Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been reading about load-balancing with HaProxy and was wondering if you can use this load balancer if I don't do any layer 7 processing? I suppose that using only roundrobin at TCP level load-balancing could work with SSL connexions? I only accept SSL (no HTTP whatsoever). I would like not to terminate SSL at the load balancer (that's why I would like to avoid STunnel).

Thank you.

share|improve this question
up vote 2 down vote accepted

If you want to terminate the SSL at the load balancer then you have no choice but to use something like Stunnel, Pound or Nginx. HA-Proxy doesn't support terminating the SSL itself.

Alternatively you can terminate the SSL at your web servers. In which case just setup HA-Proxy to pass-thru the TCP (HTTPS/443) connections to your web servers. Although remember in this mode you will not be able to do any L7 inspection or rules which is sort of what makes HA-Proxy so powerful.

share|improve this answer

You can use haproxy to load balance SSL connections to multiple backend servers, so the backend servers terminate SSL instead of haproxy. The only trick is to enable Proxy Protocol on both haproxy and your backend servers, so the user's real IP address is preserved.

For example, if you have two nginx app servers 10.0.0.11 and 10.0.0.12 and one haproxy load balancer 10.0.0.10. Edit /etc/haproxy/haproxy.cfg adding these lines:

frontend https-in
    bind *:443
    default_backend https-servers

backend https-servers
        mode tcp
        balance roundrobin
        server srv1 10.0.0.11:443 send-proxy
        server srv2 10.0.0.12:443 send-proxy

With an nginx server config like:

server {
    server_name  example.com;
    root /opt/example/current/app;

    listen 443 ssl http2 proxy_protocol;

    set_real_ip_from 10.0.0.10/32;
    real_ip_header proxy_protocol;

    ssl_certificate /etc/ssl/example/ssl.crt;
    ssl_certificate_key /etc/ssl/example/ssl.key;

    location / {
        include uwsgi_params;
        uwsgi_pass unix:/tmp/app.sock;
    }
}

This tells haproxy to setup a Layer 4 proxy to forward all TCP connections unmodified to the two nginx servers using roundrobin to balance the connections. The nginx app servers will share the load of negotiating SSL and parsing the HTTP requests. Proxy Protocol forwards the originating client's IP address from haproxy to nginx without having to modify the HTTP request headers. Notice how we told nginx to trust the IP address of your haproxy load balancer 10.0.0.10 to give us the client's real IP. SSL is distributed among your two nginx app servers, and your nginx log files show the correct client IP address for each request.

I wrote a blog post describing this:

https://wakatime.com/blog/34-how-to-scale-ssl-with-haproxy-and-nginx

share|improve this answer
    
Please provide relevant config content here, and link elsewhere for more details if necessary. We want your answer as posted on SF to remain relevant and helpful even long after your blog disappears or its link structure changes. – EEAA Jun 13 at 21:46
    
@EEAA thanks, just added the config content here. – Alan Hamlett Jun 15 at 7:47
    
Excellent! Downvote retracted. – EEAA Jun 15 at 7:51
    
Also, you may want to reference the version of haproxy as it relates to your answer. When this question was asked (and answered) way back in 2011, haproxy did not actually support SSL termination. – Ryan Bolger Jun 15 at 8:16
    
"or its link structure changes". That's actually pretty on point because the blog post linked has links back to itself for other posts that are currently returning 404s. – Ryan Bolger Jun 15 at 8:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.