4 ms·

We built a fantastic CDN on top of HAProxy, and all these nifty tricks are only scratching the surface of its potential. The ease with which you can make real-

We built a fantastic CDN on top of HAProxy, and all these nifty tricks are only scratching the surface of its potential. The ease with which you can make real-time reactions to threats and conditions is really second to none, and with the ability to truly "hitless" reload (reload without affecting in-flight requests and connections) it makes those have immediate impact and no customer impact. Sometimes the capabilities make the config a bit inscrutable, but other than that, I can't recommend it enough.

xani_ 4y ago
Newer versions also have few more tricks up the sleeve, like you can probe and act upon client's TCP RTT and RTT variance (because apparently newer kernels just track that info and it can be accessed from userspace). We ended up using HAPRoxy as front for pretty much everything (even if techncially slapping just Nginx would be simpler at first), just because it often happens that this and that needs to be added (stuff like adding proper headers when devs don't want to figure out how to make their '00s CMS emi the '20s security headers). It can also talk directly via unix socket to the backends so you don't even need to have a bunch of ports open if you want to front something.
- pull_my_finger 4y ago
  Have you used the ngx_lua module (or OpenResty) with Nginx at all? I'm curious if there was something HAProxy does that can't be done with OpenResty, because that is crazy full-featured. Basically the main reason I haven't played around with HAProxy is just because I haven't ever felt like I was missing anything with OpenResty/Nginx
  - lukeqsee 4y ago
    HAProxy also has Lua support. The general answer here, is no, I don't think you can do much in HAProxy that you can't do with OpenResty, but with HAProxy you generally don't have to pay the overhead of Lua (and HAProxy tends to be very well optimized, so the difference can be significant at high throughput of requests / bytes).
    - smw 4y ago
      One notable thing is that OpenResty, unlike HAProxy, uses LuaJIT, which is dramatically faster.

xani_ 4y ago

Newer versions also have few more tricks up the sleeve, like you can probe and act upon client's TCP RTT and RTT variance (because apparently newer kernels just track that info and it can be accessed from userspace). We ended up using HAPRoxy as front for pretty much everything (even if techncially slapping just Nginx would be simpler at first), just because it often happens that this and that needs to be added (stuff like adding proper headers when devs don't want to figure out how to make their '00s CMS emi the '20s security headers). It can also talk directly via unix socket to the backends so you don't even need to have a bunch of ports open if you want to front something.

pull_my_finger 4y ago
Have you used the ngx_lua module (or OpenResty) with Nginx at all? I'm curious if there was something HAProxy does that can't be done with OpenResty, because that is crazy full-featured. Basically the main reason I haven't played around with HAProxy is just because I haven't ever felt like I was missing anything with OpenResty/Nginx
- lukeqsee 4y ago
  HAProxy also has Lua support. The general answer here, is no, I don't think you can do much in HAProxy that you can't do with OpenResty, but with HAProxy you generally don't have to pay the overhead of Lua (and HAProxy tends to be very well optimized, so the difference can be significant at high throughput of requests / bytes).
  - smw 4y ago
    One notable thing is that OpenResty, unlike HAProxy, uses LuaJIT, which is dramatically faster.