8 ms·
HAProxy 1.5
- fideloper 12y agoIf you're a curious Ubuntu (14.04) user, it looks like the PPA to get version 1.5 is ppa:vbernat/haproxy-1.5. Based on this: http://haproxy.debian.net/ http://haproxy.debian.net/
- druiid 12y agoBeen using this in production for about six months now. Happy that the release version is finally out. The nicest feature of 1.5 is that you can easily do Redis failover using the new TCP check features.
- swah 12y agoThis is embarassing. I'm getting a 502 Proxy Error.
- diminish 12y agoImpressive list of features. Does anyone know if HAProxy is used by any IAAS/PAAS providers?
- jdub 12y agoI have the sneaking suspicion that Amazon's Elastic Load Balancer is based on HAProxy (and has been tracking the 1.5 series in development for some time). Nothing particularly evidentiary, but it's a glass slipper that fits very snugly.
- Rapzid 12y agoI believe they use nginx. Traditionally ELB has been the most featureless LB's you'd ever encounter. That's in direct contrast with HAProxy. Truly a pain point with AWS IMO.
- jdub 12y agoELB has features that nginx does not (health checks for one), and does not take advantage of many features that nginx does have. On the other hand, the feature set of HAProxy (1.5 branch, now "released") matches remarkably closely.
- tachion 12y ago> ELB has features that nginx does not (health checks for one) Check out Tengine, a Nginx fork made by Alibaba guys ;)
- yarapavan 12y agoMostly, HAProxy. In contrast, the AWS-clone Eucalyptus IaaS platform uses HAProxy for ELB functionality, mimicking AWS ELB functionality [1] [1] https://github.com/eucalyptus/architecture/blob/master/features/elb/3.3/elb-benchmark.wiki https://github.com/eucalyptus/architecture/blob/master/featu...
- wpietri 12y ago
- mathieuruellan 12y agoI'm using HAProxy to load balance to an EC2 autoscaling group. I have to list all ip in the configuration file. It's still not possibile to put A.B.C.0/24.
- coops 12y agoThis release contains a neat feature: you can now bind HAProxy to a specific FD opened by its parent process. This means that you can babysit your HAProxy processes underneath a parent process that opens ports and get hitless HAProxy restarts, which I've long desired.
- kawsper 12y agoWouldn't you get the same with a HAProxy reload with a SIGTERM?
- radoslawc 12y agoNo, not really, for short period of time you've got state where previously configured instance is not working already and future one is not working yet.
- coops 12y agoThis is generally correct. In particular, when the HAProxy process is stopped/restarted there is a brief period during which the port is not bound by either process. (If the new process isn't able to get the socket when it boots it will sleep ~XXms, then try to bind/listen in a loop until it gets it or a retry threshold is hit.) During this time the kernel will reject incoming connections to the HAProxy port, so you are in danger of dropping incoming requests on the ground.
- kawsper 12y agoOh, you are right, after searching a little on the subject it looks like some people are doing things like this: iptables -I INPUT -p tcp -m multiport —dports 80,443 —syn -j DROP && sleep 0.5 && \ /etc/init.d/haproxy reload; iptables -D INPUT -p -tcp -m multiport —dports 80,443 —syn -j DROP Source: https://medium.com/@Drew_Stokes/actual-zero-downtime-with-haproxy-18318578fde6 https://medium.com/@Drew_Stokes/actual-zero-downtime-with-ha...
- coops 12y ago
- tachion 12y agoHow come this is a news if 1.5.1 has already been released on June 24th?
- brlewis 12y agoJune, even. I'm still interested, though. Fitbit uses haproxy but I set up my development machine with nginx because of SSL. It probably doesn't make a difference, but I'll still feel better when I can easily make my dev setup more closely mirror production.
- tachion 12y agoFrom what I recall, the SSL functionality was in haproxy for a while now. Some time ago, when I was doing research if I have other options for SSL enabled LB other than Nginx, I found the information that haproxy has such support included, but for some reason I decided to go with Nginx anyway.
- tomaac 12y agoWhat about SSL? HAProxy supports SSL offloading.
- brlewis 12y agoI didn't investigate deeply; I'd never heard of haproxy prior to Fitbit. Someone from site ops told me they use nginx + haproxy but it would be easier for me to just set up nginx. This article does sound to me like SSL support in haproxy is brand new: http://seanmcgary.com/posts/using-sslhttps-with-haproxy http://seanmcgary.com/posts/using-sslhttps-with-haproxy
- ominous_prime 12y agoSSL support has been around for a while, but 1.5 has been considered beta for a few years now, though that hasn't stopped it from being deployed in a lot of production environments. Before SSL was rolled into haproxy, nginx was often a good candidate to handle the SSL termination. Stunnel is also common, and stud was popular for a while, but seems it was abandoned once haproxy could handle the job.
- fasteo 12y agoKudos to loadbalancer.org team. Classy
- aaas_dot_io 12y agoThanks for all hard work. I had checked 1.5 dev build 2-3 months ago, enabling SSL was causing very high CPU. Must have been good now.
- daigoba66 12y agoWe've been using HAProxy 1.5dev in production for a few month, including SSL. It's been one of the most simplest and stable parts of our infrastructure.
- justizin 12y agohow much traffic are you passing in this environment? we're still using stunnel for ssl, have been waiting for positive reports to let haproxy do it, but are optimistic.
- indutny 12y agoA bit of self-promotion, but you may want to take a look at bud ( https://github.com/indutny/bud https://github.com/indutny/bud ) too. It is basically a TLS terminating proxy, and does support some availability features (if you need them). The bud is built on the top of the libuv, which empowers the node.js.
- nasalgoat 12y agoI was doing about 8GB/s sustained through 1.5 on a single box without issue. However, you need to run it in multi-process - I found 16 to be a good number. The only drawback is that any monitoring you do is on whichever process you happen to connect to when you check, so you need to multiply by the number of total processes to get accurate numbers. Not sure why the monitoring is per-process, but it's a bit of a pain.
- daigoba66 12y agoIt's not very heavy. Usually between 1000-2000 concurrent sessions during the day. Connection and session rates peak around 200/s. Single process. CPU has remained under 15%.
- kawsper 12y ago- [MINOR] checks: add PostgreSQL health check A bit silent, but this is a very interesting change for us.