Haproxy: Is there a way to group acls for greater efficiency

access-control-listhaproxy

I have some logic in a frontend that routes to different backends based on both the host and the url. Logically it looks like this:

if hdr(host) ends with 'a.domain.com':
    if url starts with '/dir1/':
        use backend domain.com/dir1/
    elif url starts with '/dir2/':
        use backend domain.com/dir2/
    # ... else if ladder repeats on different dirs
elif hdr(host) ends with 'b.domain.com':
    # another else if ladder exactly the same as above
    # ...
# ... else if ladder repeats like this on different domains

Is there a way to group acls to avoid having to repeatedly check the domain acl?

Obviously there needs to be a use backend statement for each possibility, but I don't want to have to check the domain over and over because it's very inefficient.

In other words, I want to avoid this:

use backend domain.com/url1/ if acl-domain.com and acl-url1
use backend domain.com/url2/ if acl-domain.com and acl-url2
use backend domain.com/url3/ if acl-domain.com and acl-url3
# tons more possibilities below

because it has to keep checking acl-domain.com.

This is particularly an issue because I have specific rules for subdomains such as a.domain.com and b.domain.com, but I want to fall back on the most common case of *.domain.com. That means every single rule that uses a specific subdomain must be checked prior to *.domain.com which makes it even more inefficient for the common case.

Best Answer

Are you running into performance problems with your current application?

If you definitely need to improve performance at the HAProxy level, then I would suggest simply using a separate HAProxy instance for each subdomain. For example, create a new HAProxy server, and point a.domain.com directly to the new server. You can also continue pointing all DNS entries to the main HAProxy server, and have the first HAProxy layer only handle subdomain matching.

Of course, if you don't really have performance problems, then maybe it's better to leave well enough alone.

Related Topic