
+----------
 
-.. cfgcmd:: set load-balancing reverse-proxy global-parameters ssl-bind-ciphers
-   <ciphers>
+Health checks can also be configured for TCP mode backends. You can configure
+protocol aware checks for a range of Layer 7 protocols:
 
-  Limit allowed cipher algorithms used during SSL/TLS handshake
+.. cfgcmd:: set load-balancing reverse-proxy backend <name> health-check <protocol>
 
-.. cfgcmd:: set load-balancing reverse-proxy global-parameters tls-version-min
-   <version>
+  Available health check protocols:
+   * ``ldap`` LDAP protocol check.
+   * ``redis`` Redis protocol check.
+   * ``mysql`` MySQL protocol check.
+   * ``pgsql`` PostgreSQL protocol check.
+   * ``smtp`` SMTP protocol check.
 
-  Specify the minimum required TLS version 1.2 or 1.3
+.. note:: If you specify a server to be checked but do not configure a
+   protocol, a basic TCP health check will be attempted. A server shall be
+   deemed online if it responses to a connection attempt with a valid
+   ``SYN/ACK`` packet.
 
 
 Redirect HTTP to HTTPS