Tag Info

New answers tagged

1

I figured it out. Not sure how I missed this, but the variable is "dst". So the resulting config would look like this: frontend localhost bind *:80 bind *:443 ssl crt /etc/ssl/ssl.pem mode http default_backend nodes option forwardfor backend nodes mode http balance roundrobin http-request add-header X-FrontEnd-IP %[dst] ...


1

Am I correct in assuming that SNI is essentially globally supported now? If you consider browsers - yes. If you have to deal with other kind of applications - not really: Python 3 has support, but Python 2.7. got only support with the just released version 2.7.9 Android has limited support. The HTTPUrlConnection had support for a long time, but the ...


1

Am I correct in assuming that SNI is essentially globally supported now? Essentially, yes - though you'll likely run into some edge case users who will complain about brokenness if SNI is required. If you have the capability to tell those people "use a browser from this decade, please" for your service, then you're set. Are there scenarios that I ...


1

This is usually accomplished by combining HAproxy with keepalived. HAproxy handles the load balancing, keepalived handles the HA failover. To clarify, only one HAproxy instance is active at a time, but if the primary node fails, the other takes over.


1

Yes, HAproxy will do that. You'll just need to configure keepalived with all of the virtual IPs that HAproxy will use. You can assign multiple IPs in the virtual_ipaddress block in keepalived.conf: virtual_ipaddress { 192.168.0.10 192.168.0.11 192.168.0.12 192.168.0.13 }


0

@felix-frank is right. To check if keep-alive is supported or not simply execute this command : curl -Iv http://www.serverfault.com/ 2>&1 | grep -i 'connection #0' Result (Keep-alive disabled) : 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Closing connection #0 Another test with keep-alive enabled : curl -Iv ...


0

I have found that the problem only occurs when you use a CMS like Drupal and Wordpress, I found the solution force both to use https, in the case of Drupal editing sites/default/settings.php uncomment the line: $base_url = 'https://domain_name_blablabla'; In the case of Wordpress it's necessary to install Wordpress HTTPS (SSL) plugin ...


0

Figured it out. HAProxy does its DNS resolution at startup, which I'd suspected but had a hard time confirming since all my queries just led me back to the config manual. Since I own the DNS infrastructure and namespace being queried (SkyDNS from Docker containers) I'd hoped to use that for service discovery and HAProxy backends. Seems like an Nginx-like ...


3

I'm uncomfortable with this Q&A because it hasn't really been established what type of DNS server you're talking about. There are some significant misconceptions when it comes to the resiliency of recursive DNS and it's important that people cruising in via search engines don't walk away from this discussion with a false sense of security. ...


2

As far as I know, listen block maxconn is different then global maxconn. With global maxconn you limit the max number of connections you let the haproxy process handle. Listen / frontend section has its own maxconn, which limits the nubmer of connections per listener. So, try to set up maxconn in your frontend sections too, or at least set it up in default ...


0

What is the hardware configuration of your HAProxy machine? Cores, RAM, network interfaces, etc? We have run into many HAProxy performance issues. Here are some ideas: Split traffic into two HAProxy servers, with each acting as a backup for the other. Raise nbproc to reflect the number of cores on your particular hardware. If you are using layer 7 mode, ...


8

Don't load balance your DNS. It's an incredibly light protocol - you'd need an enormous amount of traffic to need more than one box (in which case you'll just be bottlenecking on your load balancer anyway), and there's resilience built in because you can use multiple NS records in your delegation (other servers will be used if one's down).


0

Did you maybe try to use something like: server HALB_ucd1 "${UCD1_END_POINT_IP}:${UCD1_END_POINT_PORT}" check port 8444


0

I was able to resolve the issue by setting up the proxy server to use SSL termination to enable layer 7 load balancing and http mode. # This file managed by Puppet global daemon group haproxy log 192.168.*.* local1 maxconn 4000 nbproc 1 pidfile /var/run/haproxy.pid user haproxy defaults maxconn 8000 timeout http-request 10s ...


0

Mixed content is blocked outright if the domains are different. Make sure that when you switch to using the load balancer, the mixed content in the page is using the same server name.


0

I managed to get this set up, and here's how I did it: I created a global IP address using SoftLayer's control panel. I have Debian 7 on both HAProxy virtual servers. I added the global IP address to eth1 interface on both servers. Here's the HAProxy settings used on both servers: global log 127.0.0.1 local0 log 127.0.0.1 local1 notice maxconn 4096 ...


2

If i'm reading this right, you've identified the problem. Your real question seems to be "Header not ADDED when using HTTPS" - is that correct? The proxy is responsible for inserting the header? If that's the case, it can't be done without intercepting HTTPS as all bar one of the headers (host) are encrypted.


0

The files server.pem and client.pem should have 3 sections in it and should look like this: -----BEGIN RSA PRIVATE KEY----- <lots of base64 encoded data> -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- <lots of base64 encoded data> -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- <lots of base64 encoded data> -----END ...


0

Since HAProxy only has layer 4 (TCP) and layer7 (HTTP) modes, it can't handle the GRE tunnels that PPTP controls. So in short, you can load-balance the control channel (with TCP mode), but not the actual tunnels.


1

According to this post on StackOverflow, spaces in URLs aren't valid so whatever is generating these requests is flawed. I also had a poke around the HAProxy docs and I don't see any way to do it. Actually, if you know for certain that there's not going to be more than 8 spaces, I suppose you could use reqrep something like this: reqrep ^GET\ ([^\ \t]*)\ ...


0

Your problem is the balance roundrobin line in HAProxy.cfg. This tells HAProxy to round-robin between all available nodes. Change it to something else (as detailed in the haproxy documentation) and you should get the behaviour you want. For posterity, the (IMO) most popular options to the 'balance' directive are: roundrobin - classic round-robin ...


1

CPU load on HAProxy will spike at 100 once you run out of source ports and tries to scan for available ones. Usually that is 30kish though. What do you have for sysctl net.ipv4.ip_local_port_range? So for example if you have 30k connections to a single server in the backend you will likely run out of source ports and hit the CPU problem.


1

Add nbproc <number-of-cores> option to the config. Without this HAproxy runs on one core.


0

It might be worthwhile to try changing your HAProxy configuration to TCP instead of HTTP. You lose some advanced load balancing options that HTTP provides (setting cookies for persistence, etc), but it doesn't look like you're using them right now anyway. Here's an example config that I use with HAProxy for MySQL load balancing: listen mysql-failover ...


0

If you want to see the exact error HAproxy runs into you can do so using socat to connect to the admin socket. Install socat via apt-get install socat, then run the following: echo "show errors" | socat unix-connect:/run/haproxy/admin.sock stdio If you run this right after getting a "Bad Request" error it should show you exactly what HAproxy didn't like ...


0

I found a solution to this problem, that doesn't require additional servers or services. I'm not entirely sure if this doesn't spawn new problems though. For me it seems to work right now. The way I did it, was to create a frontend for each domain that required different ssl settings. I then set the bind option of those frontends to high ports (these are ...



Top 50 recent answers are included