@matteo-nunziati said in how do you deal with SPOF with HAproxy: @stacksofplates said in how do you deal with SPOF with HAproxy: Keepalived is most likely what you're looking for. You assign a VIP to your interface and it keeps a heartbeat between the systems. The VIP (floating IP) will move between systems if there is an issue. Once that's set up, use Serf to update your HAProxy configs or Consul for automatic service discovery which HAProxy can read. If you're using a cloud provider, I'd just use one of their provided load balancers. +1 for serf but I can not find any doc about serf as a distributed config (as consul). I know about serf as a discovery/alive tool only... When systems send their messages to the cluster they can run a script depending on the message. Their example repository has simple Bash scripts to update an HAProxy config. https://github.com/hashicorp/serf/blob/master/demo/web-load-balancer/README.md It's very very simple, but sometimes that's easier than setting up a full Consul cluster.

@nashbrydges said in Nginx Active-Passive HA: @jaredbusch said in Nginx Active-Passive HA: @NashBrydges side question. If you setup the .well-known to work correctly, why do you then need the HA? because nginx will never be down except for the momentary reload after the certs are updated. That certainly addresses the biggest concern about a long downtime during the renewall process for a high number of certs and probably addresses most concerns with this client. He's already running Veeam replication to a second box so his RTO and RPO are relatively short and within his business tolerance. Having said that, it's a great learning opportunity for me to set this up in my lab, if for no other reason than to try it and see how it works. Certainly no reason not to do it for a lab. and for a proxy with as much as it sounds like you have in production, it will still be a likely good solution.

Good read and it explains very clearly what split-brain is, and how to prevent it in simple enough terms. I've had to explain many times myself what split-brain is and ways to prevent it. I just get starred at. . .

@oksana Still backups are needed

@mlnews Thread resurrected !!! I see, interesting . Regarding Ovirt + GLusterFs my update on this is that did learn glustering and it was easy to perform. I didnt apply it in production or VMs. I did use Ovirt a month ago and it was very slow web ui experience. I should write a thread about my and Gluster.