4 ms·

In my previous company we used to use HAProxy, and it was a hassle. Yes, it is powerful. However, nginx is way easier to configure and set up, and performance w

by henvic 7y ago

In my previous company we used to use HAProxy, and it was a hassle. Yes, it is powerful. However, nginx is way easier to configure and set up, and performance wise is a contender for most usual applications people needed. Maybe for a few edge cases, HAProxy works better, but overall, I'd pass on it. nginx just fulfills most people's requirements for reverse proxy and has solid HTTP/2 support (and other features) for way longer. If you are using nginx and it is working good, I'd recommend against trying out HAProxy. If it's not working good, I'd first look into fixing whatever is wrong with your setup and only trying HAProxy if some experienced with it helps you out with it. HAProxy requires much more configuration tweaking than nginx (at least to gain any benefit from using it).

gnaritas 7y ago
Crazy, HAProxy is free, will proxy and load balance anything not just HTTP, and it's absolutely trivial to configure and install; there's nothing remotely complicated about setting it up. Most importantly for trivial offloading of certificates at the edge; even if using nxinx for your app servers, you should front end it with HAProxy. nxinx just doesn't compare and isn't free. Nxinx is a web server, haproxy is a tcp/ip load balancer; they're really not comparable and are for different things.
- henvic 7y ago
  Why do you say nginx is not free? If anything, nginx is more free than HAProxy (that has a viral license).
wtarreau 7y ago
It would be great if you can explain the type of difficulties you've met. There are probably certain points that could easily be improved to satisfy users with your needs. In 2.0 we've set a number of things by default to work better and use all the capacity with no need for tweaking. Just doing this will start a proxy on all CPU cores, support both H1 and H2 and will automatically enable round robin load-balancing, tune the maxconns, something which used to be a hassle in previous versions, and enable connection pooling and reuse by default: listen foo bind :80 mode http server www1 192.168.1.1:80 server www2 192.168.1.2:80 server www3 192.168.1.3:80 It's hard to do much simpler, even with nginx.
- jsmeaton 7y ago
  It’s been awhile since I’ve used HAProxy (changed roles, loved the product). But are there drawbacks running on all cores? I seem to remember sticky routing and acls not working properly as each core had its own set. Has that changed?
  - TimWolla 7y ago
    You probably remember the nbproc [1] setting which indeed is multiple, unrelated processes. There's proper threading now (since 1.8). [1] http://cbonte.github.io/haproxy-dconv/2.0/configuration.html#3.1-nbproc http://cbonte.github.io/haproxy-dconv/2.0/configuration.html...
- sandGorgon 7y ago
  Same here. We wanted to use haproxy from day zero because it could inject proxy protocol headers. However, haproxy actively fights being compared to nginx. There's no 101 guide to setup haproxy as a reverse proxy for nodejs application with separate domain names, ssl certificate configuration (I don't even know how to create the correct chain for haproxy after buying it from a commercial vendor), good security defaults (CORS/CORB) and docker defaults. As of RIGHT NOW, haproxy has not updated it's official docker image and has 6 day old docker images which docker hub flags as having vulnerabilities (screenshot at https://imgur.com/a/SiYoZzc https://imgur.com/a/SiYoZzc). So I'm a little hesitant at calling this release "Cloud Native" Latest nginx docker image is not flagged for any vulnerabilities.
  - TimWolla 7y ago
    > As of RIGHT NOW, haproxy has not updated it's official docker image and has 6 day old docker images which docker hub flags as having vulnerabilities (screenshot at https://imgur.com/a/SiYoZzc https://imgur.com/a/SiYoZzc). So I'm a little hesitant at calling this release "Cloud Native" 1. The “official” Docker image is not maintained by HAProxy itself. “Official” refers to being blessed by Docker. See: https://github.com/docker-library/official-images#what-do-you-mean-by-official https://github.com/docker-library/official-images#what-do-yo... 2. The vulnerability scan of Docker Hub is bogus: https://github.com/docker-library/faq#why-does-my-security-scanner-show-that-an-image-has-cves https://github.com/docker-library/faq#why-does-my-security-s... 3. There's a pull request created by me to switch from 2.0-rc to 2.0: https://github.com/docker-library/haproxy/pull/89 https://github.com/docker-library/haproxy/pull/89. I created it immediately after learning about the release. Any further delay is caused by the Docker Official Images team. Disclosure: I'm a community contributor to HAProxy and I help maintain the issue tracker on GitHub. I also maintain a few “official” Docker images and by that I know the process.
youngtaff 7y ago
> nginx … has solid HTTP/2 support (and other features) … AFAIK nginx doesn't implement HTTP/2 prioritisation effectively, and this can result in responses being served in a non-optimal order https://blog.cloudflare.com/nginx-structural-enhancements-for-http-2-performance/ https://blog.cloudflare.com/nginx-structural-enhancements-fo...

by henvic 7y ago

gnaritas 7y ago

Crazy, HAProxy is free, will proxy and load balance anything not just HTTP, and it's absolutely trivial to configure and install; there's nothing remotely complicated about setting it up. Most importantly for trivial offloading of certificates at the edge; even if using nxinx for your app servers, you should front end it with HAProxy. nxinx just doesn't compare and isn't free. Nxinx is a web server, haproxy is a tcp/ip load balancer; they're really not comparable and are for different things.

henvic 7y ago
Why do you say nginx is not free? If anything, nginx is more free than HAProxy (that has a viral license).

wtarreau 7y ago

It would be great if you can explain the type of difficulties you've met. There are probably certain points that could easily be improved to satisfy users with your needs. In 2.0 we've set a number of things by default to work better and use all the capacity with no need for tweaking. Just doing this will start a proxy on all CPU cores, support both H1 and H2 and will automatically enable round robin load-balancing, tune the maxconns, something which used to be a hassle in previous versions, and enable connection pooling and reuse by default: listen foo bind :80 mode http server www1 192.168.1.1:80 server www2 192.168.1.2:80 server www3 192.168.1.3:80 It's hard to do much simpler, even with nginx.

jsmeaton 7y ago
It’s been awhile since I’ve used HAProxy (changed roles, loved the product). But are there drawbacks running on all cores? I seem to remember sticky routing and acls not working properly as each core had its own set. Has that changed?
- TimWolla 7y ago
  You probably remember the nbproc [1] setting which indeed is multiple, unrelated processes. There's proper threading now (since 1.8). [1] http://cbonte.github.io/haproxy-dconv/2.0/configuration.html#3.1-nbproc http://cbonte.github.io/haproxy-dconv/2.0/configuration.html...
sandGorgon 7y ago
Same here. We wanted to use haproxy from day zero because it could inject proxy protocol headers. However, haproxy actively fights being compared to nginx. There's no 101 guide to setup haproxy as a reverse proxy for nodejs application with separate domain names, ssl certificate configuration (I don't even know how to create the correct chain for haproxy after buying it from a commercial vendor), good security defaults (CORS/CORB) and docker defaults. As of RIGHT NOW, haproxy has not updated it's official docker image and has 6 day old docker images which docker hub flags as having vulnerabilities (screenshot at https://imgur.com/a/SiYoZzc https://imgur.com/a/SiYoZzc). So I'm a little hesitant at calling this release "Cloud Native" Latest nginx docker image is not flagged for any vulnerabilities.
- TimWolla 7y ago
  > As of RIGHT NOW, haproxy has not updated it's official docker image and has 6 day old docker images which docker hub flags as having vulnerabilities (screenshot at https://imgur.com/a/SiYoZzc https://imgur.com/a/SiYoZzc). So I'm a little hesitant at calling this release "Cloud Native" 1. The “official” Docker image is not maintained by HAProxy itself. “Official” refers to being blessed by Docker. See: https://github.com/docker-library/official-images#what-do-you-mean-by-official https://github.com/docker-library/official-images#what-do-yo... 2. The vulnerability scan of Docker Hub is bogus: https://github.com/docker-library/faq#why-does-my-security-scanner-show-that-an-image-has-cves https://github.com/docker-library/faq#why-does-my-security-s... 3. There's a pull request created by me to switch from 2.0-rc to 2.0: https://github.com/docker-library/haproxy/pull/89 https://github.com/docker-library/haproxy/pull/89. I created it immediately after learning about the release. Any further delay is caused by the Docker Official Images team. Disclosure: I'm a community contributor to HAProxy and I help maintain the issue tracker on GitHub. I also maintain a few “official” Docker images and by that I know the process.

youngtaff 7y ago

> nginx … has solid HTTP/2 support (and other features) … AFAIK nginx doesn't implement HTTP/2 prioritisation effectively, and this can result in responses being served in a non-optimal order https://blog.cloudflare.com/nginx-structural-enhancements-for-http-2-performance/ https://blog.cloudflare.com/nginx-structural-enhancements-fo...