4 ms·

Informations about HAProxy on multi-core hardware (TLS de- and encryption are CPU bound) are a bit discouraging. You can assign workers to cores, but there's no

Informations about HAProxy on multi-core hardware (TLS de- and encryption are CPU bound) are a bit discouraging. You can assign workers to cores, but there's no shared memory and therefore the official docs warn about some inconsistencies that might occur. There doesn't seem to be a consensus wether to use the multi-core feature or not. Also nginx supports http/2. Regarding the status of the backendservers - I use monitoring with health checks for every backend server anyway. That are the reasons I chose nginx as reverse proxy recently.

jonathanoliver 9y ago
We've had great success with HAProxy on multi-core without the warnings. The Stack Exchange operations did a blog post about an easy way to do it. Here's a sample config that does multi-core processing really well: https://gist.github.com/joliver/40291313605971545a0c1f6a3040d4c3 https://gist.github.com/joliver/40291313605971545a0c1f6a3040...
- doubleplusgood 9y ago
  Does the stats endpoint reflect stats for all processes?
  - jonathanoliver 9y ago
    Yes, it aggregates stats for all endpoints.
    - doubleplusgood 9y ago
      Perhaps I mis-remembered that it would only work for one of them. Haven't used HAProxy in a while.
codinghorror 9y ago
Lack of http/2 on haproxy by now is terribly limiting and very disappointing.
- sofaofthedamned 9y ago
  Agreed, and I can find no roadmap for it. It's a real shame. I'm looking at moving to something a bit more application aware now, such as Traefik, which works better in my workflow anyway. Will say though - HAProxy has been rock solid for me, and was a million times easier to configure and manage than F5 LTM for our use case.
- jimktrains2 9y ago
  I wonder if that's because it may have to decode all the data going over the pipe to figure out where headers are? As it stands HAProxy only looks at and modifies HTTP headers and passes the body right on through without touching or modifying it.
user5994461 9y ago
There is definitely a single right consensus on how to do high performance TLS load balancing (irrelevant of the software): - Create 1 process per core and pin to a core. - In extreme cases, pin the NIC interrupt to a dedicated core. (If you have multiple NIC, one dedicated core per NIC). HAProxy lets you do that very easily. That's why it's configured the way it's configured, because it's the options you need to make a high performance load balancer. Shared memory is not necessarily and would kill the performances dramatically. The "inconsistencies" you might have heard about mean that the stats in the stats page are approximate, nothing important.

jonathanoliver 9y ago

We've had great success with HAProxy on multi-core without the warnings. The Stack Exchange operations did a blog post about an easy way to do it. Here's a sample config that does multi-core processing really well: https://gist.github.com/joliver/40291313605971545a0c1f6a3040d4c3 https://gist.github.com/joliver/40291313605971545a0c1f6a3040...

doubleplusgood 9y ago
Does the stats endpoint reflect stats for all processes?
- jonathanoliver 9y ago
  Yes, it aggregates stats for all endpoints.
  - doubleplusgood 9y ago
    Perhaps I mis-remembered that it would only work for one of them. Haven't used HAProxy in a while.

codinghorror 9y ago

Lack of http/2 on haproxy by now is terribly limiting and very disappointing.

sofaofthedamned 9y ago
Agreed, and I can find no roadmap for it. It's a real shame. I'm looking at moving to something a bit more application aware now, such as Traefik, which works better in my workflow anyway. Will say though - HAProxy has been rock solid for me, and was a million times easier to configure and manage than F5 LTM for our use case.
jimktrains2 9y ago
I wonder if that's because it may have to decode all the data going over the pipe to figure out where headers are? As it stands HAProxy only looks at and modifies HTTP headers and passes the body right on through without touching or modifying it.

user5994461 9y ago

There is definitely a single right consensus on how to do high performance TLS load balancing (irrelevant of the software): - Create 1 process per core and pin to a core. - In extreme cases, pin the NIC interrupt to a dedicated core. (If you have multiple NIC, one dedicated core per NIC). HAProxy lets you do that very easily. That's why it's configured the way it's configured, because it's the options you need to make a high performance load balancer. Shared memory is not necessarily and would kill the performances dramatically. The "inconsistencies" you might have heard about mean that the stats in the stats page are approximate, nothing important.