2

I've been reading about load-balancing with HaProxy and was wondering if you can use this load balancer if I don't do any layer 7 processing? I suppose that using only roundrobin at TCP level load-balancing could work with SSL connexions? I only accept SSL (no HTTP whatsoever). I would like not to terminate SSL at the load balancer (that's why I would like to avoid STunnel).

Thank you.

2 Answers 2

2

If you want to terminate the SSL at the load balancer then you have no choice but to use something like Stunnel, Pound or Nginx. HA-Proxy doesn't support terminating the SSL itself.

Alternatively you can terminate the SSL at your web servers. In which case just setup HA-Proxy to pass-thru the TCP (HTTPS/443) connections to your web servers. Although remember in this mode you will not be able to do any L7 inspection or rules which is sort of what makes HA-Proxy so powerful.

3

You can use haproxy to load balance SSL connections to multiple backend servers, so the backend servers terminate SSL instead of haproxy. The only trick is to enable Proxy Protocol on both haproxy and your backend servers, so the user's real IP address is preserved.

For example, if you have two nginx app servers 10.0.0.11 and 10.0.0.12 and one haproxy load balancer 10.0.0.10. Edit /etc/haproxy/haproxy.cfg adding these lines:

frontend https-in
    bind *:443
    default_backend https-servers

backend https-servers
        mode tcp
        balance roundrobin
        server srv1 10.0.0.11:443 send-proxy
        server srv2 10.0.0.12:443 send-proxy

With an nginx server config like:

server {
    server_name  example.com;
    root /opt/example/current/app;

    listen 443 ssl http2 proxy_protocol;

    set_real_ip_from 10.0.0.10/32;
    real_ip_header proxy_protocol;

    ssl_certificate /etc/ssl/example/ssl.crt;
    ssl_certificate_key /etc/ssl/example/ssl.key;

    location / {
        include uwsgi_params;
        uwsgi_pass unix:/tmp/app.sock;
    }
}

This tells haproxy to setup a Layer 4 proxy to forward all TCP connections unmodified to the two nginx servers using roundrobin to balance the connections. The nginx app servers will share the load of negotiating SSL and parsing the HTTP requests. Proxy Protocol forwards the originating client's IP address from haproxy to nginx without having to modify the HTTP request headers. Notice how we told nginx to trust the IP address of your haproxy load balancer 10.0.0.10 to give us the client's real IP. SSL is distributed among your two nginx app servers, and your nginx log files show the correct client IP address for each request.

I wrote a blog post describing this:

https://wakatime.com/blog/34-how-to-scale-ssl-with-haproxy-and-nginx

7
  • Please provide relevant config content here, and link elsewhere for more details if necessary. We want your answer as posted on SF to remain relevant and helpful even long after your blog disappears or its link structure changes.
    – EEAA
    Jun 13, 2016 at 21:46
  • Excellent! Downvote retracted.
    – EEAA
    Jun 15, 2016 at 7:51
  • Also, you may want to reference the version of haproxy as it relates to your answer. When this question was asked (and answered) way back in 2011, haproxy did not actually support SSL termination. Jun 15, 2016 at 8:16
  • "or its link structure changes". That's actually pretty on point because the blog post linked has links back to itself for other posts that are currently returning 404s. Jun 15, 2016 at 8:21
  • @RyanBolger thanks, didn't notice those links but fixed them now github.com/wakatime/wakatime-blog/commit/… Jun 16, 2016 at 4:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .