Live data from Hacker News

HAProxy 2.0

haproxy.com

51–60 of 120 posts

Re: HAProxy 2.0

#51

I've always used Nginx as a proxy, but I've seen HAProxy mentioned, what are some of the benefits of using HAProxy over nginx as a proxy or load balancer?

It's part of our infrastructure at work to do some fairly complex routing, which might be possible in nginx but is easier with haproxy.

Multi-tenant hosting for customers with lots of custom domains (with SSL) with different customers on different versions, and an app with lots of legacy. In older versions, different paths are handled by different servers. Some paths use source-ip sticky. One part of the app uses websockets. Some paths are handled via S3+cache layer (offloading traffic from app servers without changing the app).

There's also a bunch of special paths to access specific servers directly to get some health metrics (from app written without thinking about running in an auto-scaling environment). One fun thing I built handles some old SOAP requests from a defunct service running on hundreds (maybe down to dozens now?) of external systems that will retry every request forever (exponential traffic growth) if they don't get a "success" response; using Haproxy and some request capture regexes, it can return one of a dozen specially crafted hard coded "success" responses. The date is wrong but the service doesn't care, and now few lines in Haproxy replace a dedicated "black hole" app server we used to run.

Haproxy handles all this in a single hop for all traffic (and Haproxy itself runs in an autoscaling group). The config is complex, but still understandable. All the variable stuff is generated by scripts at runtime, which also lets us use an admin UI to manage customer domains, versions, and automatically picks up available (deployed) application versions in the region.

Having used both, I'd say in general nginx is easier for simple things, and in many ways has more capabilities (like static hosting, authentication support). In fact we use nginx on the Haproxy servers for hosting static pages and being a caching proxy for S3. Haproxy makes simple hosting more complicated, but you get a lot of very fine-grinned control over everything (eg, it's pretty easy to do almost anything to the traffic like changing request/response headers/paths at any point). For anything new, I'd use nginx only if I could get away with it (note: all the above may be possible in nginx now, but I'm not going to rewrite our infrastructure unless there's a very good reason).

Re: HAProxy 2.0

#52

I've always used Nginx as a proxy, but I've seen HAProxy mentioned, what are some of the benefits of using HAProxy over nginx as a proxy or load balancer?

For me it's the superior HTTP / header rewriting capabilities. With nginx you are more or less restricted to just adding headers the last time I looked into it. Disclosure: I'm a community contributor to HAProxy and I help maintain the issue tracker on GitHub.

Looks like you have to add in a non core module:

https://github.com/openresty/headers-more-nginx-module#readm...

Re: HAProxy 2.0

#53

Earlier quoted context omitted.

What open-source NGINX lacks that open-source HAProxy has: * ACL rules with full support for logical if statements [1] * active health checks * end-to-end HTTP/2 [2] * Robust logging or a dashboard with metrics * The ability to read env variables * session stickiness * DNS service discovery [3] These are just things I'm aware of, there could be a lot more. HAProxy has shown itself to perform better for certain users…

> * ACL rules with full support for logical if statements [1] That is a terrifying "feature". Turing completeness is not a feature. That "feature" allows complete emulation of other computation types.. Including an infinite ways of doing something wrong or bad.

AFAIR first-order logic is not Turing-complete.

Re: HAProxy 2.0

#54

I've always used Nginx as a proxy, but I've seen HAProxy mentioned, what are some of the benefits of using HAProxy over nginx as a proxy or load balancer?

What open-source NGINX lacks that open-source HAProxy has: * ACL rules with full support for logical if statements [1] * active health checks * end-to-end HTTP/2 [2] * Robust logging or a dashboard with metrics * The ability to read env variables * session stickiness * DNS service discovery [3] These are just things I'm aware of, there could be a lot more. HAProxy has shown itself to perform better for certain users…

Environment variables can be used in Nginx if you compile with Lua support or use the pre-built OpenResty distro.

Re: HAProxy 2.0

#55

Earlier quoted context omitted.

WRT > end-to-end HTTP/2 [2] I think this is supported. We are using NGINX with its core Stream module to receive HTTP/2 encrypted traffic, and loadbalance it (with random or least_conn) algorithms -- to each of our backends. Traffic stays encrypted end-to-end, and it remains HTTP/2 (because the Stream module works at TCP level, not http so it does not care http/2 or http/1 is used). It seems that in the ticket [2] th…

HAProxy can proxy HTTP/2 at Layer 4 or at Layer 7, to get all the HTTP message data and perform routing based on that, etc.

Thx. Yes, NGNIX will not be able to balance HTTP/2 traffic based on HTTP headers. But HAProxy 2.0 can.

In our case, we are not un-encrypting at the load balancer, so we cannot see the HTTP headers anyway. Instead we use NGINX to load-balance based on TCP-level info.

Re: HAProxy 2.0

#56
post #34

Thoughts on HAProxy vs. Envoy, or as the data plane for a service mesh?

It definitely depends on your use case, so it's hard to tell what's better for you. HAProxy is solid and doesn't take a long time to get started.

At the same time, some of the HAProxy 2.0 features have already been available in Envoy and tested in production, at scale (if HAProxy provided those features, there wouldn't be a big need for Envoy). For example, Envoy is pretty extensible, has good performance and has good support for dynamic cert management (including service-to-service mutual TLS).

Re: HAProxy 2.0

#59
post #43

I've always used Nginx as a proxy, but I've seen HAProxy mentioned, what are some of the benefits of using HAProxy over nginx as a proxy or load balancer?

In my previous company we used to use HAProxy, and it was a hassle. Yes, it is powerful. However, nginx is way easier to configure and set up, and performance wise is a contender for most usual applications people needed. Maybe for a few edge cases, HAProxy works better, but overall, I'd pass on it. nginx just fulfills most people's requirements for reverse proxy and has solid HTTP/2 support (and other features) for…

Crazy, HAProxy is free, will proxy and load balance anything not just HTTP, and it's absolutely trivial to configure and install; there's nothing remotely complicated about setting it up. Most importantly for trivial offloading of certificates at the edge; even if using nxinx for your app servers, you should front end it with HAProxy. nxinx just doesn't compare and isn't free. Nxinx is a web server, haproxy is a tcp/ip load balancer; they're really not comparable and are for different things.

Re: HAProxy 2.0

#60
post #34

Thoughts on HAProxy vs. Envoy, or as the data plane for a service mesh?

Envoy was built for that purpose and has more functionality around it, as well as better support for service discovery (developing the now open standard APIs), more protocol introspection and observability, full-duplex connections (no upstream/downstream split in what's possible), and easy interchange between protocols.

Envoy is also used by Istio and has a lot of infrastructure support for deploying in Kubernetes and such which HAProxy doesn't currently have.

Post reply on HN