Nginx 1.13 released with TLS 1.3 support

Re:Nginx 1.13 released with TLS 1.3 support by JTenerife on Tuesday April 25, 2017 @10:04PM (#14199927)

Informations about HAProxy on multi-core hardware (TLS de- and encryption are CPU bound) are a bit discouraging. You can assign workers to cores, but there's no shared memory and therefore the official docs warn about some inconsistencies that might occur. There doesn't seem to be a consensus wether to use the multi-core feature or not. Also nginx supports http/2.

Regarding the status of the backendservers - I use monitoring with health checks for every backend server anyway.

That are the reasons I chose nginx as reverse proxy recently.

[ Parent | on HN ]

Re:Nginx 1.13 released with TLS 1.3 support by jonathanoliver on Tuesday April 25, 2017 @11:25PM (#14200207)

We've had great success with HAProxy on multi-core without the warnings. The Stack Exchange operations did a blog post about an easy way to do it. Here's a sample config that does multi-core processing really well: https://gist.github.com/joliver/40291313605971545a0c1f6a3040...

[ Parent | on HN ]

Re:Nginx 1.13 released with TLS 1.3 support by doubleplusgood on Wednesday April 26, 2017 @04:25AM (#14201385)

Does the stats endpoint reflect stats for all processes?

[ Parent | on HN ]

Re:Nginx 1.13 released with TLS 1.3 support by jonathanoliver on Wednesday April 26, 2017 @09:15AM (#14202651)

Yes, it aggregates stats for all endpoints.

[ Parent | on HN ]

Re:Nginx 1.13 released with TLS 1.3 support by doubleplusgood on Wednesday April 26, 2017 @11:07AM (#14203576)

Perhaps I mis-remembered that it would only work for one of them. Haven't used HAProxy in a while.

[ Parent | on HN ]

Re:Nginx 1.13 released with TLS 1.3 support by user5994461 on Wednesday April 26, 2017 @06:50AM (#14201998)

There is definitely a single right consensus on how to do high performance TLS load balancing (irrelevant of the software):

- Create 1 process per core and pin to a core.

- In extreme cases, pin the NIC interrupt to a dedicated core. (If you have multiple NIC, one dedicated core per NIC).

HAProxy lets you do that very easily. That's why it's configured the way it's configured, because it's the options you need to make a high performance load balancer.

Shared memory is not necessarily and would kill the performances dramatically. The "inconsistencies" you might have heard about mean that the stats in the stats page are approximate, nothing important.

[ Parent | on HN ]

Re:Nginx 1.13 released with TLS 1.3 support by codinghorror on Wednesday April 26, 2017 @12:55AM (#14200525)

Lack of http/2 on haproxy by now is terribly limiting and very disappointing.

[ Parent | on HN ]

Re:Nginx 1.13 released with TLS 1.3 support by sofaofthedamned on Wednesday April 26, 2017 @07:10AM (#14202074)

Agreed, and I can find no roadmap for it. It's a real shame.

I'm looking at moving to something a bit more application aware now, such as Traefik, which works better in my workflow anyway.

Will say though - HAProxy has been rock solid for me, and was a million times easier to configure and manage than F5 LTM for our use case.

[ Parent | on HN ]

Re:Nginx 1.13 released with TLS 1.3 support by jimktrains2 on Wednesday April 26, 2017 @08:04AM (#14202264)

I wonder if that's because it may have to decode all the data going over the pipe to figure out where headers are? As it stands HAProxy only looks at and modifies HTTP headers and passes the body right on through without touching or modifying it.

[ Parent | on HN ]