Overall slow file transfers

Help!
1

Hello,
I recently setup an HAProxy instance. I‘m using multiple subdomains for different backends, which are overall pretty slow. I have a pretty loaded page, which took less than 5s to completely load externally without haproxy and with it takes almost 90s. File transfers are also very slow, mostly below 200kb/s…

Here‘s my config:

global
	tune.h2.initial-window-size 9048576
	tune.h2.max-concurrent-streams 10000
	tune.h2.max-frame-size 9048576
	cpu-map 1 0
	cpu-map 2 1
	cpu-map 3 2
	cpu-map 4 3
	nbthread 4
	maxconn 50000
	log /dev/log	local0 info
	log /dev/log	local1 notice
	chroot /var/lib/haproxy
	stats socket /run/haproxy/admin.sock mode 660 level admin
	stats timeout 30s
	user haproxy
	group haproxy
	daemon

	# Default SSL material locations
	ca-base /etc/ssl/certs
	crt-base /etc/ssl/private

	# See: https://ssl-config.mozilla.org/#server=haproxy&server-version=2.0.3&config=intermediate
        ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
        ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
        ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets
	nopoll

defaults
	log	global
	mode	http
	option	httplog
	option	dontlognull
        timeout connect 5000ms
        timeout client  15s
        timeout server  30s
	errorfile 400 /etc/haproxy/errors/400.http
	errorfile 403 /etc/haproxy/errors/403.http
	errorfile 408 /etc/haproxy/errors/408.http
	errorfile 500 /etc/haproxy/errors/500.http
	errorfile 502 /etc/haproxy/errors/502.http
	errorfile 503 /etc/haproxy/errors/503.http
	errorfile 504 /etc/haproxy/errors/504.http
  	option  http-server-close
  	option  redispatch
  	option  contstats
  	retries 3
  	backlog 10000
# timeout tunnel available in ALOHA 5.5 or HAProxy 1.5-dev10 and higher
  	timeout tunnel        3600s
  	timeout http-keep-alive 30s
  	timeout http-request    15s
  	timeout queue           30s
  	timeout tarpit          60s
  	default-server inter 3s rise 2 fall 3

cache mycache
	total-max-size 100
	max-age 60

frontend www-https
	bind :443 ssl crt /etc/letsencrypt/live/example.com/example.com.pem
	# http-request add-header X-Forwarded-Proto: https
   	default_backend homeassistant
	acl sub1 hdr_sub(host) -i homeassistant.example.com
	acl sub2 hdr_sub(host) -i overleaf.example.com
	acl sub3 hdr_sub(host) -i redacted2.example.com
	acl sub4 hdr_sub(host) -i redacted1.example.com
	use_backend homeassistant if sub1
	use_backend overleaf if sub2
	use_backend redacted2 if sub3
	use_backend redacted1 if sub4
	
	http-request cache-use mycache
	http-response cache-store mycache
	http-request del-header Cache-Control
	http-request del-header Pragma

backend redacted2
	balance roundrobin
   	# redirect scheme https if !{ ssl_fc }
	# option forwardfor
   	server redacted2 192.168.178.27:443 maxconn 10000 ssl verify none check
	http-request replace-value x-forwarded-for ^ "%[hdr(x-forwarded-for)], %[src]"
	http-request add-header X-Forwarded-Port 443
	http-request add-header X-Forwarded-Proto https
	# http-response set-header Cache-Control public
	# http-response set-header Expires -1
	# http-response set-header Pragma cache
	# http-request cache-use mycache
	# http-response cache-store mycache

backend redacted1
	balance roundrobin
   	# redirect scheme https if !{ ssl_fc }
	# option forwardfor
   	server redacted1 192.168.178.108:443 maxconn 10000 ssl verify none check
	http-request replace-value x-forwarded-for ^ "%[hdr(x-forwarded-for)], %[src]"
	http-request add-header X-Forwarded-Port 443
	http-request add-header X-Forwarded-Proto https
	# http-response set-header Cache-Control public
	# http-response set-header Expires -1
	# http-response set-header Pragma cache
	# http-request cache-use mycache
	# http-response cache-store mycache

backend homeassistant
	balance roundrobin
    	server homeassistant 192.168.178.105:8123 maxconn 10000 check
	mode http
	# option forwardfor
	# http-request replace-value x-forwarded-for ^ "%[hdr(x-forwarded-for)], %[src]"
	# http-request add-header X-Forwarded-Port 443
	# http-request add-header X-Forwarded-Proto https



backend overleaf
	balance roundrobin
    	mode http
    	option forwardfor
    	server overleaf 192.168.178.54:80 maxconn 10000 check
	# http_request add-header Strict-Transport-Security "max-age=31536000; includeSubdomains;"
	# http_request add-header X-Frame-Options SAMEORIGIN
	# http_request add-header X-Content-Type-Options nosniff

I‘m running it stand-alone on a ProxMox VM.
What I noticed was that the overleaf PDF preview takes forever to update after a compile and my redacted2 backend also takes about 90 seconds to load, while it takes less than 5 seconds without haproxy.

2

I just found out if I remove the three tune-lines in global the upload speed increases, but the download speed stays the same. I would guess that the backends initial-window-size is still too small, is there a way to increase that?

3

Figured it out. Did a bandwidth test with haproxy and got 10g. Found out, it was my router prioritisind other stuff on my network. Fixed that and now it works perfectly.