fabio

Fabio is a dynamic load balancer that supports a wide range of features including:

• HTTP/S Capabilities: GZIP compression, HTTP header injection, path stripping/prepending, HTTPS upstreams, and Server-Sent Events (SSE) support.
• Proxying: Raw TCP proxy support, TCP-SNI proxying (forwarding TLS connections based on hostname without re-encryption), and PROXY protocol support (e.g., for Amazon ELB).
• Security & Control: Route-specific access control, dynamic certificate stores (File system, HTTP, Consul, Vault), and BGP support.
• Operational Features: Dynamic reloading of routing tables without downtime, graceful shutdown, access logging, and a Web UI to examine the current routing table.
• Observability: Metrics support for Graphite, StatsD/DataDog, and Circonus.
• Traffic Management: Traffic shaping (forwarding N% of traffic upstream) and Websocket support.

Follow these steps to get a zero-conf deployment running:

1. Install fabio via Go, Homebrew, or Docker.
2. Register your service in Consul with a unique ServiceID and a name without spaces.
3. Add a health check in Consul (fabio defaults to routing only to 'passing' services).
4. Add routing tags to your Consul service using the urlprefix- format.
5. Start fabio (it will automatically detect the Consul agent on localhost:8500).
6. Route traffic to fabio on port 9999.

Fabio supports three methods for specifying configuration options. Options are evaluated in the following order of precedence (higher priority wins):

1. Command line arguments (Highest priority)
2. Environment variables
3. Configuration file (fabio.properties) (Lowest priority)

To authenticate calls from Amazon API Gateway using client certificates, you must configure an HTTPS listener on Fabio with a valid certificate.

Because Amazon-generated certificates do not have the CA flag set, Fabio must be explicitly configured to trust them to avoid the error: TLS handshake error: failed to verify client's certificate.

Configuration for Fabio v1.1 and earlier

Use the proxy.addr and aws.apigw.cert.cn parameters in your configuration:

• proxy.addr: Set to IP:PORT;your/cert.pem;your/key.pem;api-gw-cert.pem
• aws.apigw.cert.cn: Set to the Common Name (CN) of the Amazon certificate (e.g., ApiGateway).

Configuration for Fabio v1.2 and later

Versions 1.2 and later use dynamic certificate stores. The aws.apigw.cert.cn parameter is no longer supported. Instead, add the caupgcn=ApiGateway parameter to your certificate source configuration.

When using the proto=https+tcp+sni listener, you can proxy TCP traffic (where TLS is terminated by the upstream service) by registering services in Consul with a specific tag.

If your upstream service responds to https://foo.com/..., register the service with a urlprefix- tag that includes the proto=tcp parameter. This ensures Fabio uses the SNI extension to route the TCP traffic based on the host.

To redirect an HTTP request to a specific URL, use the `redirect=<code

option within theroute add svccommand. Thecode` must be an HTTP status code between 300 and 399.

route add svc /path https://www.google.com/ opts "redirect=301"

Fabio supports per-route HTTP Basic Authorization using the proxy.auth option. You define authorization schemes globally and then reference them in specific route configurations using a unique name.

To configure a scheme, use the format: name=<name>;type=basic;file=<file>;realm=<realm>;refresh=<interval>

To apply a scheme to a route, use the auth=<name> parameter in your route command.

To append the original request URI to the redirect target, use the $path pseudo-variable at the end of the target URL.

urlprefix-/path redirect=303,https://www.foo.com$path

Fabio searches the routing table from top to bottom for every incoming request.

Matching Logic:

1. Host/Path Matching: A route matches if either the host/path matches or, if no host match is found, the /path matches.
2. Ordering: The table is ordered by:
   • Routes with a host (sorted by prefix length in descending order).
   • Routes without a host (sorted by prefix length in descending order).
3. Specificity: Routes are always ordered from most to least specific by prefix length.

Target Selection: The target URL is determined by the configured strategy. Supported strategies are rnd (default) and rr (round robin).

To run Fabio in a Docker container, use the official fabiolb/fabio image. You must mount your own configuration file to /etc/fabio/fabio.properties inside the container.

If you need to use SSL certificates, store both your configuration and your certificates in a local directory and mount the entire directory to /etc/fabio. For example, if your fabio.properties defines a proxy address with certificate paths like proxy.addr=:443;/etc/fabio/ssl/mycert.pem;/etc/fabio/ssl/mykey.pem, ensure those files are present in the mounted volume.

To perform an HTTP to HTTPS redirect, you must explicitly include the host:port of the HTTP endpoint in the route definition.

route add svc example.com:80/ https://example.com/ opts "redirect=301"

You can deploy Fabio behind an Amazon Elastic Load Balancer (ELB) to manage traffic. To ensure Fabio receives the original remote address and port of the client (rather than the ELB's internal IP), you must enable PROXY protocol support on the Amazon ELB.

In this architecture, the flow is: internet -- HTTP/HTTPS --> ELB --(HTTP w/PROXY proto)--> fabio --(HTTP)--> service