HAProxy with SSL (https) and Sticky Session

Question

I need to setup Load balancer as an alternative for ELB for Amazon as they have issue in connection timeout.

Currently, Im using HAProxy and it works normally. However, I need to use SSL for users who wants to connect in https (port 443) to the backend apache servers plus sticky session.

What will be the configuration would looks like? I heard that HAProxy doesn't support SSL in native and can use stunnel or nginx / apache to handle the SSL termination.

I would appreciate anyone to share their knowledge and experiences.

Thanks. James

Answer 1

To http use something like that. Change the XXX.XXX.XXX.XXX to your IP address.

listen  example-cluster XXX.XXX.XXX.XXX:80
        mode    http
        stats   enable
        stats   auth    user:password
        stick store-request src
        stick-table type ip size 200k expire 2m
        balance source
        cookie  JSESSIONID prefix
        option  httplog
        option  httpclose
        option  forwardfor
        option  persist
        option  redispatch
        option  httpchk HEAD    /check.txt      HTTP/1.0
        server  example-webl XXX.XXX.XXX.XXX:80 cookie A check
        server  example-web2 XXX.XXX.XXX.XXX:80 cookie B check
        server  example-web3 XXX.XXX.XXX.XXX:80 cookie C check
        server  example-web4 XXX.XXX.XXX.XXX:80 cookie D check
        server  example-web5 XXX.XXX.XXX.XXX:80 cookie E check

To your SSL use the mode tcp with balance source:

listen  example-cluster-ssl XXX.XXX.XXX.XXX:443
        mode   tcp
        reqadd X-Forwarded-Proto:\ https
        stick  store-request src
        stick-table type ip size 200k expire 2m
        option persist
        option redispatch
        option ssl-hello-chk
        balance source
        server  example-webl XXX.XXX.XXX.XXX:443 check
        server  example-web2 XXX.XXX.XXX.XXX:443 check
        server  example-web3 XXX.XXX.XXX.XXX:443 check
        server  example-web4 XXX.XXX.XXX.XXX:443 check
        server  example-web5 XXX.XXX.XXX.XXX:443 check

Another way is your upgrade your haproxy to version 1.5, in that version have support to ssl but isn't stable yet.

Answer 2

Take a look at the Stud project on github, which combines extremely well with haproxy, is very performant, scalable, and uses very little resource. Many users are switching to it right now because it's simple and efficient.