1

We are having an application that heavily relies on websockets. As our Application is software-as-a-service, our clients can use their own domains (and forward them via CNAME to our servers). At the moment, we use a reverse proxy to balance the incoming traffice between multiple fixed-ip backend servers.

We now want to migrate our architecture to docker, supporting dynamic up- and downscaling, so our current reverse proxy isn't vaiable anymore ad it cannot automatically find the backend services in our AWS ECS Docker Cluster.

The Intended Infrastructure Looks something like:

                             +-> Docker Container 1
 Clients --> Load Balancer --+-> ...
                             +-> Docker Container n

However, we have multiple restraints:

  • We need to support the ACME Protocol for getting Let's Encrypt or AWS ACM SSL Certificates
  • We need to have sticky connections for the websockets (until one node goes down)
  • The Connection between the Load Balancer and the Backend Servers needs to be encrypted
  • each of our customers is having an own domain, so we need to support incoming HTTPS-Connections for several hundred different domains.
  • multiple different domains may not share one ssl-certificate to prevent lookups of our customer base
  • the load balancer needs to find new containers from the same service

any suggestions what Load Balancer is viable for us?

Edit: The Application Load Balancer is not Vaiable for our use as they have a limit of 25 Certificates at the moment

1 Answer 1

1

Looks like Application Load Balancer is your best bet.

We need to support the ACME Protocol for getting Let's Encrypt or AWS ACM SSL Certificates

AWS ACM is definitely an easier option with ELB/ALB.

We need to have sticky connections for the websockets (until one node goes down)

Tick.

The Connection between the Load Balancer and the Backend Servers needs to be encrypted

Tick. You can have self-signed certs on your containers, ALB will be happy with that.

Each of our customers is having an own domain, so we need to support incoming HTTPS-Connections for several hundred different domains.

Tick.

Multiple different domains may not share one ssl-certificate to prevent lookups of our customer base

There is a limit of 25 certs per ALB - I guess it can be increased through a support ticket. Even if not you can set up multiple ALBs, perhaps in different regions for different customer subsets.

The load balancer needs to find new containers from the same service.

That will be part of your container deployment.

Look at AWS ECS (Elastic Container Service), AWS Fargate (serverless container platform) and AWS EKS (Elastic Kubernetes Service). These are all different ways to run docker containers on AWS, each has it pros, cons and different pricing. And they all work seamlessly with Application Load Balancers.

Alternatively look at Network Load Balancer but then you’ll have to deal with SSL termination in the containers, including distribution and rotation of SSL certs (that can be done through shared storage like S3 or EFS).

Hope that helps :)

5
  • Nope. the 25 limit is fixed, the support told me this morning. Also having multiple ELBs is way way to expensive. We are using AWS ECS.
    – Tobi
    Oct 13, 2018 at 0:23
  • @Tobi don’t mistake ELB (classic LB) with ALB (application LB) - ALB is way cheaper than ELB and the ALB price depends on load with much lower fixed cost.
    – MLu
    Oct 13, 2018 at 0:27
  • @Tobi It doesn’t cost that much to have underutilised ALB. Surely if you’ve got hundreds of customers as you say you can spend lower tens of dollars per ALB for each 25 of them!
    – MLu
    Oct 13, 2018 at 0:35
  • according to the support pages, there is no real difference in price. At the moment, we are using a t2.nano instance for load balancing and it is at around 5% Average CPU which is at around 20$ per Month for almost 1000 different domains including traffic. Doing this with ELBs, it would be at least 100$ + Traffic (if I used 10 domains per certificate) but more reatistic is 800$ + traffic
    – Tobi
    Oct 13, 2018 at 0:40
  • Look at Network Load Balancer too - updated the answer.
    – MLu
    Oct 13, 2018 at 0:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .