On 9/17/26 11:52 AM, David Lake via Freeradius-Users wrote:
Thanks.
In terms of HAProxy, I have this running between the FreeRadius servers and the Galera cluster.
I’ve seen some recommendations that I direct all write to one node and then allow read from all so I will ask HAProxy.
Noted on the upgrade - work now in progress.
Thanks
David
From: Matthew Newton via Freeradius-Users <freeradius-users@lists.freeradius.org> Date: Thursday, 17 September 2026 at 13:23 To: freeradius-users@lists.freeradius.org <freeradius-users@lists.freeradius.org> Cc: Matthew Newton <mcn@freeradius.org> Subject: Re: FreeRadius 3.0.3 and Galera Cluster
On 17/09/2026 12:43, David Lake via Freeradius-Users wrote:
I have two FR 3.0.3 servers and a 3-node Galera cluster for HA. ... 1. Should I run the ’Skip Locked’ on FreeRadius or not? Some documentation says that I shouldn’t as MariaDB doesn’t support it, but other say newer versions do support it Unsure on the database side, but it sounds like your whole system needs an upgrade. Then new features will become available to you.
1. What is the optimal way of configuring HAProxy?
For what? In front of FreeRADIUS? In front of the database? Maybe ask the HAproxy people.
1. How do I separate out writes from reads - I have two sites, each with one FR server and one Galera node. There is a high-speed network between the two, but ideally, I want to keep cross-site traffic to a minimum.
For this sort of thing you'd normally use a "redundant" type section (see instantiate in radiusd.conf) with two sql module instances, one that you point to the database server you use for RW, and the other pointing to the DB server for RO.
e.g. from the example in radiusd.conf, maybe something like
redundant redundant_sql { sql_local sql_remote }
then call 'redundant_sql' instead of 'sql'. sql_local/remote would of course be the other way around at the other site. If 'sql_local' is unavailable, FR will fall back to using 'sql_remote'.
Or, alternatively, define them as 'sql_ro' and 'sql_rw' and call each one as appropriate if you want to just read, or write.
I seem to remember there may have been some bugs fixed with this in the last couple of versions or so; another reason to upgrade before trying it.
-- Matthew
- List info/subscribe/unsubscribe? See https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=05%7C02%7Cd.lake%40surrey.ac.uk%7Ccbc286cb549f48a5695508df14b669b6%7C6b902693107440aa9e21d89446a2ebb5%7C0%7C0%7C639252445900941934%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=LowXtU6J6CYwx0k6e0uSfYGt4Yfu6vcZSXDk%2B7tQrH4%3D&reserved=0<http://www.freeradius.org/list/users.html> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
i'll keep this brief, in case this belongs being taken off-list... i use HA Proxy in front of MariaDB, with all 3 nodes taking reads and writes. i do this because my machines are relatively low powered, and i want the most performance from the cluster. by using all nodes in read/write mode, i can distribute all workloads across all instances. YMMV. my HA Proxy config, as it pertains to MariaDB is below. i do use proxy-protocol so that the instances see the original client IP, and i can base my ACLs off the client IP, not the HA Proxy VIP/shared IP. in my load-sharing-over-Anycast instances of FreeRADIUS, i point to the HA Proxy VIP for any DB pieces and dont have to worry about the redundant configs in FreeRADIUS. because the infrastructure surrounding MariaDB handles HA, fault tolerance and failover, FreeRADIUS configs are simplified. frontend mariadb mode tcp bind 192.168.120.3:3306 default_backend mariadb backend mariadb source 192.168.120.3 mode tcp option mysql-check user haproxy server mariadb1 192.168.88.1:3306 check inter 10000 send-proxy-v2 server mariadb2 192.168.88.2:3306 check inter 10000 send-proxy-v2 server mariadb3 192.168.88.8:3306 check inter 10000 send-proxy-v2 HTH, Brendan