0

We are working on a networked service, where all the functionality of our software is exposed via an in-house web-server. The company's clients connect to it via a browser, does their tasks, log out, work is done.

But this in house web server is a pretty straightforward software, or how to say, it's not so configurable, not very flexible, will do its own thing, which is serving the needs of the customer and it's more or less done. Or understand it better: does not support load balancing, or SSL, or anything that would be required by a trustable web service.

So, the big decision came around, we need to "hide" this in-house component in a local network, and put an industrial strength web server facing the internet to be able to access our service (which somehow would talk to the in-house server). And since the calculations done by this in-house component are pretty time consuming, we would like to have at least two (as per December, 2015) of them running in the local network, totally invisible to the outside network, and somehow divide the work between them.

Now, comes the problem. All of us are more or less database or algorithm programmers, we know almost nothing about how to set up (properly) a web server (no, we don't have budget to hire anyone doing it, but we are willing to learn the required steps), now how to make the "wires of the networking" part.

Here comes the "requirements": The platform for the industrial strength web server will be Linux (we were thinking of using apacher, however please suggest anything you would consider important here, knowing the requirements), the in house components also runs also on Linux.

There will be 3 computers (for now). One facing the internet, with a public IP, will host the web-server. We plan to install SSL, and obtain a certificate , to have an https interface to it (is this correct at least?).

The server on this computer will need to talk to the two other computers, hosting the two in-house web servers (if I recall correctly this is called forwarding), and preferably pick the one which is not being busy working on a clients' request (this if I'm right is load balancing).

A little bit of technological information:

The requests that the in-house computers work with are formed like:

The GET requests come in like:

https://somecompanysoftware.com/SOME_LONG_REQUEST_STRING_WITH_SOME_DATA_IN_IT

and there is the corresponding web page rendered (from the data in the URL), but also there are POST requests, like:

https://somecompanysoftware.com/SOME_LONG_REQUEST_STRING_WITH_SOME_OTHER_DATA_IN_IT

and there is POST data in the request (for example, client uploading a picture, etc ...)

and certainly the web page corresponding to the URL data is rendered.

It is really important that the internet facing web server (apache) should connect to the local web servers with the corresponding URL, and also pass in the required POST data for later usage.

I also have read that the apacahe web server has the possibility of enabling the user to create modules, so we were thinking to create a module which upon a a request from the internet will create a "local" request to one of the in-house web servers, send in the data, and wait for the answer which then will be sent back to the browser.

The question: I am just wondering, whether there is a way of making this more easier (than writing a new apache module) or if this is the only way to go.

1
  • You most certainly do not need a new module for this. Apache or nginx can act as a simple reverse proxy with round robin load balancing or you can set up something like HAProxy if your load balancing needs are more elaborate.
    – Sven
    Dec 14, 2015 at 10:08

2 Answers 2

0

Are you wanting the public facing server to operate as a caching reverse proxy? You can configure Apache (and most web servers) to do this, but you might want to consider Squid:

http://wiki.squid-cache.org/SquidFaq/ReverseProxy

3
  • Thank you for the reply. Before I can answer your question, I'll have to learn what a caching reverse proxy is :) Dec 14, 2015 at 10:03
  • The squid server responds to each request. Where it has already responded to a GET previously and has the response cached, it is able to re-serve the response without having to bother the internal web server. For POST requests and "cache misses" (requests that the proxy doesn't have in its cache) squid will refer to the underlying web server. It means the underlying web server isn't repeatedly having to server static content.
    – user79772
    Dec 14, 2015 at 10:06
  • varnish is much more suitable (and easier to setup than squid) as a reverse proxy.
    – wurtel
    Dec 14, 2015 at 13:07
0

I would certainly setup 2 apache servers with a haproxy server in from of them. Depending on the certificate you getting, either hostname or wildcard, you can then decide if you want you apache server to also have the certificate or not.

In other words. If you get a hostname certificate, you use that cert on the hproxy that will then also termininate the SSL connection. You can then pass the traffic through to the apache servers in clear text.

On the other hand, if you get a wildcard certificate, you can use that on the both the haproxy and the apache servers.

Just shout if you need help with the haproxy setup.

Kobus

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .