no, I mean "send-proxy" instead of "send-proxy-v2" it is good sign that servers are green
чт, 18 июн. 2026 г. в 15:44, Marc Hoppins <[email protected]>: > INTERNAL > > Servers are up according to stat (and WSREP in mysql). > > > > Without proxy settings in HAP and Percona traffic to DB appears as if from > proxy. With proxy settings traffic does not appear so the problem must be > proxy setting in HAP and/or Percona. It is possible that proxy setting on > HAP may be using something different than it does for non-proxy traffic. > > > > *From:* Илья Шипицин <[email protected]> > *Sent:* Thursday, June 18, 2026 3:27 PM > *To:* Marc Hoppins <[email protected]> > *Cc:* [email protected] > *Subject:* Re: [SPAM] Re: [EXT]Re: HAProxy and Percona > > > > [External Sender] > > not sure about v2, do not have percona server around to check. > > what else comes to mind, do you have "stat" enabled ? > > > > something like that (prometheus is optional). > > it will allow you to see whether haproxy is thinking servers are up or > down (as you have health checks enabled) > > > > frontend stats > mode http > bind 0.0.0.0:8404 > http-request use-service prometheus-exporter if { path /metrics } > stats enable > stats uri /stats > stats refresh 10s > > > > > > чт, 18 июн. 2026 г. в 14:56, Marc Hoppins <[email protected]>: > > INTERNAL > > > > I just tried proxy-v2 and still got the same errors > > > > (prod) marc.hoppins.ipa@d2-hmaster01:~ > <[email protected]:~> $ mysql -h > d2-haproxy02 -P 3306 -u march -p -e "select > customerNumber,customerName,city,country,creditLimit from > classicmodels.customers limit 20;" > > Enter password: > > ERROR 2026 (HY000): SSL connection error: error:0A00010B:SSL > routines::wrong version number > > (prod) marc.hoppins.ipa@d2-hmaster01:~ $ mysql -h d2-haproxy02 -P 3306 > -u march -p --ssl-mode=DISABLED -e "SELECT > 1;" Enter password: > > ERROR 2013 (HY000): Lost connection to MySQL server during query > > > > *From:* Илья Шипицин <[email protected]> > *Sent:* Thursday, June 18, 2026 2:02 PM > *To:* Marc Hoppins <[email protected]> > *Cc:* [email protected] > *Subject:* [SPAM] Re: [EXT]Re: HAProxy and Percona > > > > [External Sender] > > I've checked my config, I also use "send-proxy-v2" on "server" lines > > > > backend bk_vpn > mode tcp > server server-vpn 192.168.1.10:1443 send-proxy-v2 > > > > not sure which proxy protocol version is supported by percona, I mean > those lines: > > > > server d2-db-node01 xx.xx.140.45:3306 > server d2-db-node02 xx.xx.140.46:3306 backup > server d2-db-node03 xx.xx.140.47:3306 backup > > > > чт, 18 июн. 2026 г. в 13:56, Marc Hoppins <[email protected]>: > > INTERNAL > > > > It is claimed to exist and there is a setting for it. > > > > /etc/mysql/percona-xtradb-cluster.conf.d/mysqld.cnf > > > > [mysqld] > > proxy_protocol_networks="10.99.140.0/22" > > > > > > *From:* Илья Шипицин <[email protected]> > *Sent:* Thursday, June 18, 2026 10:51 AM > *To:* Marc Hoppins <[email protected]> > *Cc:* [email protected] > *Subject:* [EXT]Re: HAProxy and Percona > > > > [External Sender] > > you are trying to pass connection to mysql using so called "proxy > protocol" > > it is super thing preserving original ip address > > > > however, I'm not sure "proxy protocol" listen is available for mysql. at > least, I could find one > > > > ср, 17 июн. 2026 г. в 14:08, Marc Hoppins <[email protected]>: > > INTERNAL > > > > Hi, > > > > I am trying to get source IP recognition sorted to a percona cluster. > > > > Following a directive to configure the proxy/percona setup to correctly > identify client operations by source address, I reconfigured percona > backends with send-proxy. I now have: > > source-host - proxy-node - percona node (8.4.7) > > > > I installed mysql. If I connect to source to proxy-node:3306 I get:- > > > > ERROR 2026 (HY000): SSL connection error: error:0A00010B:SSL > routines::wrong version number > > > > I did try (from source) openssl s_client and gave path to the directory > where our certificates are. It is the same path on all installed hosts > companywide and contains the same base certificates, including our own > self-signed one(s). I do see > > verify error:num=19:self-signed certificate in certificate chain > > from the output but I am reluctant to admit this is the cause. I did try > removing (commenting out) the ssl bind options fro HAproxy config and > restarting but the same error (ERROR 2026) appears. I can find no 8.4.7 > client from percona. > > HAPROXY for the front/back > > defaults pxc_d2 > log global > mode tcp > option tcplog > option dontlognull > retries 3 > timeout connect 10s > timeout client 1h > timeout server 1h > > frontend pxc-d2-frontend from pxc_d2 > bind *:3306 > use_backend pxc-d2-backend > > backend pxc-d2-backend from pxc_d2 > default-server inter 1001 rise 3 fall 3 on-marked-down shutdown-sessions > default-server port 9200 check send-proxy > balance roundrobin > > server d2-db-node01 xx.xx.140.45:3306 > server d2-db-node02 xx.xx.140.46:3306 backup > server d2-db-node03 xx.xx.140.47:3306 backup > > > > Where would I see any access attempts from client to target? The > haproxy.log shows nothing, only regular Zabbix connections. > > > > Initially I contacted percona thinking that it was a problem with TLS/SSL > and their interactions may be seen here > > https://forums.percona.com/t/connecting-to-database-through-haproxy/40920 > > > > Any ideas would be helpful. > > > > Marc > >
