---
title: "10. Easier Configuration Management"
linkTitle: "10. Config Management"
weight: 340
description: "Techniques for making large HAProxy configurations easier to maintain"
icon: fa-solid fa-screwdriver-wrench
module: [HAPROXY]
categories: [Task]
aliases:
  - /haproxy/management/configuration-management/
  - /docs/haproxy/management/configuration-management/
  - /haproxy/configuration-management/
upstream_link: "https://docs.haproxy.org/3.4/management.html"
upstream_name: "HAProxy 3.4 Management Guide"
upstream_ref: "v3.4.4, chapter 10"
---

<!-- Generated by scripts/generate-haproxy-docs.py from pinned upstream text. -->

It is very common that two HAProxy nodes constituting a cluster share exactly the same configuration
modulo a few addresses. Instead of having to maintain a duplicate configuration for each node, which
will inevitably diverge, it is possible to include environment variables in the configuration. Thus
multiple configuration may share the exact same file with only a few different system wide
environment variables. This started in version 1.5 where only addresses were allowed to include
environment variables, and 1.6 goes further by supporting environment variables everywhere. The
syntax is the same as in the UNIX shell, a variable starts with a dollar sign ('\$'), followed by an
opening curly brace ('{'), then the variable name followed by the closing brace ('}'). Except for
addresses, environment variables are only interpreted in arguments surrounded with double quotes
(this was necessary not to break existing setups using regular expressions involving the dollar
symbol).

Environment variables also make it convenient to write configurations which are expected to work on
various sites where only the address changes. It can also permit to remove passwords from some
configs. Example below where the file "site1.env" file is sourced by the init script upon startup:

```shell
$ cat site1.env
LISTEN=192.168.1.1
CACHE_PFX=192.168.11
SERVER_PFX=192.168.22
LOGGER=192.168.33.1
STATSLP=admin:pa$$w0rd
ABUSERS=/etc/haproxy/abuse.lst
TIMEOUT=10s

$ cat haproxy.cfg
global
    log "${LOGGER}:514" local0

defaults
    mode http
    timeout client "${TIMEOUT}"
    timeout server "${TIMEOUT}"
    timeout connect 5s

frontend public
    bind "${LISTEN}:80"
    http-request reject if { src -f "${ABUSERS}" }
    stats uri /stats
    stats auth "${STATSLP}"
    use_backend cache if { path_end .jpg .css .ico }
    default_backend server

backend cache
    server cache1 "${CACHE_PFX}.1:18080" check
    server cache2 "${CACHE_PFX}.2:18080" check

backend server
    server cache1 "${SERVER_PFX}.1:8080" check
    server cache2 "${SERVER_PFX}.2:8080" check
```