Using HAProxy to Prevent Deletes from Elasticsearch

At one of my clients, we wanted something quick and dirty to prevent deletes from Elasticsearch (shield is too expensive and would take too much time to integrate with our systems - we'll fix this technical debt later).

The quick solution was to place HAProxy in front of Elasticsearch and use its acl mechanism to prevent HTTP DELETE. Works like a charm.

Here's the HAProxy configuration and the docker-compose setup file I used to test the configuration.

	elastic:
	image: elasticsearch
	haproxy:
	image: haproxy
	volumes:
	- ${PWD}:/usr/local/etc/haproxy
	links:
	- elastic
	ports:
	- "9200:9200"

view raw docker-compose.yml hosted with ❤ by GitHub

	# Based on http://j.mp/1YHQFgZ
	# vim: ft=haproxy
	defaults
	timeout connect 5000
	timeout client 10000
	timeout server 10000
	frontend elastic
	bind :9200
	mode http
	acl is_delete method DELETE
	http-request deny if is_delete
	default_backend elastic
	backend elastic
	mode http
	option forwardfor
	balance source
	option httpclose
	server es1 elastic:9200 weight 1 check inter 1000 rise 5 fall 1

view raw haproxy.cfg hosted with ❤ by GitHub