[HN Gopher] Poor Man's Global Traffic Manager
       ___________________________________________________________________
        
       Poor Man's Global Traffic Manager
        
       Author : Snawoot
       Score  : 7 points
       Date   : 2022-08-20 19:23 UTC (3 hours ago)
        
 (HTM) web link (gist.github.com)
 (TXT) w3m dump (gist.github.com)
        
       | Nextgrid wrote:
       | Doesn't this ignore the fact that a lot of DNS resolvers don't
       | respect the TTL and cache for way longer than they should?
        
         | zhfliz wrote:
         | isn't it usually the opposite, except for client applications
         | that ignore the ttl they got from their recursive resolver as
         | they don't want to bother with keeping track of ttls?
        
           | icedchai wrote:
           | When I ran a small web hosting provider, we had some clients
           | (mostly bots, I think) hitting old IPs for _months._ We had
           | kept the TTL below 5 minutes for a very long time before
           | migration.
           | 
           | Also, older Java apps would cache DNS lookups _forever_ ,
           | until you restarted the JVM. I remember arguing back and
           | forth in email with a "vendor." They finally believed me and
           | restarted their app server.
        
       | gandalfk7 wrote:
       | I did something almost identical and it's working wonders with
       | haproxy and "mode tcp" to pass the ssl connection just reading
       | SNI to the backend without terminating it.
       | 
       | I've used a delegated zone to achieve that, I like your catch-all
       | approach better since it's cleaner, in a future rewrite I might
       | change it.
       | 
       | I am now testing the configuration with proxy-protocol to pass
       | the information on the client IP which otherwise would be lost,
       | it's working but certbot does not like it so it needs a dedicated
       | backend with a rule.
       | 
       | I've also created an Ansible playbook that does the installation
       | for you and retrieves the haproxy config from a git repo so it's
       | always in-sync on the balancer machines:
       | https://blog.gandalfk7.it/posts/20220201_01_diy-balancer-wit...
        
       ___________________________________________________________________
       (page generated 2022-08-20 23:01 UTC)