# Haproxy

Published articles for Haproxy.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Security updates for Thursday

DevFeed: [Security updates for Thursday](<https://devfeed.tech/articles/security-updates-for-thursday-106416.md>)

Original publisher: [Read original article](<https://lwn.net/Articles/1103666/>)

Author: jzb

Published: 2026-10-29T13:18:42Z

Content type: news

Language: en

Sources: [LWN.net](<https://devfeed.tech/sources/lwn-net.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [Fedora](<https://devfeed.tech/topics/fedora.md>), [rhel](<https://devfeed.tech/topics/rhel.md>), [Firefox](<https://devfeed.tech/topics/firefox.md>), [pip](<https://devfeed.tech/topics/pip.md>), [openjdk](<https://devfeed.tech/topics/openjdk.md>), [Emacs](<https://devfeed.tech/topics/emacs.md>), [Buildah](<https://devfeed.tech/topics/buildah.md>)

Tags: [almalinux](<https://devfeed.tech/tags/almalinux.md>), [alsa](<https://devfeed.tech/tags/alsa.md>), [buildah](<https://devfeed.tech/tags/buildah.md>), [chromium](<https://devfeed.tech/tags/chromium.md>), [codex](<https://devfeed.tech/tags/codex.md>), [coreutils](<https://devfeed.tech/tags/coreutils.md>), [curl](<https://devfeed.tech/tags/curl.md>), [debian](<https://devfeed.tech/tags/debian.md>), [docker](<https://devfeed.tech/tags/docker.md>), [emacs](<https://devfeed.tech/tags/emacs.md>), [fedora](<https://devfeed.tech/tags/fedora.md>), [firefox](<https://devfeed.tech/tags/firefox.md>), [haproxy](<https://devfeed.tech/tags/haproxy.md>), [java](<https://devfeed.tech/tags/java.md>), [java-17](<https://devfeed.tech/tags/java-17.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [libreoffice](<https://devfeed.tech/tags/libreoffice.md>), [security](<https://devfeed.tech/tags/security.md>), [security-updates](<https://devfeed.tech/tags/security-updates.md>), [updates](<https://devfeed.tech/tags/updates.md>)

### AI overview

Security updates were issued by AlmaLinux, Debian, Fedora, Mageia, Oracle, Red Hat, and SUSE. The listed packages span kernels and real-time kernels, browsers such as Firefox and Chromium, Thunderbird, OpenJDK, container tools, and libraries and system utilities. The source names affected packages but gives no vulnerability details, severity, versions, or remediation steps.

### Source excerpt

Security updates have been issued by AlmaLinux (cjose, emacs, expat, gcc-toolset-15-gcc, java-17-openjdk, java-25-openjdk, kernel, kernel-rt, libX11, libXi, libXrender, libXtst, mod_auth_openidc:2.3, pki-deps:10.6, thunderbird, webkit2gtk3, and yggdrasil), Debian (chromium, firefox-esr, and openjdk-25), Fedora (firefox, librabbitmq, libreswan, python-pillow, and unbound), Mageia (fio and python3, python-pip), Oracle (buildah, cjose, container-tools:ol8, emacs, flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac, kernel, libX11, libXi, libXrender, libXtst, podman, python-urllib3, thunderbird, and yggdrasil), Red Hat (firefox, goose, kernel, kernel package, kernel-rt, librsvg2, multiple packages, php:7.4, sudo, thunderbird, and xorg-x11-server), and SUSE (alsa, ca-certificates-mozilla, chromedriver, cifs-utils, coredns, coreutils, cpupower, curl, cyrus-sasl, docker, dpdk, haproxy, kernel, libpoppler-cpp3, libsndfile-devel, libzbar-devel, mozilla-nss, MozillaFirefox, nginx, openai-codex, and perl-Cpanel-JSON-XS).

## Security updates for Monday

DevFeed: [Security updates for Monday](<https://devfeed.tech/articles/security-updates-for-monday-89981.md>)

Original publisher: [Read original article](<https://lwn.net/Articles/1101421/>)

Author: jzb

Published: 2026-10-19T13:10:19Z

Content type: news

Language: en

Sources: [LWN.net](<https://devfeed.tech/sources/lwn-net.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [Ubuntu](<https://devfeed.tech/topics/ubuntu.md>), [rhel](<https://devfeed.tech/topics/rhel.md>), [chezmoi](<https://devfeed.tech/topics/chezmoi.md>), [efcore](<https://devfeed.tech/topics/efcore.md>)

Tags: [docker](<https://devfeed.tech/tags/docker.md>), [fedora](<https://devfeed.tech/tags/fedora.md>), [go1-27](<https://devfeed.tech/tags/go1-27.md>), [grype](<https://devfeed.tech/tags/grype.md>), [haproxy](<https://devfeed.tech/tags/haproxy.md>), [helm](<https://devfeed.tech/tags/helm.md>), [jfrog](<https://devfeed.tech/tags/jfrog.md>), [jq](<https://devfeed.tech/tags/jq.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [nodejs](<https://devfeed.tech/tags/nodejs.md>), [ntfs](<https://devfeed.tech/tags/ntfs.md>), [nvidia](<https://devfeed.tech/tags/nvidia.md>), [openssl](<https://devfeed.tech/tags/openssl.md>), [openvpn](<https://devfeed.tech/tags/openvpn.md>), [pgvector](<https://devfeed.tech/tags/pgvector.md>), [php8](<https://devfeed.tech/tags/php8.md>), [podman](<https://devfeed.tech/tags/podman.md>), [python](<https://devfeed.tech/tags/python.md>), [security](<https://devfeed.tech/tags/security.md>), [security-updates](<https://devfeed.tech/tags/security-updates.md>)

### AI overview

Security updates were issued by AlmaLinux, Debian, Fedora, Mageia, Oracle, Red Hat, Slackware, and SUSE. The listed updates cover a wide range of operating system packages and software, including kernels, browsers, developer tools, and libraries.

### Source excerpt

Security updates have been issued by AlmaLinux (idm:DL1, kernel, libsoup, perl-URI, python3.14-urllib3, and webkit2gtk3), Debian (apache2, cifs-utils, haproxy, jq, kernel, and xen), Fedora (aom, chezmoi, chromium, docker-buildx, freeipa, freerdp, GitPython, httpd, jfrog-cli, kernel, knot, libheif, log4net, mongo-c-driver, nant, NetworkManager, openssl, plasma-nm, python-cairosvg, python-django5, python-django6, qt5-qtbase, radicale, rust-faster-hex, rust-onefetch, SDL3_image, syncthing, thunderbird, tor, webkitgtk, and wordpress), Mageia (curl, libreoffice, mozjs140, mutt, nodejs-braces, parted, perl-Net-Whois-Raw, perl-XS-Parse-Keyword, and python-django), Oracle (kernel, kernel-uek, python36:3.6, and wireshark), Red Hat (gvfs, kernel, and kernel-rt), Slackware (libXtst), and SUSE (agama, ansible-core, bcel, bind, buildah, busybox, cadvisor, chromium, cosign, cups-filters, distribution-registry, fetchmail, gcc13, ghostscript, gimp, glib2, go1.26, go1.27, golang-github-lusitaniae-apache_exporter, golang-github-prometheus-alertmanager, google-osconfig-agent, grype-db, hauler, hawk2, helm, ImageMagick, iperf, kernel, libheif, libpng16, librsvg, libsoup, libsoup2, libthrift-0_25_0, libx11, libxi, libxpm, mutt, ntfs-3g_ntfsprogs, nvidia-open-driver-g07-signed, nvidia-open-driver-G07-signed-check, openssl-3, openvpn, p11-kit, pacemaker, perl-xs-parse-keyword, pgvector, php8, podman, psqlodbc, python-anyio, python-hpack, python-jwcrypto, python-oauthlib, python-pyjwt, python-tornado6, python-urllib3, python-virtualenv, python313-ruff, python313-social-auth-app-django, python313-urllib3, python313-urllib3_1, python313-validators, python313-waitress, python313-zipp, qemu, qsnapper, squid, strongswan, stunnel, swtpm, unbound, virtiofsd, webkit2gtk3, xen, and xwayland).

## Keycloak 26.7.0 released

DevFeed: [Keycloak 26.7.0 released](<https://devfeed.tech/articles/keycloak-26-7-0-released-31784.md>)

Original publisher: [Read original article](<https://www.keycloak.org/2026/07/keycloak-2670-released>)

Author: Keycloak Team

Published: 2026-07-09T00:00:00Z

Content type: release

Language: en

Sources: [Keycloak Blog](<https://devfeed.tech/sources/keycloak-blog.md>)

Topics: [Keycloak](<https://devfeed.tech/topics/keycloak.md>), [API](<https://devfeed.tech/topics/api.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [Security](<https://devfeed.tech/topics/security.md>), [OAuth 2.0](<https://devfeed.tech/topics/oauth2.md>), [saml](<https://devfeed.tech/topics/saml.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [deprecated](<https://devfeed.tech/tags/deprecated.md>), [haproxy](<https://devfeed.tech/tags/haproxy.md>), [high-availability](<https://devfeed.tech/tags/high-availability.md>), [idm](<https://devfeed.tech/tags/idm.md>), [kerberos](<https://devfeed.tech/tags/kerberos.md>), [keycloak](<https://devfeed.tech/tags/keycloak.md>), [keycloak-release](<https://devfeed.tech/tags/keycloak-release.md>), [ldap](<https://devfeed.tech/tags/ldap.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [oauth-2-0](<https://devfeed.tech/tags/oauth-2-0.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [persistence](<https://devfeed.tech/tags/persistence.md>), [provisioning](<https://devfeed.tech/tags/provisioning.md>), [release](<https://devfeed.tech/tags/release.md>), [saml](<https://devfeed.tech/tags/saml.md>), [security](<https://devfeed.tech/tags/security.md>), [sso](<https://devfeed.tech/tags/sso.md>), [traefik](<https://devfeed.tech/tags/traefik.md>)

### AI overview

Keycloak 26.7.0 introduces preview support for SCIM-based user provisioning and simplified multi-cluster high availability, along with enhanced HAProxy and Traefik reverse-proxy guidance and step-up authentication for SAML clients. The release also adds a more secure, OAuth 2.0-compliant Identity Brokering API v2, while V1 remains enabled by default but is deprecated. OID4VCI improvements remain experimental.

### Source excerpt

To download the release go to Keycloak downloads. Highlights This release features new capabilities for users and administrators of Keycloak. The highlights of this release are: Automate user provisioning with the SCIM API (preview) Simplified multi-cluster high availability without external caches (preview) Enhanced reverse proxy guides with blueprints for HAProxy and Traefik Step-up authentication for SAML clients Read on to learn more about each new feature. If you are upgrading from a previous release, also review the changes listed in the upgrading guide. Security and Standards Stronger security for the Identity Brokering API The Identity Brokering API allows applications to retrieve tokens obtained from external identity providers during federated login. Version 2 of this API replaces the legacy V1 with a more secure and standards-compliant design: Client-level authorization -- access to external tokens is controlled per client using dedicated settings (Allow retrieve external tokens and an identity provider allow list) instead of assigning broker roles to individual users. Confidential clients only -- public clients are rejected, ensuring that only authenticated clients can retrieve external tokens. OAuth 2.0 compliant -- the endpoint uses POST and returns standard JSON responses with access_token, error, and error_description fields. Session-based token storage -- a new Store token in session option keeps tokens in the user session for faster access, with automatic cleanup on session expiry. Database storage remains available for persistence across sessions. V2 is now supported but disabled by default. V1 is deprecated but still enabled by default for backward compatibility. In a future release, V1 will be removed and V2 will become the default. For more information, see the Identity Brokering APIs chapter in the Server Developer Guide. Progress on Verifiable Credentials (OID4VCI) (experimental) Verifiable Credentials (OID4VCI) allow organizations to issue tampe

## Essential Non Functional Requirements

DevFeed: [Essential Non Functional Requirements](<https://devfeed.tech/articles/essential-non-functional-requirements-34676.md>)

Original publisher: [Read original article](<https://newsletter.systemdesigncodex.com/p/essential-non-functional-requirements>)

Author: Saurabh Dashora

Published: 2026-07-07T08:33:34Z

Content type: tutorial

Language: en

Sources: [System Design Codex](<https://devfeed.tech/sources/system-design-codex.md>)

Topics: [Requirements](<https://devfeed.tech/topics/requirements.md>), [Scalability](<https://devfeed.tech/topics/scalability.md>), [software-architecture](<https://devfeed.tech/topics/software-architecture.md>), [Availability](<https://devfeed.tech/topics/availability.md>), [Latency](<https://devfeed.tech/topics/latency.md>), [reliability-engineering](<https://devfeed.tech/topics/reliability-engineering.md>), [Replication](<https://devfeed.tech/topics/replication.md>), [Users](<https://devfeed.tech/topics/users.md>)

Tags: [availability](<https://devfeed.tech/tags/availability.md>), [data-replication](<https://devfeed.tech/tags/data-replication.md>), [failover](<https://devfeed.tech/tags/failover.md>), [haproxy](<https://devfeed.tech/tags/haproxy.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [latency](<https://devfeed.tech/tags/latency.md>), [nginx](<https://devfeed.tech/tags/nginx.md>), [requirements](<https://devfeed.tech/tags/requirements.md>)

### AI overview

This tutorial explains non-functional requirements as quality attributes that determine how software systems behave under real-world conditions. It covers availability, latency, scalability, and durability, with implementation approaches including load balancers, health checks, failover, CDNs, data replication, horizontal scaling, Kubernetes, and concurrent API design.

### Source excerpt

Don't miss them

## Key Components of a Production Web Application

DevFeed: [Key Components of a Production Web Application](<https://devfeed.tech/articles/key-components-of-a-prod-web-application-34686.md>)

Original publisher: [Read original article](<https://newsletter.systemdesigncodex.com/p/key-components-of-a-prod-web-application>)

Author: Saurabh Dashora

Published: 2026-06-09T07:56:22Z

Content type: article

Language: en

Sources: [System Design Codex](<https://devfeed.tech/sources/system-design-codex.md>)

Topics: [Web app](<https://devfeed.tech/topics/webapp.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>), [Load Balancing](<https://devfeed.tech/topics/load-balancing.md>), [proxy](<https://devfeed.tech/topics/proxy.md>), [Cache](<https://devfeed.tech/topics/cache.md>)

Tags: [cache](<https://devfeed.tech/tags/cache.md>), [caching](<https://devfeed.tech/tags/caching.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [cloudflare](<https://devfeed.tech/tags/cloudflare.md>), [ddos](<https://devfeed.tech/tags/ddos.md>), [haproxy](<https://devfeed.tech/tags/haproxy.md>), [web](<https://devfeed.tech/tags/web.md>)

### AI overview

This article provides a high-level overview of components used in production web applications, including CI/CD pipelines, DNS resolution, load balancers, reverse proxies, and content delivery networks. It explains their roles in deployment, availability, scalability, performance, and security.

### Source excerpt

A big picture view...

## Chainguard Image now available for HAProxy

DevFeed: [Chainguard Image now available for HAProxy](<https://devfeed.tech/articles/chainguard-image-now-available-for-haproxy-12946.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/chainguard-image-now-available-for-haproxy>)

Published: 2023-02-09T00:00:00Z

Content type: release

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard images](<https://devfeed.tech/topics/chainguard-images.md>), [container](<https://devfeed.tech/topics/container.md>), [Security](<https://devfeed.tech/topics/security.md>), [vulnerability scanning](<https://devfeed.tech/topics/vulnerability-scanning.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-images](<https://devfeed.tech/tags/chainguard-images.md>), [containers](<https://devfeed.tech/tags/containers.md>), [cosign](<https://devfeed.tech/tags/cosign.md>), [cves](<https://devfeed.tech/tags/cves.md>), [haproxy](<https://devfeed.tech/tags/haproxy.md>), [haproxy-images](<https://devfeed.tech/tags/haproxy-images.md>), [image](<https://devfeed.tech/tags/image.md>), [load-balancer](<https://devfeed.tech/tags/load-balancer.md>), [minimal-image](<https://devfeed.tech/tags/minimal-image.md>), [sboms](<https://devfeed.tech/tags/sboms.md>), [secure-by-default](<https://devfeed.tech/tags/secure-by-default.md>), [secure-images](<https://devfeed.tech/tags/secure-images.md>), [toolchain](<https://devfeed.tech/tags/toolchain.md>), [vulnerability-scanning](<https://devfeed.tech/tags/vulnerability-scanning.md>), [wolfi](<https://devfeed.tech/tags/wolfi.md>)

### AI overview

Chainguard announces a Chainguard Image for HAProxy. Built on Wolfi with a hardened toolchain, the image is designed to reduce image size and known vulnerabilities while providing binaries built from source, SBOMs, signatures, and SLSA Build Level 2 provenance.

### Source excerpt

HAProxy Chainguard Image now available: Built on Wolfi, up to 90% smaller, aims for 0-known CVEs, and is built with hardened toolchain, making it memory safe.

## How SoundCloud Uses HAProxy with Kubernetes for User-Facing Traffic

DevFeed: [How SoundCloud Uses HAProxy with Kubernetes for User-Facing Traffic](<https://devfeed.tech/articles/how-soundcloud-uses-haproxy-with-kubernetes-for-user-facing-traffic-2048.md>)

Original publisher: [Read original article](<https://developers.soundcloud.com/blog//how-soundcloud-uses-haproxy-with-kubernetes-for-user-facing-traffic>)

Published: 2017-12-07T00:00:00Z

Content type: article

Language: en

Sources: [SoundCloud Backstage](<https://devfeed.tech/sources/soundcloud-backstage-blog.md>)

Topics: [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [Deployment & Scaling](<https://devfeed.tech/topics/deployment-scaling.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [applications](<https://devfeed.tech/tags/applications.md>), [architecture](<https://devfeed.tech/tags/architecture.md>), [cdn](<https://devfeed.tech/tags/cdn.md>), [cluster](<https://devfeed.tech/tags/cluster.md>), [clusters](<https://devfeed.tech/tags/clusters.md>), [configuration](<https://devfeed.tech/tags/configuration.md>), [configure](<https://devfeed.tech/tags/configure.md>), [data-center](<https://devfeed.tech/tags/data-center.md>), [deployment](<https://devfeed.tech/tags/deployment.md>), [deployment-scaling](<https://devfeed.tech/tags/deployment-scaling.md>), [developers](<https://devfeed.tech/tags/developers.md>), [dns](<https://devfeed.tech/tags/dns.md>), [edge](<https://devfeed.tech/tags/edge.md>), [haproxy](<https://devfeed.tech/tags/haproxy.md>), [has](<https://devfeed.tech/tags/has.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [management](<https://devfeed.tech/tags/management.md>), [microservices](<https://devfeed.tech/tags/microservices.md>), [platform](<https://devfeed.tech/tags/platform.md>), [scaling](<https://devfeed.tech/tags/scaling.md>), [traffic](<https://devfeed.tech/tags/traffic.md>)

### AI overview

SoundCloud routed public traffic to Kubernetes workloads in physical data centers by having HAProxy terminators send requests to NodePorts exposed on cluster nodes. A configuration generator queries Kubernetes for each service's NodePort and node list, then uses rendezvous hashing to choose a stable, service-specific subset of nodes. This reduced the tens of thousands of health checks produced when every terminator checked every node. A node agent using HAProxy's agent-check protocol shifts traffic away when a node is cordoned; service annotations also let operators adjust backend weights within seconds, including across deployments or clusters. SoundCloud found its initial HAProxy Ingress layer unreliable for high-volume traffic, difficult to keep aligned with terminator routing, and unsuitable for some long-lived connections. The NodePort approach has uneven load distribution across application instances, which SoundCloud compensates for by over-provisioning. Node replacement requires a several-hour automated configuration pipeline, and only a limited number of nodes can be replaced daily. NodePorts also cannot be removed from an existing Service; recovery so far has required re-

### Source excerpt

A little less than two years ago, SoundCloud began the journey of replacing our homegrown deployment platform, Bazooka, with Kubernetes. Kubernetes automates deployment, scaling, and management of containerized applications.

## Anatomy of an HAProxy \<-\> Java TLS bug

DevFeed: [Anatomy of an HAProxy \<-\> Java TLS bug](<https://devfeed.tech/articles/anatomy-of-an-haproxy-java-tls-bug-15500.md>)

Original publisher: [Read original article](<https://developer.squareup.com/blog/anatomy-of-an-haproxy-java-tls-bug>)

Author: Steven Davidovitz

Published: 2017-03-27T19:23:27Z

Content type: article

Language: en

Sources: [Square Corner](<https://devfeed.tech/sources/square-corner-blog-medium.md>)

Topics: [TLS (Transport Layer Security)](<https://devfeed.tech/topics/tls.md>), [Java](<https://devfeed.tech/topics/java.md>), [TLS handshake](<https://devfeed.tech/topics/tls-handshake.md>), [health check](<https://devfeed.tech/topics/health-check.md>), [Server](<https://devfeed.tech/topics/server.md>), [debugging](<https://devfeed.tech/topics/debugging.md>), [openssl](<https://devfeed.tech/topics/openssl.md>)

Tags: [bug](<https://devfeed.tech/tags/bug.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [haproxy](<https://devfeed.tech/tags/haproxy.md>), [health-checks](<https://devfeed.tech/tags/health-checks.md>), [java](<https://devfeed.tech/tags/java.md>), [tls](<https://devfeed.tech/tags/tls.md>)

### AI overview

HAProxy's SSL health checks drove CPU usage to 100% because Java backends invalidated TLS sessions after health-check connections closed without a `close_notify`. HAProxy then had to perform expensive full key exchanges on every check instead of resuming sessions; its `SslBackendKeyRate` exceeded 300 per second. Java's strict close handling was tied to protection against TLS truncation attacks, even though TLS 1.1 permits session resumption after an unclean close. The fix changed HAProxy's health-check shutdown to attempt a clean close before hard-closing, allowing session resumption. The patch was accepted and released in HAProxy 1.7.4.

### Source excerpt

Adding SSL health checks to HAProxy uncovered an interesting interaction with Java servers.

## GLB part 2: HAProxy zero-downtime, zero-delay reloads with multibinder

DevFeed: [GLB part 2: HAProxy zero-downtime, zero-delay reloads with multibinder](<https://devfeed.tech/articles/glb-part-2-haproxy-zero-downtime-zero-delay-reloads-with-multibinder-69559.md>)

Original publisher: [Read original article](<https://github.blog/news-insights/the-library/glb-part-2-haproxy-zero-downtime-zero-delay-reloads-with-multibinder/>)

Author: GitHub Engineering

Published: 2016-12-01T17:00:31Z

Content type: article

Language: en

Sources: [GitHub Blog](<https://devfeed.tech/sources/github-engineering.md>)

Topics: [zero downtime deployment](<https://devfeed.tech/topics/zero-downtime-deployment.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>), [downtime](<https://devfeed.tech/topics/downtime.md>)

Tags: [downtime](<https://devfeed.tech/tags/downtime.md>), [haproxy](<https://devfeed.tech/tags/haproxy.md>), [http-proxy](<https://devfeed.tech/tags/http-proxy.md>), [linux](<https://devfeed.tech/tags/linux.md>), [linux-kernel](<https://devfeed.tech/tags/linux-kernel.md>), [load](<https://devfeed.tech/tags/load.md>), [load-balancer](<https://devfeed.tech/tags/load-balancer.md>), [machine](<https://devfeed.tech/tags/machine.md>), [news-insights](<https://devfeed.tech/tags/news-insights.md>), [the-library](<https://devfeed.tech/tags/the-library.md>)

### AI overview

GitHub describes multibinder, a service that lets HAProxy reload without dropping queued connections or delaying them. It shares a listening socket across separate processes by passing file descriptors to HAProxy, enabling isolated instances and zero-downtime reloads.

### Source excerpt

As part of the design of GLB, we set out to solve a few of the common issues found when using HAProxy at scale.

## Context aware MySQL pools via HAProxy

DevFeed: [Context aware MySQL pools via HAProxy](<https://devfeed.tech/articles/context-aware-mysql-pools-via-haproxy-69619.md>)

Original publisher: [Read original article](<https://github.blog/engineering/infrastructure/context-aware-mysql-pools-via-haproxy/>)

Author: Shlomi Noach

Published: 2016-08-17T07:00:00Z

Content type: tutorial

Language: en

Sources: [GitHub Blog](<https://devfeed.tech/sources/github-engineering.md>), [GitHub Engineering](<https://devfeed.tech/sources/github.md>)

Topics: [MySQL](<https://devfeed.tech/topics/mysql.md>), [connection draining](<https://devfeed.tech/topics/connection-draining.md>), [least connections](<https://devfeed.tech/topics/least-connections.md>)

Tags: [availability](<https://devfeed.tech/tags/availability.md>), [cluster](<https://devfeed.tech/tags/cluster.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [haproxy](<https://devfeed.tech/tags/haproxy.md>), [infrastructure](<https://devfeed.tech/tags/infrastructure.md>), [metadata](<https://devfeed.tech/tags/metadata.md>), [mysql](<https://devfeed.tech/tags/mysql.md>)

### AI overview

The article describes GitHub's context-aware MySQL read pools behind HAProxy. Replica checks evaluate replication lag, server role, and maintenance state; when too few healthy replicas remain, HAProxy can route reads to a backup pool that accepts lagging replicas. The article also covers manual controls, monitoring, testing, and the shell-based check service used to make pool membership decisions.

### Source excerpt

At GitHub we use MySQL as our main datastore. While repository data lies in git, metadata is stored in MySQL. This includes Issues, Pull Requests, Comments etc. We also auth...

## 10x: Service Discovery at Clay.io

DevFeed: [10x: Service Discovery at Clay.io](<https://devfeed.tech/articles/10x-service-discovery-at-clay-io-35614.md>)

Original publisher: [Read original article](<https://zolmeister.com/2015/02/10x-service-discovery-at-clay-io.html>)

Author: Zoli Kahan

Published: 2015-02-17T06:00:00Z

Content type: tutorial

Language: en

Sources: [Zolmeister](<https://devfeed.tech/sources/zolmeister.md>)

Topics: [Docker](<https://devfeed.tech/topics/docker.md>), [systems](<https://devfeed.tech/topics/systems.md>), [Ansible](<https://devfeed.tech/topics/ansible.md>), [Amazon EC2](<https://devfeed.tech/topics/amazon-ec2.md>)

Tags: [ansible](<https://devfeed.tech/tags/ansible.md>), [architecture](<https://devfeed.tech/tags/architecture.md>), [docker](<https://devfeed.tech/tags/docker.md>), [haproxy](<https://devfeed.tech/tags/haproxy.md>), [tutorial](<https://devfeed.tech/tags/tutorial.md>)

### AI overview

A tutorial describing Clay.io's service-discovery architecture using Docker, Synapse, and a local HAProxy instance. Synapse dynamically configures HAProxy to route requests to services in an Amazon EC2 cluster, while Ansible supplies local IP and port configuration to services.

### Source excerpt

10x: Service Discovery at Clay.io Architecture Service Oriented Architectures can be one of the most iterable and available software configurations for building almost any product. There are many challenges that come with these systems, probably the biggest of which is service discovery. This is how your services will communicate with each other. For our service discovery, we turn again to Docker.

## Improving our SSL setup

DevFeed: [Improving our SSL setup](<https://devfeed.tech/articles/improving-our-ssl-setup-70069.md>)

Original publisher: [Read original article](<https://github.blog/news-insights/the-library/improving-our-ssl-setup/>)

Author: Dirkjan Bussink

Published: 2014-01-08T00:31:48Z

Content type: article

Language: en

Sources: [GitHub Blog](<https://devfeed.tech/sources/github-engineering.md>)

Topics: [SSL](<https://devfeed.tech/topics/ssl.md>), [Cloud Architecture](<https://devfeed.tech/topics/cloud-architecture.md>)

Tags: [ecdhe](<https://devfeed.tech/tags/ecdhe.md>), [encryption](<https://devfeed.tech/tags/encryption.md>), [haproxy](<https://devfeed.tech/tags/haproxy.md>), [news-insights](<https://devfeed.tech/tags/news-insights.md>), [ssl](<https://devfeed.tech/tags/ssl.md>), [the-library](<https://devfeed.tech/tags/the-library.md>)

### AI overview

GitHub describes its changes to SSL/TLS configuration, including prioritizing AES-GCM ciphers, using session IDs for resumption, and disabling session tickets. It explains that long-lived session ticket keys could let an attacker decrypt prior sessions, while session IDs with a five-minute lifetime limit that exposure window. The setup was chosen to maintain forward secrecy and acceptable client performance.

### Source excerpt

As we announced previously we've improved our SSL setup by deploying forward secrecy and improving the list of supported ciphers. Deploying forward secrecy and up to date cipher lists comes...

## Scaling database with Django and HAProxy

DevFeed: [Scaling database with Django and HAProxy](<https://devfeed.tech/articles/scaling-database-with-django-and-haproxy-19985.md>)

Original publisher: [Read original article](<http://engineering.hackerearth.com/2013/10/07/scaling-database-with-django-and-haproxy/>)

Published: 2013-10-07T00:00:00Z

Content type: article

Language: en

Sources: [HackerEarth](<https://devfeed.tech/sources/hackerearth.md>)

Topics: [database-scalability](<https://devfeed.tech/topics/database-scalability.md>), [Database](<https://devfeed.tech/topics/database.md>), [read-replica](<https://devfeed.tech/topics/read-replica.md>), [Load Balancing](<https://devfeed.tech/topics/load-balancing.md>), [software-architecture](<https://devfeed.tech/topics/software-architecture.md>), [Django](<https://devfeed.tech/topics/django.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>)

Tags: [availability](<https://devfeed.tech/tags/availability.md>), [cloud](<https://devfeed.tech/tags/cloud.md>), [couchdb](<https://devfeed.tech/tags/couchdb.md>), [data](<https://devfeed.tech/tags/data.md>), [database](<https://devfeed.tech/tags/database.md>), [distributed](<https://devfeed.tech/tags/distributed.md>), [django](<https://devfeed.tech/tags/django.md>), [frontend](<https://devfeed.tech/tags/frontend.md>), [haproxy](<https://devfeed.tech/tags/haproxy.md>), [json](<https://devfeed.tech/tags/json.md>), [load-balancer](<https://devfeed.tech/tags/load-balancer.md>), [master](<https://devfeed.tech/tags/master.md>), [mongodb](<https://devfeed.tech/tags/mongodb.md>), [monitoring](<https://devfeed.tech/tags/monitoring.md>), [mysql](<https://devfeed.tech/tags/mysql.md>), [nosql](<https://devfeed.tech/tags/nosql.md>), [orm](<https://devfeed.tech/tags/orm.md>), [queries](<https://devfeed.tech/tags/queries.md>), [read-replica](<https://devfeed.tech/tags/read-replica.md>), [scaling](<https://devfeed.tech/tags/scaling.md>)

### AI overview

As MySQL became a scaling bottleneck and caused downtime, HackerEarth reworked its Django application around read replicas, database routing, HAProxy, and an analytics database. Writes and reads requiring fresh data stayed on the master; custom ORM manager methods sent selected reads to replicas, accepting possible replication lag where stale results were tolerable. HAProxy balanced replica traffic and checked server health, while startup scripts refreshed its configuration because nonexistent endpoints could prevent it from starting. A router sent analytics app queries to a separate database, with router order determining which database handled each query. The article reports higher uptime and stability and more than halving server count after the architecture and code optimizations; it notes analytics replicas were not yet in use.

### Source excerpt

###MySQL - Primary data store At HackerEarth, we use MySQL database as the primary data store. We have experimented with a few NoSQL databases on the way, but the results have been largely unsatisfactory. The distributed databases like MongoDB or CouchDB aren't very scalable or stable. Right now, our status monitoring services use RethinkDB for storing the data in JSON format and that's all for the NoSQL database usage right now. With the growing data and number of requests/sec, it turns out that the database becomes the major bottlneck to scale the application dynamically. At this point if you are thinking that there are mythical (cloud) providers who can handle the growing need of your application, you can't be more wrong. To make the problem even harder, you can't spin a new database whenever you want to just like your frontend servers. To achieve a horizontal scalability at all levels, it requires massive rearchitecture of the system while being completely transparent to the end user. This is what a part of our team has focussed on in last few months, resulting in very high uptime and availability. The master (and only) MySQL database had started being under heavy load recently. We thought we will delay any scalability at this level till the single database could handle the load, and we will work on other high priority things. But that was not supposed to go as planned and we experienced a few downtimes. After that we did a rearchitecture of our application, sharded the database, wrote database routers and wrappers on top of django ORM, put HAProxy load balancer infront of the MySQL databases, and refactored our codebase to optimize it significantly. The image below shows a part of the architecture we have at HackerEarth. Many other components have been omitted for simplicity. ###Database slaves and router The idea was to create read replicas and route the write queries to master database and read queries to slave (read replica) databases. But that was not so si

## Proxy socket.io and nginx on the same port, over SSL

DevFeed: [Proxy socket.io and nginx on the same port, over SSL](<https://devfeed.tech/articles/proxy-socket-io-and-nginx-on-the-same-port-over-ssl-35445.md>)

Original publisher: [Read original article](<https://darkcoding.net/software/proxy-socket-io-and-nginx-on-the-same-port-over-ssl/>)

Author: Graham King

Published: 2011-12-22T22:32:26Z

Content type: tutorial

Language: en

Sources: [Graham King](<https://devfeed.tech/sources/graham-king.md>)

Topics: [Socket.IO](<https://devfeed.tech/topics/socket-io.md>), [nginx](<https://devfeed.tech/topics/nginx.md>), [proxy](<https://devfeed.tech/topics/proxy.md>), [SSL](<https://devfeed.tech/topics/ssl.md>), [real-time](<https://devfeed.tech/topics/real-time.md>), [Web](<https://devfeed.tech/topics/web.md>), [Django](<https://devfeed.tech/topics/django.md>), [Back end](<https://devfeed.tech/topics/backend.md>)

Tags: [django](<https://devfeed.tech/tags/django.md>), [haproxy](<https://devfeed.tech/tags/haproxy.md>), [http](<https://devfeed.tech/tags/http.md>), [nginx](<https://devfeed.tech/tags/nginx.md>), [proxy](<https://devfeed.tech/tags/proxy.md>), [realtime](<https://devfeed.tech/tags/realtime.md>), [server](<https://devfeed.tech/tags/server.md>), [socket](<https://devfeed.tech/tags/socket.md>), [software](<https://devfeed.tech/tags/software.md>), [ssl](<https://devfeed.tech/tags/ssl.md>)

### AI overview

A tutorial for running Socket.IO realtime traffic and a Django web application on the same SSL port. It uses stunnel to terminate SSL, HAProxy to route WebSocket traffic to Node.js and web traffic to nginx, and nginx with Gunicorn to serve the Django application.

### Source excerpt

Streamline your SSL setup: Realtime and web on one port.

## This Morning's Git Protocol Outage

DevFeed: [This Morning's Git Protocol Outage](<https://devfeed.tech/articles/this-morning-s-git-protocol-outage-70712.md>)

Original publisher: [Read original article](<https://github.blog/news-insights/the-library/this-morning-s-git-protocol-outage/>)

Author: Tom Preston-Werner

Published: 2010-09-29T00:48:16Z

Content type: news

Language: en

Sources: [GitHub Blog](<https://devfeed.tech/sources/github-engineering.md>)

Topics: [GCP outage lessons learned](<https://devfeed.tech/topics/gcp-outage-lessons-learned.md>), [cloud service outage management](<https://devfeed.tech/topics/cloud-service-outage-management.md>), [infrastructure monitoring](<https://devfeed.tech/topics/infrastructure-monitoring.md>)

Tags: [availability](<https://devfeed.tech/tags/availability.md>), [git](<https://devfeed.tech/tags/git.md>), [haproxy](<https://devfeed.tech/tags/haproxy.md>), [http](<https://devfeed.tech/tags/http.md>), [news-insights](<https://devfeed.tech/tags/news-insights.md>), [outage](<https://devfeed.tech/tags/outage.md>), [the-library](<https://devfeed.tech/tags/the-library.md>), [timeout](<https://devfeed.tech/tags/timeout.md>)

### AI overview

Anonymous Git clones were unavailable for several hours after a change removed HAProxy's client inactivity timeout, allowing idle connections to exhaust the session limit. SSH and HTTP clones remained available. The timeout was restored, and GitHub said it was improving monitoring and reviewing future changes.

### Source excerpt

Anonymous Git clones were offline this morning for several hours (SSH and HTTP clones remained functional). Several days ago we removed the client inactivity timeout from our backend HAProxy configuration...