0

I've been looking around different setups for a server cluster supporting SSL and I would like to benchmark my idea with you.

Requirements:

  • All servers in the cluster should be under the same full domain name. (http and https)
  • Routing to subsystems is done on URI matching in HA proxy.
  • All URIs have support for SSL support.

Wish:

  • Centralizing routing rules

            ---<----http-----<--
        |                  |
Inet -->HA--+---https--->NGInx_SSL_1..N
            |
            |
            +---http---> Apache_1..M
            |
            +---http---> NodeJS

Idea: Configure HA to route all SSL traffic (mode=tcp,algorithm=Source) to an NGInx cluster turning https traffic into http. Re-pass the http traffic from NGInx to the HA for normal load-balancing which performs load balancing based on HA config.

My question is simply: Is this the best way to to configure based on requirements above?

Improve this question

3 Answers 3

Reset to default
1

The way I've always heard of it being deployed is that you would have multiple load balancers, all running nginx (or stunnel) to strip the SSL. These would then directly connect to the backend servers. Your approach of having a separate set of servers to decrypt the SSL seems like it would be quite complex.

Honestly, what are you hoping to get out of this setup? Is your traffic too much for one server? Are you hoping to get high-availablity (in which case you need multiple HAproxy servers, which adds to the confusion)?

Improve this answer
1
  • also what we are doing. Use nginx as SSL offloader, forwarding traffic to HAPROXY (which also get http traffic straight) which then load balance internally. Allows you to keep your traffic secure up to your edge. NGINX also support SSI. Quite an interesting features if all browsers accepted it.
    – CloudWeavers
    Dec 13, 2012 at 16:57
0

To me your setup seems a little bit strange and complicated. I also think it will be hard, if at all possible, to manage to get the original visitor's ip address into the final nginx logs.

A common alternative is to use stunnel in front of haproxy. Stunnel will decrypt the ssl and feed it to haproxy, which can in turn forward the stuff to the appropriate backend server. This solution also has some difficulty in forwarding the original ip address, but if you use the current 1.5 development version of haproxy and v. 4.45 or later of stunnel, you can use the PROXY protocol for that.

Improve this answer
0

So there are two options.. use stunnel with the xforwardfor patch

https://github.com/davean/stunnel-xforwardfor

This will allow you to set the header for the backend servers to read from

I would just sit nginx in front of it to handle the ssl termination and also setting the xforwardfor header back to the app. Put it on the same server as haproxy. Also you could just use ngninx for passing back based on routes also so there would be no need for even haproxy.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .