Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HAProxy 2.0

haproxy.com

Post reply on HN
Print view View original

81–90 of 120 posts

Re: HAProxy 2.0

#81

Post by wtarreau »

user5994461 wrote: post #41
aidanlister wrote: post #14

Earlier quoted context omitted.

What are you spending with HAProxy a year now?

You can't spend money on haproxy license. It's free. They make money by selling appliances (servers with haproxy pre installed). Nginx however is $1900 per year per server. There are plenty of critical features missing from the free edition, for example the status page to see available servers or metrics exporting for monitoring.

Just to do justice to my coworkers working on the ALOHA appliance, it's not just a "server with haproxy preinstalled" but a tight integration of haproxy plus a few management tools into a dedicated distro built from scratch and packaged as an upgradable image like you'd have on your routers or switches. The whole OS image is around 16 megabytes, kernel included, and it contains a 10 Gbps-capable anti-ddos module, a web interface, and troubleshooting tools. And of course you have root access on it and it doesn't void your support to start to hack on it (not pointing the finger at anyone, but still a little bit :-))

Re: HAProxy 2.0

#82

Post by wtarreau »

henvic wrote: post #43
johnramsden wrote: post #2

I've always used Nginx as a proxy, but I've seen HAProxy mentioned, what are some of the benefits of using HAProxy over nginx as a proxy or load balancer?

In my previous company we used to use HAProxy, and it was a hassle. Yes, it is powerful. However, nginx is way easier to configure and set up, and performance wise is a contender for most usual applications people needed. Maybe for a few edge cases, HAProxy works better, but overall, I'd pass on it. nginx just fulfills most people's requirements for reverse proxy and has solid HTTP/2 support (and other features) for…

It would be great if you can explain the type of difficulties you've met. There are probably certain points that could easily be improved to satisfy users with your needs.

In 2.0 we've set a number of things by default to work better and use all the capacity with no need for tweaking. Just doing this will start a proxy on all CPU cores, support both H1 and H2 and will automatically enable round robin load-balancing, tune the maxconns, something which used to be a hassle in previous versions, and enable connection pooling and reuse by default:

     listen foo
        bind :80
        mode http
        server www1 192.168.1.1:80
        server www2 192.168.1.2:80
        server www3 192.168.1.3:80
It's hard to do much simpler, even with nginx.

Re: HAProxy 2.0

#83

Post by tnolet »

sansnomme wrote: post #64

Are there any programmble http proxy servers? I write a fair bit of VM/container control software and often need to map URLs to specific entities on the network dynamically. Never found a good programmable proxy with routing table API and always had to hand roll.

Shameless plug. I wrote a REST wrapper around HAproxy some years back. Wrote it in Go. Works pretty nice. Willy was a great support also. https://github.com/magneticio/vamp-router

Works quite nicely and can set ACL’s dynamically.

Re: HAProxy 2.0

#84

Post by SahAssar »

no_wizard wrote: post #47
user5994461 wrote: post #44

Earlier quoted context omitted.

Of course, for anything that is cgi/fastcgi. nginx doesn't support that. There is also stuff running on mod_php/mod_python/mod_wcgi that is bound to apache, however these are deprecated and unstable technologies that should not be used in this decade.

nginx supports fast cgi https://www.nginx.com/resources/wiki/start/topics/examples/f... I imagine it supports cgi calls too

Nginx does not support CGI, but you can for example use uWSGI as a application server behind nginx.

Re: HAProxy 2.0

#85

Post by zeeZ »

If I were to use it as a k8s ingress, how would I do OCSP stapling? nginx does that for you, but with haproxy you've always had to hack something together to add a .ocsp file (which has to exist at startup) and reload externally.

I also see no option for client certificate auth or TLS versions and cipher suites in the repo.

I guess it's still better to handle TLS outside of haproxy.

Re: HAProxy 2.0

#86

Post by ricardbejarano »

PSA: if you are building your own HAProxy binaries, 2.0 replaces the confusing linux `TARGET`s (`linux2628` and the like) with a single target "`linux-glibc`", that name may be even more confusing, as that's the target you need to build HAProxy even if you are using musl instead of glibc.

Re: HAProxy 2.0

#87

Post by wtarreau »

zeeZ wrote: post #85

If I were to use it as a k8s ingress, how would I do OCSP stapling? nginx does that for you, but with haproxy you've always had to hack something together to add a .ocsp file (which has to exist at startup) and reload externally. I also see no option for client certificate auth or TLS versions and cipher suites in the repo. I guess it's still better to handle TLS outside of haproxy.

Strange that you see no option for client certs because that has been supported from day one. In addition we even support SNI-based client auth even with wildcard certs. Same for TLS versions and cipher suites.

Further, just look at https://istlsfastyet.com/ and you'll see that haproxy, H2O and nghttpx are the only 3 implementations checking everything (and haproxy was the one inventing dynamic record sizing).

So it seems your opinion on haproxy's TLS support is not that spread!

Re: HAProxy 2.0

#88

Post by wtarreau »

ricardbejarano wrote: post #86

PSA: if you are building your own HAProxy binaries, 2.0 replaces the confusing linux `TARGET`s (`linux2628` and the like) with a single target "`linux-glibc`", that name may be even more confusing, as that's the target you need to build HAProxy even if you are using musl instead of glibc.

If you're seeing good support for musl, I'd be interested in receiving a patch to add it as another combination. I prefer to keep the libc apart from the kernel (the mistake we made long ago was to mix them) so that we don't have issues anymore when building on other libcs. For example getaddrinfo tends to be bogus on uClibc and must not be enabled there. And threads do not work on dietlibc if I remember well.

Re: HAProxy 2.0

#89

Post by isodude »

wtarreau wrote: post #81
user5994461 wrote: post #41

Earlier quoted context omitted.

You can't spend money on haproxy license. It's free. They make money by selling appliances (servers with haproxy pre installed). Nginx however is $1900 per year per server. There are plenty of critical features missing from the free edition, for example the status page to see available servers or metrics exporting for monitoring.

Just to do justice to my coworkers working on the ALOHA appliance, it's not just a "server with haproxy preinstalled" but a tight integration of haproxy plus a few management tools into a dedicated distro built from scratch and packaged as an upgradable image like you'd have on your routers or switches. The whole OS image is around 16 megabytes, kernel included, and it contains a 10 Gbps-capable anti-ddos module, a w…

Also, HAProxy has brilliant minds like Willy Tarreau behind it. That as a reason is enough. We are lucky to have you around.

Re: HAProxy 2.0

#90

Post by zeeZ »

wtarreau wrote: post #87
zeeZ wrote: post #85

If I were to use it as a k8s ingress, how would I do OCSP stapling? nginx does that for you, but with haproxy you've always had to hack something together to add a .ocsp file (which has to exist at startup) and reload externally. I also see no option for client certificate auth or TLS versions and cipher suites in the repo. I guess it's still better to handle TLS outside of haproxy.

Strange that you see no option for client certs because that has been supported from day one. In addition we even support SNI-based client auth even with wildcard certs. Same for TLS versions and cipher suites. Further, just look at https://istlsfastyet.com/ and you'll see that haproxy, H2O and nghttpx are the only 3 implementations checking everything (and haproxy was the one inventing dynamic record sizing). So it…

I know haproxy itself supports that and have used those features with static configuration, but does the k8s ingress controller out of the box?
Post reply on HN