Currently we have good ol' LVS running in the same subnet as our webservers. We use Piranha for automatic redundancy and take full advantage of the status check scripts to not only automatically detect when a server is down, but to curl a control page we have written so we can take servers off the cluster (and put them back on!) at our leisure. It's a neat and useful solution. We load balance http and https with no issue.
We are in the process of tightening up security and are going to put in proxies on a different subnet to forward to the web servers. Ideally we would like to proxy and load balance on the same box (cluster).
So essentially my requirements are:
- Must be able to reverse proxy
- Must be able to load balance (across subnets, so LVS is out).
- Must be able to modify the http headers so we can determine true client IP (X-Forwarded-For is okay but we'd prefer to add a custom tag, only Apache can do this that I've seen so far).
- Must have automatic redundancy with automatic failover
- Must support https (ideally all the way to the back end)
- Ideally have the ability to run a status check (send/expect) script to determine if the host is up or down.
I've found 1 solution that could involve Pound and Stunnel but I can't find a clear answer on whether Pound works in layer 3. How do you make Pound redundant?
The same for HAProxy, how do you make that redundant? I know there's a httpcheck module for that so that's good. Can you modify headers with HAProxy (other than X-Forwarded-For)?
So far all I can come up with is sticking our existing LVS cluster in front of a bunch of Apache servers run mod_proxy and mod_http and have a 1 to 1 mapping of proxy to web server. I'm all ears to other solutions though!
EDIT: I can't work out if HAProxy supports https without Stunnel now. If it does can it forward decrypt the https then send a https request to the back end or does it decrypt and forward off http?