Merge ~hloeung/content-cache-charm:haproxy-config into content-cache-charm:master

[Haw Loeung]

Increase HAProxy SSL/TLS session cache

Default cache size is 20k. We want to improve user experience by
reducing TTFB. Obviously this applies to vistors revisiting sites.

Rather than hardcode high values here, let's just dynamically
calculate this using global_max_connections (which is a combination of
num. of cores and num. of configured sites). Each entry requires ~200
bytes so on a host iwth say 32 CPUs, 10 sites configured, each with
the default 2000 maxconns, it will only consume around 122 Mbytes,
which is not much!

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Unable to determine commit message from repository - please click "Set commit message" and enter the commit message manually.

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[Joel Sing (jsing)]

LGTM, see comments inline.

Also, as discussed, it would be preferable to use session tickets which removes the need for state to be stored on the servers and allows session resumption across all frontends if they share keys. The challenge is ensuring frequent rotation and preferably not persisting ticket keys to disk.

review: Approve (+1)

[Haw Loeung (hloeung)]

Filed LP:1866746 to look into and implement session tickets.

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change successfully merged at revision a1fcac903113718953671597d4a1a46b8a3848fb

diff --git a/templates/haproxy_cfg.tmpl b/templates/haproxy_cfg.tmpl
index aee0e16..f2665dc 100644
--- a/templates/haproxy_cfg.tmpl
+++ b/templates/haproxy_cfg.tmpl
@@ -24,6 +24,14 @@ global
 	# We'll eventually disable DHE (LP#1825321), but for now, bump DH params
 	tune.ssl.default-dh-param 2048
 
+	# Increase the SSL/TLS session cache from the default 20k. But
+	# rather than hardcode values, let's just dynamically calculate it
+	# and using global_max_connections. Each entry requires ~200 bytes
+	# so on a host with say 32 CPUs, 10 sites, each with 2000 max
+	# conns will only consume around 122 Mbytes (32 * 10 * 2000 *
+	# 200), which is not much.
+	tune.ssl.cachesize {{global_max_connections}}
+
 defaults
 	log	global
 	maxconn {{max_connections}}
diff --git a/tests/unit/files/content_cache_rendered_haproxy_test_output.txt b/tests/unit/files/content_cache_rendered_haproxy_test_output.txt
index 73063ab..6b78db5 100644
--- a/tests/unit/files/content_cache_rendered_haproxy_test_output.txt
+++ b/tests/unit/files/content_cache_rendered_haproxy_test_output.txt
@@ -24,6 +24,14 @@ global
 	# We'll eventually disable DHE (LP#1825321), but for now, bump DH params
 	tune.ssl.default-dh-param 2048
 
+	# Increase the SSL/TLS session cache from the default 20k. But
+	# rather than hardcode values, let's just dynamically calculate it
+	# and using global_max_connections. Each entry requires ~200 bytes
+	# so on a host with say 32 CPUs, 10 sites, each with 2000 max
+	# conns will only consume around 122 Mbytes (32 * 10 * 2000 *
+	# 200), which is not much.
+	tune.ssl.cachesize 106496
+
 defaults
 	log	global
 	maxconn 8192
diff --git a/tests/unit/files/content_cache_rendered_haproxy_test_output_auto_maxconns.txt b/tests/unit/files/content_cache_rendered_haproxy_test_output_auto_maxconns.txt
index cad0ce4..51ef6a4 100644
--- a/tests/unit/files/content_cache_rendered_haproxy_test_output_auto_maxconns.txt
+++ b/tests/unit/files/content_cache_rendered_haproxy_test_output_auto_maxconns.txt
@@ -24,6 +24,14 @@ global
 	# We'll eventually disable DHE (LP#1825321), but for now, bump DH params
 	tune.ssl.default-dh-param 2048
 
+	# Increase the SSL/TLS session cache from the default 20k. But
+	# rather than hardcode values, let's just dynamically calculate it
+	# and using global_max_connections. Each entry requires ~200 bytes
+	# so on a host with say 32 CPUs, 10 sites, each with 2000 max
+	# conns will only consume around 122 Mbytes (32 * 10 * 2000 *
+	# 200), which is not much.
+	tune.ssl.cachesize 104000
+
 defaults
 	log	global
 	maxconn 8000
diff --git a/tests/unit/files/haproxy_config_rendered_test_output.txt b/tests/unit/files/haproxy_config_rendered_test_output.txt
index e1b10d9..341f796 100644
--- a/tests/unit/files/haproxy_config_rendered_test_output.txt
+++ b/tests/unit/files/haproxy_config_rendered_test_output.txt
@@ -24,6 +24,14 @@ global
 	# We'll eventually disable DHE (LP#1825321), but for now, bump DH params
 	tune.ssl.default-dh-param 2048
 
+	# Increase the SSL/TLS session cache from the default 20k. But
+	# rather than hardcode values, let's just dynamically calculate it
+	# and using global_max_connections. Each entry requires ~200 bytes
+	# so on a host with say 32 CPUs, 10 sites, each with 2000 max
+	# conns will only consume around 122 Mbytes (32 * 10 * 2000 *
+	# 200), which is not much.
+	tune.ssl.cachesize 15000
+
 defaults
 	log	global
 	maxconn 5000