HAProxy + Nodejs + SockJS + Express + SSL

Question

I've got a server setup in NodeJS which looks like the picture below:

Now what i want to do two things which seem to be possible with HAProxy :

1. To only use one port no matter what server a client wants to access. I want to use the external port 8080 for all non SSL traffic. (All SSL traffic should use the port 443)

2. Enable SSL on the SockJS Server and the Express Server .

Please not that all my servers are running on the same instance on an amazon ec2 . So i want to internally route the traffic.

This is my haproxy.cfg so far:

    mode http
    # Set timeouts to your needs
    timeout client  10s
    timeout connect 10s
    timeout server  10s

frontend all 0.0.0.0:8080
    mode http
    timeout client 120s

    option forwardfor
    # Fake connection:close, required in this setup.
    option http-server-close
    option http-pretend-keepalive

    acl is_sockjs path_beg /echo /broadcast /close
    acl is_stats  path_beg /stats

    use_backend sockjs if is_sockjs
    use_backend stats if is_stats
    default_backend express


backend sockjs
    # Load-balance according to hash created from first two
    # directories in url path. For example requests going to /1/
    # should be handled by single server (assuming resource prefix is
    # one-level deep, like "/echo").
    balance uri depth 2
    timeout server  120s
    server srv_sockjs1 127.0.0.1:8081

backend express
    balance roundrobin
    server srv_static 127.0.0.1:8008

backend stats
    stats uri /stats
    stats enable

Cant figure out how to route the SSL and the traffic to the TCP Server (8080 internal port)

Any ideas?

Answer 1

Your setup is kinda hard to understand (for me). If I understand your goals correctly, you want to serve your web service through SSL hence port 443. And from 443, connect to port 8080 (internally). If that is the case then the following configuration might be what you are looking for. It does not really use port 8080 but instead it connects directly to your express backend. You don't really need to have port 8080 exposed (unless you have special reasons for doing so) because you can just use the backend servers directly inside the frontend section.

Note that this only works for HAProxy 1.5+, if you are using older version of HAProxy, you should put something to tunnel the SSL connection before it reaches HAProxy (But I strongly suggest 1.5 because it makes your setup less complex)

frontend ssl
    bind *:443 ssl crt /path/to/cert.pem ca-file  /path/to/cert.pem
    timeout client 120s

    option forwardfor
    # Fake connection:close, required in this setup.
    option http-server-close
    option http-pretend-keepalive

    acl is_sockjs path_beg /echo /broadcast /close
    acl is_stats  path_beg /stats

    use_backend sockjs if is_sockjs
    use_backend stats if is_stats
    default_backend express