wtarreau

11 ms·

91.
by wtarreau 7y ago
If you're seeing good support for musl, I'd be interested in receiving a patch to add it as another combination. I prefer to keep the libc apart from the kernel (the mistake we made long ago was to mix them) so that we don't
92.
by wtarreau 7y ago
Strange that you see no option for client certs because that has been supported from day one. In addition we even support SNI-based client auth even with wildcard certs. Same for TLS versions and cipher suites. Further, just look at https:
93.
by wtarreau 7y ago
It would be great if you can explain the type of difficulties you've met. There are probably certain points that could easily be improved to satisfy users with your needs. In 2.0 we've set a number of things by default to work be
94.
by wtarreau 7y ago
Just to do justice to my coworkers working on the ALOHA appliance, it's not just a "server with haproxy preinstalled" but a tight integration of haproxy plus a few management tools into a dedicated distro built from scratch
95.
by wtarreau 7y ago
Thus it's just a plain TCP proxy and cannot route the traffic intelligently (based on Host or path) nor cache it. Following the same principle it could be said that haproxy has been supporting end-to-end H2 since version 1.0 long befor
96.
by wtarreau 7y ago
This is a strange assertion. This is not envoy, it's haproxy as you've always known it plus all the features people have been asking for recently, without removing what makes it fast, robust, compact and flexible. From what I&#x27
97.
by wtarreau 7y ago
I never saw this classification. Since 1.9 haproxy passes 100% of the h2spec tests.
98.
by wtarreau 7y ago
Hehe I still have the unbreakable 1.3 running on some home machines. It doesn't want to die so I'm not forcing it :-)
99.
by wtarreau 7y ago
Exactly, I want directory listings to remain alphanumerically ordered, not like when you want to download Git and end up believing 2.9 is the latest one :-)
100.
by wtarreau 7y ago
To be fair to squid and nginx, they don't do the same things. Squid is mainly a forward proxy. Nginx is mainly a web server. There's no reason for not using them anymore for these use cases where they excel.
101.
by wtarreau 7y ago
You have Lua in haproxy if you want to do complex things. If you just want a programmable routing table, the maps in haproxy do exactly this and can be updated on the fly (including from the traffic itself if needed). Or you can write the c
102.
by wtarreau 7y ago
I'm not sure what you mean. HAProxy has always been a layer 4/7 load balancer and has indeed never been a web server. NGINX historically was a web server (an excellent one) which has evolved towards proxying and a bit of load bala
103.
by wtarreau 8y ago
By the way, when you have very few devices to aggregate values from (let's say only 2 haproxy nodes), there's a trick you can use to still aggregate their values over peers, assuming you are willing to maintain different configura
104.
by wtarreau 8y ago
I don't think they use haproxy (or at least they don't heavily rely on it). But once you start with properly scalable tools, you "just" need to have a high bandwidth and many machines, and everything becomes easy. Think
105.
by wtarreau 9y ago
Bah what an horror. I doubt anyone can spot a more unreadable language (except maybe brainfuck). One of the issues I have with C++ is that they seem to have used basically all the symbols you can find on a keyboard to create unspellable ope
106.
by wtarreau 9y ago
So I could inject in keep-alive at 100 concurrent threads but it was very slow (2200 req/s at 12% CPU), idling on I-don't-know-what. And at 1000 threads (still 100 concurrent connections), it immediately ate all my memory and got
107.
by wtarreau 9y ago
Also, thanks for the link to the code, I found the issue with keep-alive (in fact there are two such issues). The first one is that you're looking for the Connection header with the Keep-Alive value, but this is needed only for HTTP&#x
108.
by wtarreau 9y ago
So you need as many threads as you're delivering parallel files ? That reminds me the late 90's when everyone started to discover how easy it was to deal with blocking I/O using threads until they discovered that threads are
109.
by wtarreau 9y ago
Well, I didn't know it so I tried it on my laptop but sadly that doesn't reflect my observations. Injecting here with 2000 concurrent connections results in a very fluctuating load oscillating between 2000 and 31000 requests/
110.
by wtarreau 9y ago
Yes, it's using a similar shctx to ssl, I just don't know how to configure it for now, let's wait for William to push a bit of doc first :-)
111.
by wtarreau 9y ago
The purpose is not to compare to varnish. If you need a real cache, please use varnish. haproxy is to the cache what varnish is to the load-balancer. Ie: we both do a little bit of it to simplify certain deployments, but serious ones need
112.
by wtarreau 9y ago
HTTP/2 was designed for high latency networks. It supports stream multiplexing and headers compression to significantly shrink page load time over the internet. It has very limited use on the local network. Regarding server-side push
113.
by wtarreau 9y ago
I think it'll become hard to explain simple things in this place. THE CODE IS FIRST DEVELOPPED INTO HAPROXY DEVELOPMENT BRANCH AND ONLY THEN BACKPORTED INTO HAPEE ONCE WE CONSIDER IT STABLE ENOUGH. ANY SINGLE HAPEE COMMIT HAS AN UPSTRE
114.
by wtarreau 9y ago
OK fine. But my business is not to sell products, it's to maintain haproxy the best load balancer. It's other people's task to present it as an eye candy thing that attracts and pleases customers. And obviously I give my opin
115.
by wtarreau 9y ago
Sure but these are extra packages which help ease of deployment, management in an enterprise context etc. Some of them are side projects (eg: VRRP is provided by keepalived, route injection relies on Bird and some patches we tried to upstre
116.
by wtarreau 9y ago
?
117.
by wtarreau 9y ago
To be honest it's not a matter of duplicating, catching up or anything. It's just that when a significant number of our users ask for exactly the same stuff with similar and sometimes different justifications, it becomes quite har
118.
by wtarreau 9y ago
What ? Are you kidding ? We're extremely open, we currently have 7 devs working full time for most of the stuff you'll have in 1.8, we provide all the sources with our packages (and some of our customers do their own builds), and
119.
by wtarreau 10y ago
Did people really read the article ? For me it was pretty clear, maybe it involves some regular load-balancing terms that people are not familiar with, because I'm seeing a lot of bullshit written in the comments, but here is what is d
120.
by wtarreau 11y ago
That's interesting because I'm seeing people do the exact opposite : since almost all security holes in web environments these days come not from the applications but the myriad of frameworks and unauditable layers making fun use

More ›