# HAProxy benchmark configuration.
#
# Matched to the pqcrypta-proxy config as closely as the two products allow:
# same certificate, same backend, same worker count, TLS 1.3 only, no WAF or
# access logging on either side. Anything that differs is a difference between
# the products, not between the configs.
global
    nbthread 2
    # HAProxy applies cpu-map AFTER start and it overrides the inherited taskset
    # mask, so this must name the same cores the harness pins the other proxy to.
    # Threads match CPUs: HAProxy warns that oversubscribing them degrades it
    # severely, and a proxy running in a configuration it warns about is not a
    # fair opponent.
    cpu-map auto:1/1-2 4-5
    log stdout format raw local0 notice
    tune.ssl.default-dh-param 2048
    ssl-default-bind-ciphersuites TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256
    ssl-default-bind-options ssl-min-ver TLSv1.3
    # One UDP socket per QUIC connection: the default, stated so it is visible.
    # HAProxy's documentation calls it the preferred mode for large QUIC traffic.
    tune.quic.socket-owner connection

defaults
    mode http
    option httplog
    no log
    timeout connect 5s
    timeout client  30s
    timeout server  30s
    maxconn 60000

frontend bench_tcp
    # HTTP/1.1 and HTTP/2 share this listener; ALPN decides which.
    bind 127.0.0.1:18443 ssl crt /root/bench/certs/bench.local.pem alpn h2,http/1.1
    default_backend static

frontend bench_quic
    # HTTP/3. Same cert, same backend.
    bind quic4@127.0.0.1:18443 ssl crt /root/bench/certs/bench.local.pem alpn h3
    http-response set-header alt-svc "h3=\":18443\"; ma=86400"
    default_backend static

backend static
    balance roundrobin
    server s1 127.0.0.1:18080 maxconn 20000