Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HAProxy 2.0

haproxy.com

Post reply on HN
Print view View original

91–100 of 120 posts

Re: HAProxy 2.0

#91

Post by ricardbejarano »

wtarreau wrote: post #88
ricardbejarano wrote: post #86

PSA: if you are building your own HAProxy binaries, 2.0 replaces the confusing linux `TARGET`s (`linux2628` and the like) with a single target "`linux-glibc`", that name may be even more confusing, as that's the target you need to build HAProxy even if you are using musl instead of glibc.

If you're seeing good support for musl, I'd be interested in receiving a patch to add it as another combination. I prefer to keep the libc apart from the kernel (the mistake we made long ago was to mix them) so that we don't have issues anymore when building on other libcs. For example getaddrinfo tends to be bogus on uClibc and must not be enabled there. And threads do not work on dietlibc if I remember well.

My experience with HAProxy is limited to maintaining https://github.com/ricardbejarano/haproxy, a HAProxy Docker image, which has both glibc and musl variants.

I haven't used HAProxy in any environments other than testing, but as far as I can tell both variants behave equally. In fact, haproxy.cfg for both images is the same, they only differ in their build flags.

Re: HAProxy 2.0

#92

Post by wtarreau »

ricardbejarano wrote: post #91
wtarreau wrote: post #88

Earlier quoted context omitted.

If you're seeing good support for musl, I'd be interested in receiving a patch to add it as another combination. I prefer to keep the libc apart from the kernel (the mistake we made long ago was to mix them) so that we don't have issues anymore when building on other libcs. For example getaddrinfo tends to be bogus on uClibc and must not be enabled there. And threads do not work on dietlibc if I remember well.

My experience with HAProxy is limited to maintaining https://github.com/ricardbejarano/haproxy , a HAProxy Docker image, which has both glibc and musl variants. I haven't used HAProxy in any environments other than testing, but as far as I can tell both variants behave equally. In fact, haproxy.cfg for both images is the same, they only differ in their build flags.

Oh yes absolutely! For example last time I checked libmusl, you didn't need -lrt, -ldl, -lcrypt nor a few others which I forgot about. It just provides empty stubs for those so that you can use the same build options as you regularly use with glibc. However for me threads were not supported (it was on a MIPS, lacking some 64-bit atomic ops haproxy relies on). So I'd be tempted to suggest having less options by default with musl since it's mostly aimed at embedded systems, and leaving it to users to choose if they want to enable more or not.

Correction: this requires to add -latomic there (just tested). I should mention this in the INSTALL file.

Re: HAProxy 2.0

#93

Post by wtarreau »

zeeZ wrote: post #90
wtarreau wrote: post #87

Earlier quoted context omitted.

Strange that you see no option for client certs because that has been supported from day one. In addition we even support SNI-based client auth even with wildcard certs. Same for TLS versions and cipher suites. Further, just look at https://istlsfastyet.com/ and you'll see that haproxy, H2O and nghttpx are the only 3 implementations checking everything (and haproxy was the one inventing dynamic record sizing). So it…

I know haproxy itself supports that and have used those features with static configuration, but does the k8s ingress controller out of the box?

I don't know as I have no use for it. Just check the article, it presents some of the things done with the ingress controller, it should answer some of your questions I guess.

Re: HAProxy 2.0

#94

Post by idoubtit »

PetahNZ wrote: post #42
no_wizard wrote: post #39

The conversation in this thread has made me wonder after reading it if anyone uses Apache2 as their webserver anymore. Edit: seems many still do! I thought it was dying slowly as php popularity was going down.

Yes, its still more popular than Nginx according to https://trends.builtwith.com/Web-Server/Apache https://trends.builtwith.com/Web-Server/nginx

The global trend for Apache is not looking good, and I believe a large part of its popularity is simply a legacy of its dominant position a decade ago.

Over the last 10 years, it probably lost half of its share. The exact figures vary with the source: according to the link below, Apache's share of the million busiest web sites went from 66% in 2011 to 32% now.

https://news.netcraft.com/archives/2019/05/10/may-2019-web-s...

Re: HAProxy 2.0

#95

Post by youngtaff »

henvic wrote: post #43
johnramsden wrote: post #2

I've always used Nginx as a proxy, but I've seen HAProxy mentioned, what are some of the benefits of using HAProxy over nginx as a proxy or load balancer?

In my previous company we used to use HAProxy, and it was a hassle. Yes, it is powerful. However, nginx is way easier to configure and set up, and performance wise is a contender for most usual applications people needed. Maybe for a few edge cases, HAProxy works better, but overall, I'd pass on it. nginx just fulfills most people's requirements for reverse proxy and has solid HTTP/2 support (and other features) for…

> nginx … has solid HTTP/2 support (and other features) …

AFAIK nginx doesn't implement HTTP/2 prioritisation effectively, and this can result in responses being served in a non-optimal order

https://blog.cloudflare.com/nginx-structural-enhancements-fo...

Re: HAProxy 2.0

#96

Post by nstart »

johnramsden wrote: post #2

I've always used Nginx as a proxy, but I've seen HAProxy mentioned, what are some of the benefits of using HAProxy over nginx as a proxy or load balancer?

Without knowing the scale it's hard to answer this. But in general HAProxy is THE layer to sit in front of web servers. From DDoS protection rules to a true set of metrics and a real dashboard (good luck w/ Datadog metrics for Nginx), it's purpose IS to be a highly available Load Balancer/Proxy.

Nginx in comparison is for me, THE thing to use as a web server. When it comes to being a single layer away from reverseproxying requests to apps running on an instance or static file serving with caching rules Nginx is purpose built for this.

Both apps have support for what each other do though. For the more pedantic it's easy to say "But x can do this too with this feature". Usability wise though, nginx and HAProxy are distinct. I went through the comparison very recently while testing setup of HAProxy as a load balancer in front of multiple webservers running Nginx which in turn sat in front of several apps running on each instance.

TL;DR - At a slightly larger scale (scale being number of instances + apps) HAProxy and Nginx are great to use together as opposed to one over the other.

Re: HAProxy 2.0

#97

Post by youngtaff »

jaytaylor wrote: post #25

Does it have proper support for HTTP/2.0? Last I checked, only Nginx really did it right.

AFAIK nginx does not "do it right", it can get HTTP/2 prioritisation pretty wrong and when it gets it right it can appear to be more by luck than design

https://blog.cloudflare.com/nginx-structural-enhancements-fo...

h2o is probably the only server that has done HTTP/2 right fora long time, others a finally getting it right

Re: HAProxy 2.0

#98

Post by 3xblah »

wtarreau wrote: post #71
xmichael999 wrote: post #61

Such a great project! I was a squid guy, then nginx and now since nginx stopped getting new features due to the commercial edition I am switching. Thank you developers for this amazing work!

To be fair to squid and nginx, they don't do the same things. Squid is mainly a forward proxy. Nginx is mainly a web server. There's no reason for not using them anymore for these use cases where they excel.

I use haproxy as a forward proxy on my personal computers mainly for ability to control SSL options, sniffing SSL traffic and to support non-SSL enabled clients. I do not need any caching so squid seems inappropriate.

Re: HAProxy 2.0

#99

Post by bedis9 »

zeeZ wrote: post #90
wtarreau wrote: post #87

Earlier quoted context omitted.

Strange that you see no option for client certs because that has been supported from day one. In addition we even support SNI-based client auth even with wildcard certs. Same for TLS versions and cipher suites. Further, just look at https://istlsfastyet.com/ and you'll see that haproxy, H2O and nghttpx are the only 3 implementations checking everything (and haproxy was the one inventing dynamic record sizing). So it…

I know haproxy itself supports that and have used those features with static configuration, but does the k8s ingress controller out of the box?

Yes, it does. We'll blog about those use cases during the summer.

Re: HAProxy 2.0

#100

Post by bedis9 »

zeeZ wrote: post #85

If I were to use it as a k8s ingress, how would I do OCSP stapling? nginx does that for you, but with haproxy you've always had to hack something together to add a .ocsp file (which has to exist at startup) and reload externally. I also see no option for client certificate auth or TLS versions and cipher suites in the repo. I guess it's still better to handle TLS outside of haproxy.

As you explained, HAProxy does support OCSP stapling through flat file, but also support it through the runtime API.

v1 of the ingress controller does not update OCSP. That said, this is planed for a next release.

Stay tuned :)

Post reply on HN