Load Balancing with nginx and HaProxy

Load Balancer with SSL offloading - nginx + HAProxy HAProxy and nginx can be configured together to work as an SSL offloader and a load balancer.

Listed below are the steps to achieve the same on a centOS instance.

Assume 192.168.1.1 and 192.168.1.2 running web servers on port 80 and 192.168.1.3 running haproxy on port 8181.

Starting with HAPROXY set up.

1. Install haproxy. yum install -y haproxy 2. Edit the haproxy configuration to update the backend web servers and keep it at the basic log level. global log 127.0.0.1 chroot pidfile maxconn user group daemon defaults mode log option option option option option retries timeout timeout timeout timeout

local2 /var/lib/haproxy /var/run/haproxy.pid 4096 haproxy haproxy

http global httplog dontlognull http-server-close forwardfor except 127.0.0.0/8 redispatch 3 http-request 20s queue 1m connect 10s client 1m

timeout timeout timeout maxconn

server 1m http-keep-alive 30s check 10s 3000

frontend fe_http option option bind default_backend

forwardfor except 127.0.0.1 httpclose *:8181 be_http

backend be_http balance option server server

roundrobin httpchk ws_1 192.168.1.1:80 check port 80 ws_2 192.168.1.2:80 check port 80

3. HAProxy doesn't start logging on installation, it uses syslog for the same. To enable logging install rsyslog and add a config for HAProxy yum install -y rsyslog 4. Create a config file for haproxy logging /etc/rsyslog.d/haproxy.conf $ModLoad imudp $UDPServerRun 514 $template Haproxy,"%msg%\n" local2.info -/var/log/haproxy.log;Haproxy local2.notice -/var/log/haproxy.admin;Haproxy # don't log anywhere else local2.* ~ 5. Edit /etc/sysconfig/rsyslog as below SYSLOGD_OPTIONS="-c 2 -r" 6. Restart rsyslog and haproxy services.

That sets up haproxy to bind to 8181 and check the ports 80 for all the backend web servers that would be load balanced.

Taking the set up ahead, configuring NGINX 1. Install nginx yum install -y nginx 2. If you're configuring the web servers to bind to port 80, remove the default.conf in /etc/nginx/conf.d/. Copy the SSL certificate and private key to /etc/nginx/. Make sure to change the owner to nginx:nginx with mode 600 and 644 respectively.

3. Configure the default nginx server as below

error_log access_log

/var/log/nginx/ssl_error.log debug; /var/log/nginx/ssl_access.log;

upstream haproxy { server 192.168.1.3:8181; } server { listen 443 ssl; ssl_certificate server.crt ssl_certificate_key server_cert.key server_name domain.com location / { proxy_pass http://haproxy/; proxy_set_header X-NginX-Proxy true; proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto https; proxy_redirect proxy_redirect proxy_redirect proxy_read_timeout proxy_connect_timeout } location ~ /\. { deny

default; http://$host/ https://$host/; http://hostname/ https://$host/; 15s; 15s; all; }

} server { listen return }

80; 301 https://$host$request_uri;

4. Restart the nginx and haproxy services.