I am trying to figure out how to set up an SSL farm with haproxy and SSL reverse proxies and I am looking for some general advice:
Is it possible to meet all of the following:
- Load balance requests against the SSL farm and have failover so more than one SSL box will be possible (perhaps the sslcheck in haproxy will help with this).
- Get an HTTP log that has the actual client IP addresses in it.
- No TProxy Requirement
If all 3 of these are not possible I am wondering what the tradeoffs might be. Right now I am considering something like the following but this could change:
Haproxy 443 TCP Proxy Frontend -> SSL Proxies (Maybe Nginx) on High Ports -> Haproxy HTTP Front-End -> Webservers
I realize I could probably skip the second hop back to haproxy but the single perspective of everything in HAproxy might be nice. Also if I have to use TProxy, maybe going back to haproxy from the SSL farm will make the routing simpler?