TCP proxy (HAProxy) operations
This page is the operational runbook for maintaining the TCP proxy that powers *.db.lef database endpoints.
The canonical endpoint → VIP → backend mapping lives in Reference.
Preconditions
Section titled “Preconditions”- You are on VPN/LAN (see VPN access (support)).
- You have SSH access to
proxy.core.lefand authorization to change routing. - You know:
- the endpoint hostname (
<name>.db.lef) - the destination port (commonly
1433for SQL Server,5432for PostgreSQL) - the backend target (prefer hostnames where possible, otherwise IP:port)
- the endpoint hostname (
Where it runs
Section titled “Where it runs”- HAProxy runs on
proxy.core.lef. - VIP allocations and pools are tracked in Core LAN and TCP proxy (facts).
Add a new *.db.lef endpoint
Section titled “Add a new *.db.lef endpoint”1) Pick a VIP (LAN)
Section titled “1) Pick a VIP (LAN)”- Prefer consuming an existing VIP from the documented pool on
proxy.core.lefto avoid expanding the pool. - Validate the VIP is not already assigned in TCP proxy (facts) and is not documented as used elsewhere in Core LAN.
2) Ensure the VIP is bound on proxy.core.lef
Section titled “2) Ensure the VIP is bound on proxy.core.lef”If the VIP is not already present on the host, add it to /etc/network/interfaces and bring it up.
The current pool on proxy.core.lef uses a 255.255.255.0 netmask for VIP aliases (see proxy.core.lef).
auto ens18:<n>
iface ens18:<n> inet static
address <vip-ip>
netmask 255.255.255.0Bring it up:
sudo ifup ens18:<n>
ip -4 addr show dev ens183) Update HAProxy routing
Section titled “3) Update HAProxy routing”At minimum, HAProxy must:
- listen on
<vip-ip>:<port> - route traffic to the intended backend
- fail closed when the backend is unhealthy
After changes, validate and reload HAProxy (use your local standard once captured above).
4) Update DNS (*.db.lef)
Section titled “4) Update DNS (*.db.lef)”Update DNS for <name>.db.lef to point to the VIP.
Prefer using the DNS tooling/process documented for dns.core.lef and follow DNS split horizon when relevant.
5) Update docs (same PR)
Section titled “5) Update docs (same PR)”- Add/update the row in TCP proxy (facts).
- If you introduced a new VIP or touched LAN allocations, regenerate the derived Core LAN map:
npm run generate:core-lan-address-map6) Validate
Section titled “6) Validate”From a machine that can reach the Core LAN:
nc -vz <name>.db.lef <port>
nc -vz <vip-ip> <port>Then validate at the application layer (SQL client / app connection), if applicable.
Support
Section titled “Support”For symptom-driven connectivity issues, see TCP proxy connectivity (support).