Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does it make sense to have this architecture where users connect to then HAProxy does TCP redirection to one of the servers defined in the cluster, then once that server gets the data (NGINX) it will decrypt the SSL and then pass the request on to an application server (COldFusion) on another machine. So basically the data is going through 3 machines , HaProxy,NGIX and Finally CF.

Is Latency a big issue here?

share|improve this question

It sounds like you're doing premature optimization. If you already have a load that warrants that architecture, then you should also have facts about CPU load etc from your current servers.

So basically the data is going through 3 machines , HaProxy, NGIX and Finally CF. Is Latency a big issue here?

Normally, no. Each layer adds a little bit of latency of course, but usually it's less than 10 milliseconds, even with general-purpose servers and software.


  • Keep it simple.
  • Keep it standardized.

How about at first doing:

Internet ->  | nginx -> CF |

And then later on:

             -------------          ------
Internet ->  | nginx(SSL)| -> | ->  | CF |
             -------------    |     ------
                              |     ------
                              | ->  | CF |
                              |     ------

And lastly, to fully answer your question: Yes your setup does make sense; when the SSL decryption alone is more than a single server can handle.

Essentially you're suggesting a modified version of what Willy Tarreau wrote about in this excellent overview of load balancing technique. In many cases it might be simpler to just use firewall hashing, or routing tricks, or DNS Round Robin at the very front (in front of the SSL accelerators) instead of using HAPRoxy in TCP mode as you suggest -- maybe consider that.

share|improve this answer
Wow great answer. Thanks and just in time too , I was just about to set up some servers. – Faisal Abid Jul 1 '11 at 4:46

I believe you can decrypt at the HAProxy level as well, removing the need for nginx. If HAProxy is seeing a lot of traffic, I suppose you may not want the extra burden of handling SSL, however having three machines just seems like one more than is necessary.

share|improve this answer
Hmm I thought so. The site is expected to get a lot of traffic which is why i want to remove SSL processesing from HAProxy. If NGIX was decrypting the SSL and CF was kicking in and processing the request would that be better? With just 2 servers? So HaProxy --> (NGIX & CF) – Faisal Abid Oct 16 '10 at 20:09
HAproxy does not decrypt SSL. – ThatGraemeGuy Jun 30 '11 at 10:49
You are correct. Thanks. I was lead to believe otherwise. For the reasons I mentioned above, HAProxy chooses to avoid this: – nategood Jul 13 '11 at 14:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.