COCKROACH-GEN-HAPROXY(1)

NAME

cockroach-gen-haproxy - generate haproxy.cfg for the connected cluster

SYNOPSIS

cockroach gen haproxy [flags]

DESCRIPTION

This command generates a minimal haproxy configuration file for the cluster reached through the client flags. The file is written to --out. Use "--out -" for stdout.

The addresses used are those advertised by the nodes themselves. Make sure haproxy can resolve the hostnames in the configuration file, either by using full-qualified names, or running haproxy in the same network.

Nodes that have been decommissioned are excluded from the generated configuration.

Nodes to include can be filtered by localities matching the '--locality' regular expression. eg:
  --locality=region=us-east # Nodes in region "us-east"
  --locality=region=us.* # Nodes in the US
  --locality=region=us.*,deployment=testing # Nodes in the US AND in deployment tier "testing"

A regular expression can be specified per locality tier and all specified tiers must match. The key (eg: 'region') must be fully specified, only values (eg: 'us-east1') can be regular expressions. An error is returned if no nodes match the locality filter.

OPTIONS

--cert-principal-map=[]

A comma separated list of : mappings. This
 allows mapping the principal in a cert to a DB principal such as "node" or
 "root" or any SQL user. This is intended for use in situations where the
 certificate management system places restrictions on the Subject.CommonName or
 SubjectAlternateName fields in the certificate (e.g. disallowing a CommonName
 such as "node" or "root"). If multiple mappings are provided for the same
 , the last one specified in the list takes precedence. A
 principal not specified in the map is passed through as-is via the identity
 function. A cert is allowed to authenticate a DB principal if the DB principal
 name is contained in the mapped CommonName or DNS-type SubjectAlternateName
 fields. It is permissible for the string to contain colons.

--certs-dir="/home/builder/.cockroach-certs"

Path to the directory containing SSL certificates and keys.
 Environment variable: COCKROACH_CERTS_DIR

--cluster-name=

Sets a name to verify the identity of a remote node or cluster. The value must
 match between this node and the remote node(s) specified via --join.

This can be used as an additional verification when either the node or
 cluster, or both, have not yet been initialized and do not yet know their
 cluster ID.

To introduce a cluster name into an already-initialized cluster, pair this
 flag with --disable-cluster-name-verification.

--disable-cluster-name-verification[=false]

Tell the server to ignore cluster name mismatches. This is meant for use when
 opting an existing cluster into starting to use cluster name verification, or
 when changing the cluster name.

The cluster should be restarted once with --cluster-name and
 --disable-cluster-name-verification combined, and once all nodes have been
 updated to know the new cluster name, the cluster can be restarted again with
 this flag removed.

-h, --help[=false]
    help for haproxy

--host=localhost:26257

CockroachDB node to connect to. This can be specified either as an
 address/hostname, or together with a port number as in -s myhost:26257. If
 the port number is left unspecified, it defaults to 26257. An IPv6 address
 can also be specified with the notation [...], for example [::1]:26257 or

Environment variable: COCKROACH_HOST

--insecure[=false]

Connect to a cluster without using TLS nor authentication. This makes the
 client-server connection vulnerable to MITM attacks. Use with care.
 Environment variable: COCKROACH_INSECURE

--locality=

An ordered, comma-separated list of key-value pairs that describe the
 topography of the machine. Topography often includes cloud provider regions
 and availability zones, but can also refer to on-prem concepts like datacenter
 or rack. Data is automatically replicated to maximize diversities of each
 tier. The order of tiers is used to determine the priority of the diversity,
 so the more inclusive localities like region should come before less inclusive
 localities like availability zone. The tiers and order must be the same on all
 nodes. Including more tiers is better than including fewer. For example:

--locality=cloud=gce,region=us-west1,zone=us-west-1b
   --locality=cloud=aws,region=us-east,zone=us-east-2

This flag is incompatible with --locality-file.

--out="haproxy.cfg"
    path to generated haproxy configuration file

--url=

Connection URL, of the form:
    postgresql://[user[:passwd]@]host[:port]/[db][?parameters...]
    postgresql://[user[:passwd]@]host[:port]/cluster:[virtual-cluster]/[db][?parameters...]

For example:
    postgresql://myuser@localhost:26257/mydb
    postgresql://myuser@localhost:26257/cluster:mycluster/mydb

If left empty, the discrete connection flags are used: host, port, user,
 database, insecure, certs-dir.
 Environment variable: COCKROACH_URL

-u, --user="root"

Database user name.
 Environment variable: COCKROACH_USER

OPTIONS INHERITED FROM PARENT COMMANDS

--enterprise-require-fips-ready[=false]
    abort if FIPS readiness checks fail

--log=

Logging configuration, expressed using YAML syntax. For example, you can
 change the default logging directory with: --log='file-defaults: {dir: ...}'.
 See the documentation for more options and details. To preview how the log
 configuration is applied, or preview the default configuration, you can use
 the 'cockroach debug check-log-config' sub-command.

--log-config-file=

File name to read the logging configuration from. This has the same effect as
 passing the content of the file via the --log flag.

--log-config-vars=[]

Environment variables that will be expanded if present in the body of the
 logging configuration.

--log-dir=

--log-dir=XXX is an alias for --log='file-defaults: {dir: XXX}'.

--logtostderr[=UNKNOWN]

--logtostderr=XXX is an alias for --log='sinks: {stderr: {filter: XXX}}'. If
 no value is specified, the default value for the command is inferred: INFO for
 server commands, WARNING for client commands.

--redactable-logs=false

--redactable-logs=XXX is an alias for --log='file-defaults: {redactable:
 XXX}}'.

--vmodule=
    comma-separated list of pattern=N settings for file-filtered logging (significantly hurts performance)

SEE ALSO

cockroach-gen(1)

HISTORY

13-May-2026 Auto generated by spf13/cobra