Merge ~hloeung/content-cache-charm:haproxy-config into content-cache-charm:master

[Haw Loeung]

Automatically calculate max. connections - LP:1866036

This is now split to per site in the 'default' stanza rather than each site's listen stanza. Also, the global max. connections is now a total of each per-site.

Willy explains it best in https://stackoverflow.com/questions/8750518/difference-between-global-maxconn-and-server-maxconn-haproxy

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[Tom Haddon (mthaddon)]

Overall this looks very good. Could we have a test where maxconn is set to something other than 0 to confirm manually setting it does the right thing?

[Stuart Bishop (stub)]

Code changes all look good. This changes the meaning of the charm config from global max-connections to per-site max-connections, which is a backwards incompatible change but one we should be able to live with (anyone besides Canonical running this charm?).

review: Approve

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change successfully merged at revision 00ab9893d3074fccb217ab12b33e683c14d35b89

diff --git a/config.yaml b/config.yaml
index d6bb918..4b5d99b 100644
--- a/config.yaml
+++ b/config.yaml
@@ -38,10 +38,10 @@ options:
       Number of log files to retain during rotation.
   max_connections:
     type: int
-    default: 8192
+    default: 0
     description: >
-      Configure maximum number of connections on frontend HAProxy. (8192 for now,
-      the default will automatically be calculated in the future)
+      Configure maximum number of connections per site on frontend
+      HAProxy. Defaults to auto-calculate (0).
   nagios_context:
     type: string
     default: "juju"
diff --git a/lib/haproxy.py b/lib/haproxy.py
index 6c70fc4..e3a4d38 100644
--- a/lib/haproxy.py
+++ b/lib/haproxy.py
@@ -14,9 +14,9 @@ TLS_CIPHER_SUITES = 'ECDHE+AESGCM:ECDHE+AES256:ECDHE+AES128:!SSLv3:!TLSv1'
 
 
 class HAProxyConf:
-    def __init__(self, conf_path=HAPROXY_BASE_PATH, max_connections=2000):
+    def __init__(self, conf_path=HAPROXY_BASE_PATH, max_connections=0):
         self._conf_path = conf_path
-        self.max_connections = max_connections
+        self.max_connections = int(max_connections)
 
     @property
     def conf_path(self):
@@ -99,7 +99,6 @@ class HAProxyConf:
         listen_stanza = """
 listen {name}
 {bind_config}
-    maxconn {max_connections}
 {backend_config}"""
         backend_conf = '{indent}use_backend backend-{backend} if {{ hdr(Host) -i {site_name} }}\n'
         redirect_conf = '{indent}redirect scheme https code 301 if {{ hdr(Host) -i {site_name} }} !{{ ssl_fc }}\n'
@@ -153,11 +152,7 @@ listen {name}
             if address == '0.0.0.0':
                 bind_config += '\n{indent}bind :::{port}{tls}'.format(port=port, tls=tls_config, indent=INDENT)
             output = listen_stanza.format(
-                name=name,
-                max_connections=self.max_connections,
-                backend_config=''.join(backend_config),
-                bind_config=bind_config,
-                indent=INDENT,
+                name=name, backend_config=''.join(backend_config), bind_config=bind_config, indent=INDENT,
             )
             rendered_output.append(output)
         return rendered_output
@@ -250,18 +245,25 @@ backend backend-{name}
     def render(self, config, num_threads=None, monitoring_password=None, tls_cipher_suites=None):
         if not num_threads:
             num_threads = multiprocessing.cpu_count()
+        if self.max_connections:
+            max_connections = self.max_connections
+        else:
+            max_connections = num_threads * 2000
         if not tls_cipher_suites:
             tls_cipher_suites = TLS_CIPHER_SUITES
         tls_cipher_suites = utils.tls_cipher_suites(tls_cipher_suites)
 
+        listen_stanzas = self.render_stanza_listen(config)
+
         base = os.path.dirname(os.path.dirname(os.path.realpath(__file__)))
         env = jinja2.Environment(loader=jinja2.FileSystemLoader(base))
         template = env.get_template('templates/haproxy_cfg.tmpl')
         return template.render(
             {
                 'backend': self.render_stanza_backend(config),
-                'listen': self.render_stanza_listen(config),
-                'max_connections': self.max_connections,
+                'global_max_connections': max_connections * len(listen_stanzas),
+                'listen': listen_stanzas,
+                'max_connections': max_connections,
                 'monitoring_password': monitoring_password or self.monitoring_password,
                 'num_threads': num_threads,
                 'tls_cipher_suites': tls_cipher_suites,
diff --git a/reactive/content_cache.py b/reactive/content_cache.py
index ea8cf20..450c63f 100644
--- a/reactive/content_cache.py
+++ b/reactive/content_cache.py
@@ -204,9 +204,7 @@ def configure_haproxy():  # NOQA: C901 LP#1825084
         status.blocked('requires list of sites to configure')
         return
 
-    # TODO: Calculate max connections if none specified. Likely use configured
-    # nbthreads (2000 * nbthreads). Or maybe even per site.
-    haproxy = HAProxy.HAProxyConf(max_connections=config['max_connections'])
+    haproxy = HAProxy.HAProxyConf(max_connections=config.get('max_connections', 0))
     sites_secrets = secrets_from_config(config.get('sites_secrets'))
     blacklist_ports = [int(x.strip()) for x in config.get('blacklist_ports', '').split(',') if x.strip()]
     sites = sites_from_config(config.get('sites'), sites_secrets, blacklist_ports=blacklist_ports)
diff --git a/templates/haproxy_cfg.tmpl b/templates/haproxy_cfg.tmpl
index a4ec3be..aee0e16 100644
--- a/templates/haproxy_cfg.tmpl
+++ b/templates/haproxy_cfg.tmpl
@@ -1,6 +1,6 @@
 global
 	nbthread {{num_threads}}
-	maxconn {{max_connections}}
+	maxconn {{global_max_connections}}
 	log /dev/log	local0
 	log /dev/log	local1 notice
 	chroot /var/lib/haproxy
@@ -26,6 +26,7 @@ global
 
 defaults
 	log	global
+	maxconn {{max_connections}}
 	mode	http
 	option	httplog
 	option	dontlognull
@@ -59,3 +60,4 @@ listen  stats
 {% for stanza in backend -%}
 {{stanza}}
 {%- endfor -%}
+
diff --git a/tests/unit/files/content_cache_rendered_haproxy_test_output.txt b/tests/unit/files/content_cache_rendered_haproxy_test_output.txt
index b715f9d..73063ab 100644
--- a/tests/unit/files/content_cache_rendered_haproxy_test_output.txt
+++ b/tests/unit/files/content_cache_rendered_haproxy_test_output.txt
@@ -1,6 +1,6 @@
 global
 	nbthread 4
-	maxconn 8192
+	maxconn 106496
 	log /dev/log	local0
 	log /dev/log	local1 notice
 	chroot /var/lib/haproxy
@@ -26,6 +26,7 @@ global
 
 defaults
 	log	global
+	maxconn 8192
 	mode	http
 	option	httplog
 	option	dontlognull
@@ -56,7 +57,6 @@ listen  stats
 listen combined-80
     bind 0.0.0.0:80
     bind :::80
-    maxconn 8192
     use_backend backend-cached-site1-local if { hdr(Host) -i site1.local }
     redirect scheme https code 301 if { hdr(Host) -i site2.local } !{ ssl_fc }
     use_backend backend-cached-site3-local if { hdr(Host) -i site3.local }
@@ -67,65 +67,53 @@ listen combined-80
 
 listen site1-local
     bind 127.0.0.1:8080
-    maxconn 8192
     default_backend backend-site1-local
 
 listen cached-site2-local
     bind 0.0.0.0:443 ssl crt /etc/haproxy/site2-bundle.crt
     bind :::443 ssl crt /etc/haproxy/site2-bundle.crt
-    maxconn 8192
     default_backend backend-cached-site2-local
 
 listen site2-local
     bind 127.0.0.1:8081
-    maxconn 8192
     default_backend backend-site2-local
 
 listen site3-local
     bind 127.0.0.1:8082
-    maxconn 8192
     default_backend backend-site3-local
 
 listen site5
     bind 127.0.0.1:8083
-    maxconn 8192
     default_backend backend-site5
 
 listen site5-2
     bind 127.0.0.1:8084
-    maxconn 8192
     default_backend backend-site5
 
 listen site6-local
     bind 127.0.0.1:8085
-    maxconn 8192
     default_backend backend-site6-local
 
 listen combined-444
     bind 0.0.0.0:444 ssl crt /etc/haproxy/site7-bundle.crt crt /etc/haproxy/site8-bundle.crt
     bind :::444 ssl crt /etc/haproxy/site7-bundle.crt crt /etc/haproxy/site8-bundle.crt
-    maxconn 8192
     use_backend backend-cached-site7-local if { hdr(Host) -i site7.local }
     use_backend backend-cached-site8-local if { hdr(Host) -i site8.local }
 
 listen site7-local
     bind 127.0.0.1:8086
-    maxconn 8192
     default_backend backend-site7-local
 
 listen site8-local
     bind 127.0.0.1:8087
-    maxconn 8192
     default_backend backend-site8-local
 
 listen site8-local-2
     bind 127.0.0.1:8088
-    maxconn 8192
     default_backend backend-site8-local
 
 listen site9-local
     bind 127.0.0.1:8089
-    maxconn 8192
     default_backend backend-site9-local
 
 backend backend-cached-site1-local
diff --git a/tests/unit/files/content_cache_rendered_haproxy_test_output_auto_maxconns.txt b/tests/unit/files/content_cache_rendered_haproxy_test_output_auto_maxconns.txt
new file mode 100644
index 0000000..cad0ce4
--- /dev/null
+++ b/tests/unit/files/content_cache_rendered_haproxy_test_output_auto_maxconns.txt
@@ -0,0 +1,246 @@
+global
+	nbthread 4
+	maxconn 104000
+	log /dev/log	local0
+	log /dev/log	local1 notice
+	chroot /var/lib/haproxy
+	stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
+	stats timeout 30s
+	user haproxy
+	group haproxy
+	daemon
+
+	# Default SSL material locations
+	ca-base /etc/ssl/certs
+	crt-base /etc/ssl/private
+
+	# Default ciphers to use on SSL-enabled listening sockets.
+	# For more information, see ciphers(1SSL). This list is from:
+	#  https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
+	# An alternative list with additional directives can be obtained from
+	#  https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=haproxy
+	ssl-default-bind-ciphers ECDHE+AESGCM:ECDHE+AES256:ECDHE+AES128:!SSLv3:!TLSv1
+	ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11
+	# We'll eventually disable DHE (LP#1825321), but for now, bump DH params
+	tune.ssl.default-dh-param 2048
+
+defaults
+	log	global
+	maxconn 8000
+	mode	http
+	option	httplog
+	option	dontlognull
+	timeout connect 5000
+	timeout client  50000
+	timeout server  50000
+	errorfile 400 /etc/haproxy/errors/400.http
+	errorfile 403 /etc/haproxy/errors/403.http
+	errorfile 408 /etc/haproxy/errors/408.http
+	errorfile 500 /etc/haproxy/errors/500.http
+	errorfile 502 /etc/haproxy/errors/502.http
+	errorfile 503 /etc/haproxy/errors/503.http
+	errorfile 504 /etc/haproxy/errors/504.http
+
+listen  stats
+	bind 127.0.0.1:10000
+	acl allowed_cidr src 127.0.0.0/8
+	http-request deny unless allowed_cidr
+
+	mode http
+	stats enable
+	stats uri /
+	stats realm Haproxy\ Statistics
+	stats auth haproxy:biometricsarenotsecret
+	stats refresh 3
+
+
+listen combined-80
+    bind 0.0.0.0:80
+    bind :::80
+    use_backend backend-cached-site1-local if { hdr(Host) -i site1.local }
+    redirect scheme https code 301 if { hdr(Host) -i site2.local } !{ ssl_fc }
+    use_backend backend-cached-site3-local if { hdr(Host) -i site3.local }
+    use_backend backend-cached-site4-local if { hdr(Host) -i site4.local }
+    use_backend backend-cached-site5 if { hdr(Host) -i site5.local }
+    use_backend backend-cached-site6-local if { hdr(Host) -i site6.local }
+    use_backend backend-cached-site9-local if { hdr(Host) -i site9.local }
+
+listen site1-local
+    bind 127.0.0.1:8080
+    default_backend backend-site1-local
+
+listen cached-site2-local
+    bind 0.0.0.0:443 ssl crt /etc/haproxy/site2-bundle.crt
+    bind :::443 ssl crt /etc/haproxy/site2-bundle.crt
+    default_backend backend-cached-site2-local
+
+listen site2-local
+    bind 127.0.0.1:8081
+    default_backend backend-site2-local
+
+listen site3-local
+    bind 127.0.0.1:8082
+    default_backend backend-site3-local
+
+listen site5
+    bind 127.0.0.1:8083
+    default_backend backend-site5
+
+listen site5-2
+    bind 127.0.0.1:8084
+    default_backend backend-site5
+
+listen site6-local
+    bind 127.0.0.1:8085
+    default_backend backend-site6-local
+
+listen combined-444
+    bind 0.0.0.0:444 ssl crt /etc/haproxy/site7-bundle.crt crt /etc/haproxy/site8-bundle.crt
+    bind :::444 ssl crt /etc/haproxy/site7-bundle.crt crt /etc/haproxy/site8-bundle.crt
+    use_backend backend-cached-site7-local if { hdr(Host) -i site7.local }
+    use_backend backend-cached-site8-local if { hdr(Host) -i site8.local }
+
+listen site7-local
+    bind 127.0.0.1:8086
+    default_backend backend-site7-local
+
+listen site8-local
+    bind 127.0.0.1:8087
+    default_backend backend-site8-local
+
+listen site8-local-2
+    bind 127.0.0.1:8088
+    default_backend backend-site8-local
+
+listen site9-local
+    bind 127.0.0.1:8089
+    default_backend backend-site9-local
+
+backend backend-cached-site1-local
+    option forwardfor
+    option httpchk HEAD /?token=1861920000_f3e404e205ed44749e942d481f7a7bec57c5e78a HTTP/1.0\r\nHost:\ site1.local\r\nUser-Agent:\ haproxy/httpchk\r\nCache-Control:\ no-cache
+    http-request set-header Host site1.local
+    balance leastconn
+    server server_1 127.0.0.1:6080 check inter 5000 rise 2 fall 5 maxconn 2048
+
+backend backend-site1-local
+    option httpchk HEAD / HTTP/1.0\r\nHost:\ site1.local\r\nUser-Agent:\ haproxy/httpchk\r\nCache-Control:\ no-cache
+    http-request set-header Host site1.local
+    balance leastconn
+    server server_1 127.0.1.10:80 check inter 5000 rise 2 fall 5 maxconn 2048
+    server server_2 127.0.1.11:80 check inter 5000 rise 2 fall 5 maxconn 2048
+    server server_3 127.0.1.12:80 check inter 5000 rise 2 fall 5 maxconn 2048
+
+backend backend-cached-site2-local
+    option forwardfor
+    option httpchk GET /check/ HTTP/1.0\r\nHost:\ site2.local\r\nUser-Agent:\ haproxy/httpchk\r\nCache-Control:\ no-cache
+    http-request set-header Host site2.local
+    balance leastconn
+    server server_1 127.0.0.1:6081 check inter 5000 rise 2 fall 5 maxconn 2048
+
+backend backend-site2-local
+    option httpchk GET /check/ HTTP/1.0\r\nHost:\ site2.local\r\nUser-Agent:\ haproxy/httpchk\r\nCache-Control:\ no-cache
+    http-request set-header Host site2.local
+    balance leastconn
+    server server_1 127.0.1.10:443 check inter 5000 rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt
+    server server_2 127.0.1.11:443 check inter 5000 rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt
+    server server_3 127.0.1.12:443 check inter 5000 rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt
+
+backend backend-cached-site3-local
+    option forwardfor
+    option httpchk HEAD / HTTP/1.0\r\nHost:\ site3.local\r\nUser-Agent:\ haproxy/httpchk\r\nCache-Control:\ no-cache
+    http-request set-header Host site3.local
+    balance leastconn
+    server server_1 127.0.0.1:6082 check inter 5000 rise 2 fall 5 maxconn 4096
+
+backend backend-site3-local
+    option httpchk HEAD / HTTP/1.0\r\nHost:\ site3.local\r\nUser-Agent:\ haproxy/httpchk\r\nCache-Control:\ no-cache
+    http-request set-header Host site3.local
+    balance leastconn
+    server server_1 127.0.1.10:80 check inter 5000 rise 2 fall 5 maxconn 2048
+    server server_2 127.0.1.11:80 check inter 5000 rise 2 fall 5 maxconn 2048
+    server server_3 127.0.1.12:80 check inter 5000 rise 2 fall 5 maxconn 2048
+
+backend backend-cached-site4-local
+    option forwardfor
+    option httpchk HEAD / HTTP/1.0\r\nHost:\ site4.local\r\nUser-Agent:\ haproxy/httpchk\r\nCache-Control:\ no-cache
+    http-request set-header Host site4.local
+    balance leastconn
+    server server_1 127.0.0.1:6083 check inter 5000 rise 2 fall 5 maxconn 2048
+
+backend backend-cached-site5
+    option forwardfor
+    option httpchk HEAD / HTTP/1.0\r\nHost:\ site5.local\r\nUser-Agent:\ haproxy/httpchk\r\nCache-Control:\ no-cache
+    http-request set-header Host site5.local
+    balance leastconn
+    server server_1 127.0.0.1:6084 check inter 5000 rise 2 fall 5 maxconn 2048
+
+backend backend-site5
+    option httpchk HEAD / HTTP/1.0\r\nHost:\ site5.local\r\nUser-Agent:\ haproxy/httpchk\r\nCache-Control:\ no-cache
+    http-request set-header Host site5.local
+    balance leastconn
+    server server_1 127.0.1.10:80 check inter 5000 rise 2 fall 5 maxconn 2048
+
+backend backend-site5-2
+    option httpchk HEAD / HTTP/1.0\r\nHost:\ site5.local\r\nUser-Agent:\ haproxy/httpchk\r\nCache-Control:\ no-cache
+    http-request set-header Host site5.local
+    balance leastconn
+    server server_1 127.0.1.11:80 check inter 5000 rise 2 fall 5 maxconn 2048
+
+backend backend-cached-site6-local
+    option forwardfor
+    option httpchk HEAD / HTTP/1.0\r\nHost:\ site6.local\r\nUser-Agent:\ haproxy/httpchk\r\nCache-Control:\ no-cache
+    http-request set-header Host site6.local
+    balance leastconn
+    server server_1 127.0.0.1:6085 check inter 5000 rise 2 fall 5 maxconn 2048
+
+backend backend-site6-local
+    option httpchk HEAD / HTTP/1.0\r\nHost:\ site6.local\r\nUser-Agent:\ haproxy/httpchk\r\nCache-Control:\ no-cache
+    http-request set-header Host site6.local
+    balance leastconn
+    server server_1 127.0.1.10:443 check inter 5000 rise 2 fall 5 maxconn 2048 ssl sni str(site6.local) check-sni site6.local verify required ca-file ca-certificates.crt
+
+backend backend-cached-site7-local
+    option forwardfor
+    option httpchk HEAD / HTTP/1.0\r\nHost:\ site7.local\r\nUser-Agent:\ haproxy/httpchk\r\nCache-Control:\ no-cache
+    http-request set-header Host site7.local
+    balance leastconn
+    server server_1 127.0.0.1:6086 check inter 5000 rise 2 fall 5 maxconn 2048
+
+backend backend-site7-local
+    option httpchk HEAD / HTTP/1.0\r\nHost:\ site7.local\r\nUser-Agent:\ haproxy/httpchk\r\nCache-Control:\ no-cache
+    http-request set-header Host site7.local
+    balance leastconn
+    server server_1 127.0.1.10:80 check inter 5000 rise 2 fall 5 maxconn 2048
+
+backend backend-cached-site8-local
+    option forwardfor
+    option httpchk HEAD / HTTP/1.0\r\nHost:\ site8.local\r\nUser-Agent:\ haproxy/httpchk\r\nCache-Control:\ no-cache
+    http-request set-header Host site8.local
+    balance leastconn
+    server server_1 127.0.0.1:6087 check inter 5000 rise 2 fall 5 maxconn 2048
+
+backend backend-site8-local
+    option httpchk HEAD / HTTP/1.0\r\nHost:\ site8.local\r\nUser-Agent:\ haproxy/httpchk\r\nCache-Control:\ no-cache
+    http-request set-header Host site8.local
+    balance leastconn
+    server server_1 127.0.1.10:80 check inter 5000 rise 2 fall 5 maxconn 2048
+
+backend backend-site8-local-2
+    option httpchk HEAD / HTTP/1.0\r\nHost:\ auth.site8.local\r\nUser-Agent:\ haproxy/httpchk\r\nCache-Control:\ no-cache
+    http-request set-header Host auth.site8.local
+    balance leastconn
+    server server_1 127.0.1.10:443 check inter 5000 rise 2 fall 5 maxconn 2048 ssl sni str(auth.site8.local) check-sni auth.site8.local verify required ca-file ca-certificates.crt
+
+backend backend-cached-site9-local
+    option forwardfor
+    option httpchk HEAD / HTTP/1.0\r\nHost:\ site9.local\r\nUser-Agent:\ haproxy/httpchk\r\nCache-Control:\ no-cache
+    http-request set-header Host site9.local
+    balance leastconn
+    server server_1 127.0.0.1:6088 check inter 1m rise 2 fall 5 maxconn 2048
+
+backend backend-site9-local
+    option httpchk HEAD / HTTP/1.0\r\nHost:\ site9.local\r\nUser-Agent:\ haproxy/httpchk\r\nCache-Control:\ no-cache
+    http-request set-header Host site9.local
+    balance leastconn
+    server server_1 127.0.1.15:80 check inter 1m rise 2 fall 5 maxconn 2048
diff --git a/tests/unit/files/haproxy_config_rendered_listen_stanzas_test_output.txt b/tests/unit/files/haproxy_config_rendered_listen_stanzas_test_output.txt
index 57884f0..e98c5fe 100644
--- a/tests/unit/files/haproxy_config_rendered_listen_stanzas_test_output.txt
+++ b/tests/unit/files/haproxy_config_rendered_listen_stanzas_test_output.txt
@@ -2,7 +2,6 @@
 listen combined-80
     bind 0.0.0.0:80
     bind :::80
-    maxconn 8192
     use_backend backend-site1-local if { hdr(Host) -i site1.local }
     redirect scheme https code 301 if { hdr(Host) -i site2.local } !{ ssl_fc }
     use_backend backend-site3-local if { hdr(Host) -i site3.local }
@@ -14,12 +13,10 @@ listen combined-80
 listen site2-local
     bind 0.0.0.0:443 ssl crt /etc/haproxy/site2-bundle.crt
     bind :::443 ssl crt /etc/haproxy/site2-bundle.crt
-    maxconn 8192
     default_backend backend-site2-local
 
 listen combined-444
     bind 0.0.0.0:444 ssl crt /etc/haproxy/site7-bundle.crt crt /etc/haproxy/site8-bundle.crt
     bind :::444 ssl crt /etc/haproxy/site7-bundle.crt crt /etc/haproxy/site8-bundle.crt
-    maxconn 8192
     use_backend backend-site7-local if { hdr(Host) -i site7.local }
     use_backend backend-site8-local if { hdr(Host) -i site8.local }
diff --git a/tests/unit/files/haproxy_config_rendered_test_output.txt b/tests/unit/files/haproxy_config_rendered_test_output.txt
index e3132ec..e1b10d9 100644
--- a/tests/unit/files/haproxy_config_rendered_test_output.txt
+++ b/tests/unit/files/haproxy_config_rendered_test_output.txt
@@ -1,6 +1,6 @@
 global
 	nbthread 4
-	maxconn 8192
+	maxconn 15000
 	log /dev/log	local0
 	log /dev/log	local1 notice
 	chroot /var/lib/haproxy
@@ -26,6 +26,7 @@ global
 
 defaults
 	log	global
+	maxconn 5000
 	mode	http
 	option	httplog
 	option	dontlognull
@@ -56,7 +57,6 @@ listen  stats
 listen combined-80
     bind 0.0.0.0:80
     bind :::80
-    maxconn 8192
     use_backend backend-site1-local if { hdr(Host) -i site1.local }
     redirect scheme https code 301 if { hdr(Host) -i site2.local } !{ ssl_fc }
     use_backend backend-site3-local if { hdr(Host) -i site3.local }
@@ -68,13 +68,11 @@ listen combined-80
 listen site2-local
     bind 0.0.0.0:443 ssl crt /etc/haproxy/site2-bundle.crt
     bind :::443 ssl crt /etc/haproxy/site2-bundle.crt
-    maxconn 8192
     default_backend backend-site2-local
 
 listen combined-444
     bind 0.0.0.0:444 ssl crt /etc/haproxy/site7-bundle.crt crt /etc/haproxy/site8-bundle.crt
     bind :::444 ssl crt /etc/haproxy/site7-bundle.crt crt /etc/haproxy/site8-bundle.crt
-    maxconn 8192
     use_backend backend-site7-local if { hdr(Host) -i site7.local }
     use_backend backend-site8-local if { hdr(Host) -i site8.local }
 
diff --git a/tests/unit/test_content_cache.py b/tests/unit/test_content_cache.py
index 9e1de72..4cbbf05 100644
--- a/tests/unit/test_content_cache.py
+++ b/tests/unit/test_content_cache.py
@@ -176,7 +176,6 @@ class TestCharm(unittest.TestCase):
             'cache_max_size': '1g',
             'cache_path': '/var/lib/nginx/proxy',
             'enable_prometheus_metrics': False,
-            'max_connections': 8192,
             'sites': ngx_config,
             'worker_connections': 768,
             'worker_processes': 0,
@@ -255,7 +254,6 @@ site1.local:
             'cache_inactive_time': '',
             'cache_max_size': '1g',
             'cache_path': '/var/lib/nginx/proxy',
-            'max_connections': 8192,
             'sites': config,
             'sites_secrets': secrets,
             'worker_connections': 768,
@@ -308,7 +306,6 @@ site1.local:
                 'cache_inactive_time': '2h',
                 'cache_max_size': '1g',
                 'cache_path': '/var/lib/nginx/proxy',
-                'max_connections': 8192,
                 'sites': config,
                 'worker_connections': 768,
                 'worker_processes': 0,
@@ -326,7 +323,6 @@ site1.local:
                 'cache_inactive_time': '2h',
                 'cache_max_size': '20g',
                 'cache_path': '/srv/cache',
-                'max_connections': 8192,
                 'sites': config,
                 'worker_connections': 768,
                 'worker_processes': 0,
@@ -345,7 +341,6 @@ site1.local:
                 'cache_inactive_time': '2h',
                 'cache_max_size': '',
                 'cache_path': '/srv/cache',
-                'max_connections': 8192,
                 'sites': config,
                 'worker_connections': 768,
                 'worker_processes': 0,
@@ -368,7 +363,7 @@ site1.local:
 
         status.reset_mock()
         clear_flag.reset_mock()
-        self.mock_config.return_value = {'max_connections': 8192, 'sites': 'site1:'}
+        self.mock_config.return_value = {'sites': 'site1:'}
         content_cache.configure_haproxy()
         status.blocked.assert_called()
         clear_flag.assert_called_once_with('content_cache.active')
@@ -403,6 +398,29 @@ site1.local:
                 got = f.read()
             self.assertEqual(got, want)
 
+    @freezegun.freeze_time("2019-03-22", tz_offset=0)
+    @mock.patch('charms.reactive.set_flag')
+    @mock.patch('reactive.content_cache.update_logrotate')
+    def test_configure_haproxy_sites_auto_maxconns(self, logrotation, set_flag):
+        with open('tests/unit/files/config_test_config.txt', 'r', encoding='utf-8') as f:
+            ngx_config = f.read()
+        self.mock_config.return_value = {'max_connections': 0, 'sites': ngx_config}
+
+        with mock.patch('lib.haproxy.HAProxyConf.conf_file', new_callable=mock.PropertyMock) as mock_conf_file:
+            mock_conf_file.return_value = os.path.join(self.tmpdir, 'haproxy.cfg')
+            with mock.patch('charmhelpers.core.host.pwgen', return_value="biometricsarenotsecret"), mock.patch(
+                'charmhelpers.core.hookenv.opened_ports', return_value=["443/tcp"]
+            ), mock.patch('charmhelpers.core.hookenv.open_port'), mock.patch('charmhelpers.core.hookenv.close_port'):
+                content_cache.configure_haproxy()
+
+            with open(
+                'tests/unit/files/content_cache_rendered_haproxy_test_output_auto_maxconns.txt', 'r', encoding='utf-8'
+            ) as f:
+                want = f.read()
+            with open(os.path.join(self.tmpdir, 'haproxy.cfg'), 'r', encoding='utf-8') as f:
+                got = f.read()
+            self.assertEqual(got, want)
+
     @mock.patch('charms.reactive.set_flag')
     def test_fire_stats_hook(self, set_flag):
         content_cache.fire_stats_hook()
@@ -984,7 +1002,6 @@ site1.local:
             'cache_max_size': '1g',
             'cache_path': '/var/lib/nginx/proxy',
             'enable_prometheus_metrics': True,
-            'max_connections': 8192,
             'sites': ngx_config,
             'worker_connections': 768,
             'worker_processes': 0,
@@ -1061,7 +1078,6 @@ site1.local:
         # Test that haproxy calls close_port with the nginx.METRIC_PORT when enable_prometheus_metrics is False
         self.mock_config.return_value = {
             'enable_prometheus_metrics': False,
-            'max_connections': 8192,
             'sites': ngx_config,
         }
         opened_ports.return_value = {"80/tcp", "{0}/tcp".format(nginx.METRICS_PORT)}
@@ -1073,7 +1089,6 @@ site1.local:
         open_port.reset_mock()
         self.mock_config.return_value = {
             'enable_prometheus_metrics': True,
-            'max_connections': 8192,
             'sites': ngx_config,
         }
         content_cache.configure_haproxy()
diff --git a/tests/unit/test_haproxy.py b/tests/unit/test_haproxy.py
index f8a8a07..1b2bb96 100644
--- a/tests/unit/test_haproxy.py
+++ b/tests/unit/test_haproxy.py
@@ -70,7 +70,7 @@ class TestLibHAProxy(unittest.TestCase):
         )
 
     def test_haproxy_config_rendered_listen_stanzas(self):
-        haproxy = HAProxy.HAProxyConf(self.tmpdir, max_connections=8192)
+        haproxy = HAProxy.HAProxyConf(self.tmpdir)
         config = self.site_config
         output = 'tests/unit/files/haproxy_config_rendered_listen_stanzas_test_output.txt'
         with open(output, 'r', encoding='utf-8') as f:
@@ -102,7 +102,7 @@ class TestLibHAProxy(unittest.TestCase):
 
     @freezegun.freeze_time("2019-03-22", tz_offset=0)
     def test_haproxy_config_rendered_full_config(self):
-        haproxy = HAProxy.HAProxyConf(self.tmpdir, max_connections=8192)
+        haproxy = HAProxy.HAProxyConf(self.tmpdir, max_connections=5000)
         config = self.site_config
         num_threads = 4
         tls_cipher_suites = 'ECDH+AESGCM:!aNULL:!MD5:!DSS'