# Haproxy Published articles for Haproxy. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Profiling a Yandex Food PHP monolith to identify CPU usage and reduce allocated cores DevFeed: [Profiling a Yandex Food PHP monolith to identify CPU usage and reduce allocated cores]() Original publisher: [Read original article]() Author: m03r (Яндекс) Published: 2026-09-08T07:31:51Z Content type: article Language: ru Sources: [Яндекс - Как мы делаем Яндекс / Статьи]() Topics: [PHP](), [cpu](), [eBPF](), [Linux]() Tags: [cpu](), [ebpf](), [haproxy](), [linux](), [perforator](), [php](), [postgresql]() ### AI overview A backend developer describes investigating unexpectedly high CPU usage in a legacy PHP monolith at Yandex Food. By profiling the application with Perforator and its PHP support, the investigation examined why CPU consumption was unusually high and how the allocated capacity could be reduced. ### Source excerpt Всем привет, меня зовут Миша, и я бэкенд-разработчик в платформе Яндекс Еды. Я уже рассказывал, как мы анализировали наш PHP-монолит и вынесли из него процессинг заказов, и с тех пор роль этого легаси заметно уменьшилась. Заодно туда стали писать гораздо меньше нового кода, релизы стали реже, и он спокойненько себе работал, не привлекая лишнего внимания. Так оно бы и продолжалось, но тут случилась повышенная нагрузка и необходимость зарезервировать побольше мощностей для беспроблемной обработки повышенного спроса. Монолит справился на отлично, но самое интересное случилось потом: возвращая выделение ресурсов к прежним значениям, я случайно обратил внимание, что RPS в пиковые вечерние часы как-то подозрительно совпадает с количеством ядер CPU, выделенных на весь монолит. Количество выделенных ядер, конечно, ещё ничего не означает, поэтому я полез смотреть реальное потребление процессорного времени, сложив CPU usage по всем подам. С помощью нехитрой арифметики я обнаружил, что 100% загрузки одного ядра приходятся на 2,5 RPS. Какое-то время я находился в состоянии глубокого изумления, после чего решил, что это никуда не годится, и отправился в увлекательное приключение на 20 минут. Немного спойлеров: дело оказалось далеко не только в PHP. Читать далее ## Keycloak 26.7.0 released DevFeed: [Keycloak 26.7.0 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-07-09T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [API](), [Authentication](), [Authorization](), [Security](), [OAuth 2.0](), [saml]() Tags: [api](), [authentication](), [authorization](), [deprecated](), [haproxy](), [high-availability](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oauth](), [oauth-2-0](), [openid-connect](), [persistence](), [provisioning](), [release](), [saml](), [security](), [sso](), [traefik]() ### AI overview Keycloak 26.7.0 introduces preview support for SCIM-based user provisioning and simplified multi-cluster high availability, along with enhanced HAProxy and Traefik reverse-proxy guidance and step-up authentication for SAML clients. The release also adds a more secure, OAuth 2.0-compliant Identity Brokering API v2, while V1 remains enabled by default but is deprecated. OID4VCI improvements remain experimental. ### Source excerpt To download the release go to Keycloak downloads. Highlights This release features new capabilities for users and administrators of Keycloak. The highlights of this release are: Automate user provisioning with the SCIM API (preview) Simplified multi-cluster high availability without external caches (preview) Enhanced reverse proxy guides with blueprints for HAProxy and Traefik Step-up authentication for SAML clients Read on to learn more about each new feature. If you are upgrading from a previous release, also review the changes listed in the upgrading guide. Security and Standards Stronger security for the Identity Brokering API The Identity Brokering API allows applications to retrieve tokens obtained from external identity providers during federated login. Version 2 of this API replaces the legacy V1 with a more secure and standards-compliant design: Client-level authorization -- access to external tokens is controlled per client using dedicated settings (Allow retrieve external tokens and an identity provider allow list) instead of assigning broker roles to individual users. Confidential clients only -- public clients are rejected, ensuring that only authenticated clients can retrieve external tokens. OAuth 2.0 compliant -- the endpoint uses POST and returns standard JSON responses with access_token, error, and error_description fields. Session-based token storage -- a new Store token in session option keeps tokens in the user session for faster access, with automatic cleanup on session expiry. Database storage remains available for persistence across sessions. V2 is now supported but disabled by default. V1 is deprecated but still enabled by default for backward compatibility. In a future release, V1 will be removed and V2 will become the default. For more information, see the Identity Brokering APIs chapter in the Server Developer Guide. Progress on Verifiable Credentials (OID4VCI) (experimental) Verifiable Credentials (OID4VCI) allow organizations to issue tampe ## Essential Non Functional Requirements DevFeed: [Essential Non Functional Requirements]() Original publisher: [Read original article]() Author: Saurabh Dashora Published: 2026-07-07T08:33:34Z Content type: tutorial Language: en Sources: [System Design Codex]() Topics: [Requirements](), [Architecture & Design](), [Scalability](), [Availability](), [Latency](), [reliability](), [Replication](), [Users]() Tags: [availability](), [data-replication](), [failover](), [haproxy](), [kubernetes](), [latency](), [nginx](), [requirements]() ### AI overview This tutorial explains non-functional requirements as quality attributes that determine how software systems behave under real-world conditions. It covers availability, latency, scalability, and durability, with implementation approaches including load balancers, health checks, failover, CDNs, data replication, horizontal scaling, Kubernetes, and concurrent API design. ### Source excerpt Don't miss them ## Key Components of a Production Web Application DevFeed: [Key Components of a Production Web Application]() Original publisher: [Read original article]() Author: Saurabh Dashora Published: 2026-06-09T07:56:22Z Content type: article Language: en Sources: [System Design Codex]() Topics: [web applications](), [CI/CD](), [Load Balancing](), [proxy](), [Caching]() Tags: [cache](), [caching](), [ci-cd](), [cloudflare](), [ddos](), [haproxy](), [web]() ### AI overview This article provides a high-level overview of components used in production web applications, including CI/CD pipelines, DNS resolution, load balancers, reverse proxies, and content delivery networks. It explains their roles in deployment, availability, scalability, performance, and security. ### Source excerpt A big picture view... ## Chainguard Image now available for HAProxy DevFeed: [Chainguard Image now available for HAProxy]() Original publisher: [Read original article]() Published: 2023-02-09T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [Containers](), [Security](), [vulnerability scanning]() Tags: [chainguard](), [chainguard-images](), [containers](), [cosign](), [cves](), [haproxy](), [haproxy-images](), [image](), [load-balancer](), [minimal-image](), [sboms](), [secure-by-default](), [secure-images](), [toolchain](), [vulnerability-scanning](), [wolfi]() ### AI overview Chainguard announces a Chainguard Image for HAProxy. Built on Wolfi with a hardened toolchain, the image is designed to reduce image size and known vulnerabilities while providing binaries built from source, SBOMs, signatures, and SLSA Build Level 2 provenance. ### Source excerpt HAProxy Chainguard Image now available: Built on Wolfi, up to 90% smaller, aims for 0-known CVEs, and is built with hardened toolchain, making it memory safe. ## Varnish to Redis Migration DevFeed: [Varnish to Redis Migration]() Original publisher: [Read original article]() Author: Ravikumar Published: 2022-03-22T15:39:20Z Content type: article Language: en Sources: [Groupon Engineering -- Medium]() Topics: [migration](), [Caching](), [Amazon EKS](), [Redis](), [Amazon Web Services]() Tags: [aws](), [cache-invalidation](), [caching](), [cloud](), [distributed-transaction](), [haproxy](), [kafka](), [kubernetes](), [migration](), [nginx](), [proxy](), [redis](), [varnish]() ### AI overview Groupon describes migrating its Varnish caching infrastructure to Redis while moving application workloads to AWS EKS. The article focuses on a high-traffic place read service, the limitations of TTL-based cache invalidation, and the planned shift to event-based expiration. ### Source excerpt At Groupon, we are in the process of migrating our app workloads to AWS EKS. As part of the migration, we are also in the process of re-architecting our services to make them cloud & Kubernetes optimised. In this article, we will focus on the impact of cloud migration on Varnish caching at Groupon. For the uninitiated, Varnish is a high-performance reverse caching proxy. For simplicity, you can think of it as a general proxy such as HAProxy or Nginx with caching support so that it doesn't have to go to a backend service every time it receives a request. Internally, Varnish cache uses pthreads heavily(to the tune of 1000s) to serve the requests. In contrast, Redis is single-threaded. Varnish at Groupon & Place Read Service We have been using Varnish for many of our high-traffic services. These read-heavy services get traffic to the tune of millions of RPM. One such service is our place read service which is called on each & every deal page visit; it will be the focus of this article. Place read service stores all the locations a deal can be redeemed. Ex: Redemption location details of the deal https://www.groupon.com/deals/parent-big-littles-3 is highlighted below. Traffic pattern of place read service The service is called more than a billion times a day with peak traffic of ~2 million requests per minute. Current architecture (simplified) The traffic is served by a cluster of 4 Varnish servers (40GB RAM). The current Varnish hit rate is 95%. This is admittedly a low hit rate for a read-heavy service, the main reason being our TTL-based cache invalidation logic. Varnish cache invalidation We are using TTL-based cache invalidation. This usually leads to a problem where Varnish starts bombarding the backend service when most of the keys expire at the same time. Request coalescing is not very helpful when the unique keys count is in millions (which is the case with our service). As a workaround, we use randomised TTLs (between 30 to 60 mins) so that all the keys don't ## How SoundCloud Uses HAProxy with Kubernetes for User-Facing Traffic DevFeed: [How SoundCloud Uses HAProxy with Kubernetes for User-Facing Traffic]() Original publisher: [Read original article]() Published: 2017-12-07T00:00:00Z Content type: article Language: en Sources: [SoundCloud Backstage Blog]() Topics: [Kubernetes](), [Deployment](), [Routing (disambiguation)](), [HTTP]() Tags: [architecture](), [command-line](), [haproxy](), [ingress](), [kubernetes](), [microservices](), [port](), [routing](), [ssl]() ### AI overview SoundCloud describes replacing its homegrown deployment platform with Kubernetes and addressing the challenge of routing user traffic to dynamically moving pods. Because much of its infrastructure is physical, SoundCloud uses HAProxy servers to terminate SSL and forward requests to internal services. The article explains an approach that uses Kubernetes Services of type NodePort to expose applications to the HAProxy layer. ### Source excerpt A little less than two years ago, SoundCloud began the journey of replacing our homegrown deployment platform, Bazooka, with Kubernetes. Kubernetes automates deployment, scaling, and management of containerized applications. ## Anatomy of an HAProxy \<-\> Java TLS bug DevFeed: [Anatomy of an HAProxy \<-\> Java TLS bug]() Original publisher: [Read original article]() Author: Steven Davidovitz Published: 2017-03-27T19:23:27Z Content type: article Language: en Sources: [Square Corner Blog RSS Feed]() Topics: [bug](), [TLS (Transport Layer Security)](), [Java](), [Load Balancing](), [client](), [servers](), [Open Source](), [event driven](), [debug]() Tags: [backend](), [bug](), [debugging](), [engineering](), [event-driven](), [haproxy](), [health-checks](), [java](), [load-balancing](), [openssl](), [servers](), [ssl](), [tls]() ### AI overview This article investigates a CPU saturation problem caused by HAProxy SSL health checks against Java services. It explains that Java invalidated TLS sessions after unclean connection closures, preventing session resumption and forcing expensive full key exchanges. ### Source excerpt Adding SSL health checks to HAProxy uncovered an interesting interaction with Java servers. ## 10x: Service Discovery at Clay.io DevFeed: [10x: Service Discovery at Clay.io]() Original publisher: [Read original article]() Author: Zoli Kahan Published: 2015-02-17T06:00:00Z Content type: tutorial Language: en Sources: [Zolmeister]() Topics: [Docker](), [systems](), [Ansible](), [Amazon EC2]() Tags: [ansible](), [architecture](), [docker](), [haproxy](), [tutorial]() ### AI overview A tutorial describing Clay.io's service-discovery architecture using Docker, Synapse, and a local HAProxy instance. Synapse dynamically configures HAProxy to route requests to services in an Amazon EC2 cluster, while Ansible supplies local IP and port configuration to services. ### Source excerpt 10x: Service Discovery at Clay.io Architecture Service Oriented Architectures can be one of the most iterable and available software configurations for building almost any product. There are many challenges that come with these systems, probably the biggest of which is service discovery. This is how your services will communicate with each other. For our service discovery, we turn again to Docker. ## Scaling database with Django and HAProxy DevFeed: [Scaling database with Django and HAProxy]() Original publisher: [Read original article]() Published: 2013-10-07T00:00:00Z Content type: article Language: en Sources: [HackerEarth]() Topics: [Databases](), [MySQL](), [Scalability](), [Django](), [Architecture & Design](), [Object-relational mapping](), [Replication](), [Availability]() Tags: [architecture](), [availability](), [database](), [distributed](), [django](), [frontend](), [haproxy](), [load-balancer](), [mysql](), [replication](), [scalability](), [uptime]() ### AI overview This article describes HackerEarth's effort to scale a Django application whose MySQL database became a major bottleneck as data volume and request rates grew. The team rearchitected the system by sharding the database, adding database routers and Django ORM wrappers, placing HAProxy in front of the MySQL databases, and optimizing the codebase. It also discusses read replicas, routing writes to the master, and avoiding stale data for reads that require current results. ### Source excerpt ###MySQL - Primary data store At HackerEarth, we use MySQL database as the primary data store. We have experimented with a few NoSQL databases on the way, but the results have been largely unsatisfactory. The distributed databases like MongoDB or CouchDB aren't very scalable or stable. Right now, our status monitoring services use RethinkDB for storing the data in JSON format and that's all for the NoSQL database usage right now. With the growing data and number of requests/sec, it turns out that the database becomes the major bottlneck to scale the application dynamically. At this point if you are thinking that there are mythical (cloud) providers who can handle the growing need of your application, you can't be more wrong. To make the problem even harder, you can't spin a new database whenever you want to just like your frontend servers. To achieve a horizontal scalability at all levels, it requires massive rearchitecture of the system while being completely transparent to the end user. This is what a part of our team has focussed on in last few months, resulting in very high uptime and availability. The master (and only) MySQL database had started being under heavy load recently. We thought we will delay any scalability at this level till the single database could handle the load, and we will work on other high priority things. But that was not supposed to go as planned and we experienced a few downtimes. After that we did a rearchitecture of our application, sharded the database, wrote database routers and wrappers on top of django ORM, put HAProxy load balancer infront of the MySQL databases, and refactored our codebase to optimize it significantly. The image below shows a part of the architecture we have at HackerEarth. Many other components have been omitted for simplicity. ###Database slaves and router The idea was to create read replicas and route the write queries to master database and read queries to slave (read replica) databases. But that was not so si ## Proxy socket.io and nginx on the same port, over SSL DevFeed: [Proxy socket.io and nginx on the same port, over SSL]() Original publisher: [Read original article]() Author: Graham King Published: 2011-12-22T22:32:26Z Content type: tutorial Language: en Sources: [Graham King]() Topics: [Socket.IO](), [nginx](), [proxy](), [SSL](), [realtime](), [Web](), [Django](), [backends]() Tags: [django](), [haproxy](), [http](), [nginx](), [proxy](), [realtime](), [server](), [socket](), [software](), [ssl]() ### AI overview A tutorial for running Socket.IO realtime traffic and a Django web application on the same SSL port. It uses stunnel to terminate SSL, HAProxy to route WebSocket traffic to Node.js and web traffic to nginx, and nginx with Gunicorn to serve the Django application. ### Source excerpt Streamline your SSL setup: Realtime and web on one port.