Re: [ANNOUNCE] haproxy-1.8.13

2018-07-30 Thread Willy Tarreau
Hi Vincent, On Mon, Jul 30, 2018 at 11:16:39PM +0200, Vincent Bernat wrote: > ? 30 juillet 2018 20:55 +0200, Willy Tarreau  : > > > What I don't like with PGP on an exposed machine is that it reduces the > > size of your 4096-bit key to the size of your passphrase (which most > > often contains

Re: [ANNOUNCE] haproxy-1.8.13

2018-07-30 Thread Vincent Bernat
❦ 30 juillet 2018 20:55 +0200, Willy Tarreau  : > What I don't like with PGP on an exposed machine is that it reduces the > size of your 4096-bit key to the size of your passphrase (which most > often contains much less than the ~700 characters it would need to be > as large), and also increases

Re: [ANNOUNCE] haproxy-1.8.13

2018-07-30 Thread Willy Tarreau
On Mon, Jul 30, 2018 at 07:41:33PM +0200, Tim Düsterhus wrote: > Willy, > > Am 30.07.2018 um 18:05 schrieb Willy Tarreau: > > A small update happened to the download directory, the sha256 of the > > tar.gz files are now present in addition to the (quite old) md5 ones. > > We may start to think

Re: [ANNOUNCE] haproxy-1.8.13

2018-07-30 Thread Tim Düsterhus
Willy, Am 30.07.2018 um 18:05 schrieb Willy Tarreau: > A small update happened to the download directory, the sha256 of the > tar.gz files are now present in addition to the (quite old) md5 ones. > We may start to think about phasing md5 signatures out, for example > after 1.9 is released. I'd

Re: [ANNOUNCE] haproxy-1.8.13

2018-07-30 Thread Aleksandar Lazic
On 30/07/2018 18:05, Willy Tarreau wrote: Hi, HAProxy 1.8.13 was released on 2018/07/30. It added 28 new commits after version 1.8.12. Nothing critical this time, however we finally got rid of the annoying CLOSE_WAIT on H2 thanks to the continued help from Milan Petruzelka, Janusz Dziemidowicz

Re: Help with backend server sni setup

2018-07-30 Thread Aleksandar Lazic
Hi. On 30/07/2018 16:39, Lukas Tribus wrote: On Mon, 30 Jul 2018 at 13:30, Aleksandar Lazic wrote: Hi. I have the following Setup. APP -> Internal Haproxy -(HTTPS)-> external HAProxy -> APP The external HAProxy is configured with multiple TLS Vhost. Never use SNI for Vhosting. It should

[ANNOUNCE] haproxy-1.8.13

2018-07-30 Thread Willy Tarreau
Hi, HAProxy 1.8.13 was released on 2018/07/30. It added 28 new commits after version 1.8.12. Nothing critical this time, however we finally got rid of the annoying CLOSE_WAIT on H2 thanks to the continued help from Milan Petruzelka, Janusz Dziemidowicz and Olivier Doucet. Just for this it was

Re: Help with backend server sni setup

2018-07-30 Thread Lukas Tribus
On Mon, 30 Jul 2018 at 13:30, Aleksandar Lazic wrote: > > Hi. > > I have the following Setup. > > APP -> Internal Haproxy -(HTTPS)-> external HAProxy -> APP > > The external HAProxy is configured with multiple TLS Vhost. Never use SNI for Vhosting. It should work with the host header only. SNI

Understanding certain balance configuration

2018-07-30 Thread Veiko Kukk
Hi, I'm trying to understand how balance url_param hash-type consistent should work. Haproxy 1.7.11. Lets say, we have a config of two haproxy instances that balance content between local and remote (sibling). server0 (10.0.0.1) would have config section like this: backend load_balancer

Re: force-persist and use_server combined

2018-07-30 Thread Veiko Kukk
On 07/25/2018 03:05 PM, Veiko Kukk wrote: The idea here is that HAproxy statistics page, some other backend statistics and also some remote health checks running against path under /dl/ would always reach only local_http_frontend, never go anywhere else even when local really is down, not just

Help with backend server sni setup

2018-07-30 Thread Aleksandar Lazic
Hi. I have the following Setup. APP -> Internal Haproxy -(HTTPS)-> external HAProxy -> APP The external HAProxy is configured with multiple TLS Vhost. I assume that when I add `server sni appinternal.domain.com` to the server line will be set the hostname field in the TLS session to this

Re: [PATCH] MEDIUM: proxy_protocol: Convert IPs to v6 when protocols are mixed

2018-07-30 Thread Willy Tarreau
Hi Tim, On Fri, Jul 27, 2018 at 06:46:13PM +0200, Tim Duesterhus wrote: > Willy, > > attached is an updated patch that: > > 1. Only converts the addresses to IPv6 if at least one of them is IPv6. >But it does not convert them to IPv4 if both of them can be converted to > IPv4. > 2. Does