Manage keepalive on haproxy

haproxy

I'm tuning a haproxy server (version 1.5-dev22).
Each url manage has today a backend with only one server (previously 2), so there no longer loadbalancing.
Each backend has the option "httpclose" setted up, it also in the defaults options.

I want to activate the keepalive on it, so I will delete the httpclose in the default option and backend, but i'm trying to look for the best : no httpclose at all, or http-server-close.
"http-server-close" will be better for loadbalancing only ?
It would better for me to only set "timeout http-keep-alive" to maintain connection from client to server ?

tks

Best Answer

Use option http-server-close.

This causes HAProxy to keep connections alive toward the client, while closing them toward the server after each request. The client round trip time is usually long and the server round trip time usually short, making this the most appropriate choice for many applications, since server connections tend to be more costly to maintain open, while idle client connections incur very little cost inside HAProxy itself.

You typically don't want idle clients tying up server connections, and that's what this option prevents.

Also, consider updating to HAProxy 1.5.15.

Related Solutions

Socket.io session ends with HAproxy

got an answer from the HAproxy mailling list, where an user called "Baptiste" give me this link:

http://blog.exceliance.fr/2012/11/07/websockets-load-balancing-with-haproxy/

that configuration works perfectly with socket.io (tested with all the protocols except flashsockets). What make it works is the set of options in the default directive, the checks for websockets in the backends and the headers checks are not really needed and you can set your own ACL to whatever you need to decide if you use the backend that is executing the socket.io app or not.

The stable version of HAproxy doesn't work with this config, you need a 1.5-devel10 or newer to have it working (i used the 1.5-devel14 version).

Ssl – HAproxy 1.5 Trusted CAs

I recently hit this issue in 1.5.6 where I was receiving the error message

verify is enabled by default but no CA file specified. If you're running on a LAN where you're certain to trust the server's certificate, please set an explicit 'verify none' statement on the 'server' line, or use 'ssl-server-verify none' in the global section to disable server-side verifications by default.

This was related to not specifying a ca-file, which you cannot specify at the default-server level (according to the docs). I likewise did not want to think about service disruption should the backend endpoint have their cert re-issued by another CA.

I solved by pointing to the combined CA certificates file that your linux distro packages and neatly maintains for you. On debian, this file is /etc/ssl/certs/ca-certificates.crt, it's probably the same for you. (On RHEL7, check /etc/ssl/certs/ca-bundle.crt)

global
    ca-base /etc/ssl/cert # debian
frontend f1
    use_backend b1
backend b1
    server s1 something.com:443 ssl verify required ca-file ca-certificates.crt

Best Answer

Related Solutions

Socket.io session ends with HAproxy

Ssl – HAproxy 1.5 Trusted CAs

Related Topic