Open sourcing Sōzu connectors

Emmanuel Bosquet — Mon, 25 Sep 2023 15:19:04 +0000

Clever Cloud is today the main developer of Sōzu, a Reverse Proxy that was developped at Clever Cloud, in Rust, to meet the needs of our infrastructure for performance and hot reloading. Sōzu is used throughout Clever Cloud, paired with HAProxy, to route traffic to our customer's applications.

What we used to do:

Up until now, our Reverse Proxy Sōzu used to be managed by Clever Cloud by a closed source program that ran on the same machine and assumed two big responsibilities:

Firstly, listen to a RabbitMQ topic and redirect requests to Sōzu (via its UNIX socket)
Secondly, watch over a PKI directory (Public Key Infrastructure) to redirect TLS certificates to Sōzu (via its UNIX socket)

Turning open source

While working on a new Prometheus connector for Sōzu, we realized we could open source it. With this realization came the idea of porting the logic of the former Sōzu manager (described above) from its closed source state into new open source repositories.
What we ultimately aim to develop is an entirely open-source ecosystem around our Reverse Proxy Sōzu.
This blog post details what these new open source components are, and summarizes what they do.

Our open-source ecosystem around Sōzu

Sōzu Prometheus connector

Prometheus is a monitoring and alerting software suite.
This simple connector operates alongside Sōzu. It waits for HTTP requests on the /metrics route, queries Sōzu for its metrics, formats the metrics to be Prometheus-compatible, and sends them in the HTTP response.
This means that Prometheus metrics are readily available on the IP address of a Sōzu machine.

Sōzu Pulsar connector

Apache Pulsar is a highly scalable messaging platform. We use it extensively at Clever Cloud because of its distributed aspect and cutting-edge throughput performance.
The Sōzu Pulsar connector subscribes to a Pulsar topic and transmits messages to Sōzu. Sōzu uses these messages to perform hot reloading on the proxy, which is a key feature of our Reverse Proxy.
What it means for us and anyone using the Sōzu ecosystem: this connector enables updating traffic redirection in real time.

Sōzu PKI connector

PKI stands for Public Key Infrastructure, an omnipresent security framework on the Internet, typically used for securing connections with HTTPS (among other things). In the PKI framework, Sōzu functions as a TLS endpoint: it decrypts HTTPS traffic into HTTP traffic.
The Sōzu PKI connector runs alongside Sōzu, watches over a given directory in the file system, reads TLS certificates that were put there by either human or machine, and transmits them to Sōzu.
Then , what this ultimately means is: write a TLS certificate on the machine, Sōzu will have it.

Sōzu client

This is a code library used by all above connectors. It pools connections to Sōzu's UNIX socket and functions entirely asynchronously. All in all, it makes writing new connectors easier.

What's next
The best thing we wish is for the open-source community to join us in using and improving Sōzu as it goes. Our end-game is to build a web UI to manage a Sōzu instance in the navigator.

Pgpool-II: getting the most of PostgreSQL

Emmanuel Bosquet — Wed, 07 Jul 2021 09:04:00 +0000

Are you having too many simultaneous connections on your PostgreSQL database? Do you dream of balancing the load of your requests across a PostgreSQL cluster? Either way, we've got the solution for you. Clever Cloud is proud to introduce the native support of Pgpool-II on all application instances, for no additional fee. See the Clever Cloud documentation on Pgpool-II.

What is Pgpool-II?

It is a middleware that comes in between your application and your PostgreSQL database (official website). As its name suggests, it pools your app's connections to PostgreSQL, by saving and reusing them, and letting them wait when they are too many. Pgpool-II also serves as a load balancer for PostgreSQL replicas for superior scaling. More on this below. Pgpool-II now works out of the box on all Clever Cloud machines. Only exception: if you use docker, you'll have to configure the Dockerfile yourself.

No more `connection refused`

Pgpool-II overall smoothens the use of PostgreSQL.

Accessed on a Unix socket: faster than a TCP socket. Gotta chase those nanoseconds.
Connection reuse: Pgpool saves connections and reuses them when similar ones come in (same user, same database…).
Managing exceeding connections: Normally, PostgreSQL takes only so many concurrent connections, and discards any additional ones, which compromises the app. Pgpool-II, instead, queues the excess connections for later. No more connection refused.

What do I have to do?

Barely anything. By changing only one environment variable in your code, your app will send its requests to Pgpool-II directly. In a typical PHP app, you would connect to a PostgreSQL add-on by doing:

$host = getenv("POSTGRESQL_ADDON_HOST");

You just need to change that into:

$host = getenv("CC_PGPOOL_SOCKET_PATH");

That's all there is to change in your code. User, password, all other calls to environment variables remain the same. See the doc for details. Now in the Clever Cloud Console, go to your app's environment variables, set CC_ENABLE_PGPOOL to true, and you're good to go!

Load balancing: let's go big

Suppose your web app is BIG. You've got a few INSERT queries to make (registering a new customer for instance), and a ton of SELECT queries (searches, filling pages with products, you name it). It becomes wise to create replicas of your database, a PostgreSQL feature. These identical instances, called followers, are exact copycats of your leader database. On the graph they are called primary and standby, respectively. There can be several standby nodes. Pgpool-II will direct the write queries to the primary, and dispatch the read queries to the standby nodes, thus balancing the load and increasing throughput. More details in the doc. All you have to do is create as many PostgreSQL add-ons as you want replicas, and ask us to do the plumbing for you.

Emmanuel Bosquet, Author at Clever Cloud