Bon comme y avait pas d'agent #HAProxy récent pour tourner sur du windows, j'en ai refait un en utilisant #powershell qui va créer une écoute sur un port TCP pour renvoyer les infos de charge CPU / RAM et définir un score de charge qu'il renverra au HAProxy pour faire du poids dynamique.

Maintenant, je veux créer un service Windows qui fera appel à ce script. Je vois plein de trucs utilisant des modules externes, mais y a pas un moyen tout clair et simple de faire un service avec des outils intégrés ?

What I wanted to do:
Move this mastodon instance from its current datacenter location to my homelab.

What I did:
Update all my #proxmox nodes to the latest release, remove #haproxy and #acme packages from #pfsense in favour of a dedicated machine handling it.

That machine, however, still needs an ansible role and playbook to be written, in order to set it up

Let's gooooo!

Uff! #OpenSSL has really gone down the hill :

“The State of SSL Stacks”, HAProxy (https://www.haproxy.com/blog/state-of-ssl-stacks).

Via HN: https://news.ycombinator.com/item?id=43912164

On Lobsters: https://lobste.rs/s/bqnktb/state_ssl_stacks

@dvl Hi! Thanks for your blog post https://dan.langille.org/2025/05/03/implement-anubis-to-give-the-bots-a-harder-time/

I find it very useful.

https://www.mail-archive.com/haproxy@formilux.org/msg45917.html #HAProxy 3.2.0 was released, featuring an experimental ACME client, real QUIC support for OpenSSL 3.5 and a lot of other stuff.

Did a quick writeup of how I use #anubis behind #haproxy in my #homelab.

https://mktbs.net/blog/2025/05/19/running-anubis-behind-haproxy/

Thanks to @cadey for the project. Support them!

Neskutečná haluz: Na ssl terminaci používám #haproxy s konfigurací:

frontend https
bind *:443 ssl crt /etc/haproxy/ssl/__fallback.pem crt /etc/haproxy/ssl

kam prostřednictvím skriptu https://github.com/VitexSoftware/certbot-haproxy/blob/develop/certbot-haproxy-deploy

hrnu výslednou kombinaci privkey + fullchain .pem

A co se nestalo, jedna doména jako na potvoru ať jsem dělal co jsem dělal měla sice na disku čerstvý certifikát, ale v #https byl expirovaný ....

Po X hodinách zoufalého laborování, reloadování a restartování a vzniku skriptu https://github.com/VitexSoftware/certbot-haproxy/blob/develop/check-haproxy-certs.sh jsem se nasral a celé to rebootnul ...

A server nejenže potom nabootoval, ale dokonce začal posílat správný certifikát ...

Kde to sakra mohlo být zastydlé, že nepomohl ani stop a start haproxy démona ? To mi hlava nebere :(

filesystém je normální /dev/sda2 on / type ext4 (rw,noatime) - m2 terová karta přes JMS583Gen 2 to PCIe Gen3x2 Bridge do USB a zbytek HW je #RPi5 s 8Gb ram

před rebootem jsem koukal i na výpis dmesg a žádné problémy s filesystémem nebo usb jsem tam neviděl

Dans ce (long et très détaillé) article sur l’état des stacks SSL, l’équipe de #haproxy (confirmée par d’autres équipes telles que Curl, Akamai, Microsoft…) tacle lourdement #OpenSSL sur la qualité du code et surtout sur la gouvernance du projet. Ça pique.
https://www.haproxy.com/blog/state-of-ssl-stacks

Long, but great read from #HAProxy on the state of #TLS libraries. Includes some scathing remarks about the #OpenSSL project.

“The development team has degraded their project’s quality, failed to address ongoing issues, and consistently dismissed widespread community requests for even minor improvements.”

“This unfortunate situation considerably hurts QUIC protocol adoption. It even makes it difficult to develop or build test tools to monitor a QUIC server.”

“When some of the project members considered a 32% performance regression ‘pretty near’ the original performance, it signaled to our development team that any meaningful improvement was unlikely.”

“In blunt terms: running OpenSSL 3.0.2 as shipped with Ubuntu 22.04 results in 1/100 of #WolfSSL’s performance on identical hardware! To put this into perspective, you would have to deploy 100 times the number of machines to handle the same traffic, solely because of the underlying SSL library.”

https://infosec.exchange/@0xabad1dea/114466046966536049

“AWS-LC looks like a very active project with a strong community. […] Even the recently reported performance issue was quickly fixed and released with the next version. […] This is definitely a library that anyone interested in the topic should monitor.”

#OpenSSL #BoringSSL #WolfSSL #AWSLC #HAProxy #OpenSource #FreeSoftware #FOSS #OSS #TLS #QUIC
https://www.haproxy.com/blog/state-of-ssl-stacks

Because I'm stupid, my next little project is simplifying not only #distrohopping but OS-hopping (in a very limited and specific way):

I'm attempting to build an #Ansible play to deploy #HAProxy with #acme (via acme.sh) identically across #Fedora #Debian #Ubuntu and #FreeBSD servers. Why? Why not?

Le numéro mai-juin de Linux Pratique (disponible en kiosque dans une semaine) contient mon nouvel article traitant de la gestion de #haproxy à l'aide de #terraform.
Si vous le lisez, n'hésitez pas à me partager vos retours