Tag Info

Hot answers tagged

8

Don't load balance your DNS. It's an incredibly light protocol - you'd need an enormous amount of traffic to need more than one box (in which case you'll just be bottlenecking on your load balancer anyway), and there's resilience built in because you can use multiple NS records in your delegation (other servers will be used if one's down).


3

I'm uncomfortable with this Q&A because it hasn't really been established what type of DNS server you're talking about. There are some significant misconceptions when it comes to the resiliency of recursive DNS and it's important that people cruising in via search engines don't walk away from this discussion with a false sense of security. ...


2

As far as I know, listen block maxconn is different then global maxconn. With global maxconn you limit the max number of connections you let the haproxy process handle. Listen / frontend section has its own maxconn, which limits the nubmer of connections per listener. So, try to set up maxconn in your frontend sections too, or at least set it up in default ...


2

If i'm reading this right, you've identified the problem. Your real question seems to be "Header not ADDED when using HTTPS" - is that correct? The proxy is responsible for inserting the header? If that's the case, it can't be done without intercepting HTTPS as all bar one of the headers (host) are encrypted.


1

I figured it out. Not sure how I missed this, but the variable is "dst". So the resulting config would look like this: frontend localhost bind *:80 bind *:443 ssl crt /etc/ssl/ssl.pem mode http default_backend nodes option forwardfor backend nodes mode http balance roundrobin http-request add-header X-FrontEnd-IP %[dst] ...


1

Am I correct in assuming that SNI is essentially globally supported now? If you consider browsers - yes. If you have to deal with other kind of applications - not really: Python 3 has support, but Python 2.7. got only support with the just released version 2.7.9 Android has limited support. The HTTPUrlConnection had support for a long time, but the ...


1

Am I correct in assuming that SNI is essentially globally supported now? Essentially, yes - though you'll likely run into some edge case users who will complain about brokenness if SNI is required. If you have the capability to tell those people "use a browser from this decade, please" for your service, then you're set. Are there scenarios that I ...


1

This is usually accomplished by combining HAproxy with keepalived. HAproxy handles the load balancing, keepalived handles the HA failover. To clarify, only one HAproxy instance is active at a time, but if the primary node fails, the other takes over.


1

Yes, HAproxy will do that. You'll just need to configure keepalived with all of the virtual IPs that HAproxy will use. You can assign multiple IPs in the virtual_ipaddress block in keepalived.conf: virtual_ipaddress { 192.168.0.10 192.168.0.11 192.168.0.12 192.168.0.13 }


1

According to this post on StackOverflow, spaces in URLs aren't valid so whatever is generating these requests is flawed. I also had a poke around the HAProxy docs and I don't see any way to do it. Actually, if you know for certain that there's not going to be more than 8 spaces, I suppose you could use reqrep something like this: reqrep ^GET\ ([^\ \t]*)\ ...


1

CPU load on HAProxy will spike at 100 once you run out of source ports and tries to scan for available ones. Usually that is 30kish though. What do you have for sysctl net.ipv4.ip_local_port_range? So for example if you have 30k connections to a single server in the backend you will likely run out of source ports and hit the CPU problem.


1

Add nbproc <number-of-cores> option to the config. Without this HAproxy runs on one core.



Only top voted, non community-wiki answers of a minimum length are eligible