So this article will be a continuation of Simple Load Balancing and will use extensions from Installing an SSL certificate. What we are going to do is build a load balancer using the skeleton from the last article and encrypt all the traffic from the load balancer side. What this means is that all of your webheads have to do is serve content. They'll be passing unencrypted data across the backend network and all data will be encrypted by the load balancer for the customer. Make sure when using this type of setup that you are using a strong firewall via IPtables or some other software firewall.
As for the load balancer itself, I haven't actually put this into production so you may need to change the size from a standard 256M server to a larger configuration to allow for more processing cycles you may need.
So this is really going to be a short article, we are building off of a model that has completed 90% of the work for us already. You will need to have already created the load balancer from Simple Load Balancing and have a working SSL certificate from Installing an SSL certificate. I'll be running this from a 256M CentOS box for testing purposes.
To pass SSL to your Proxy you only need to add the following lines to the config file. Keep in mind that you will need to change the path to were ever it is that you keep your ssl.crt and ssl.key files. Its almost a little anti-climatic, using this type of setup will keep the load of encrypting your traffic off of your webheads.
SSLCertificateFile /etc/httpd/conf/ssl.crt/domain.com.crt SSLCertificateKeyFile /etc/httpd/conf/ssl.key/domain.com.key
Here is the final Virtual Host:
NameVirtualHost 184.108.40.206:443 <VirtualHost 220.127.116.11:443> ProxyRequests off ServerName domain.com <Proxy balancer://mycluster> # WebHead1 BalancerMember http://10.176.42.144:80 # WebHead2 BalancerMember http://10.176.42.148:80 # Security "technically we aren't blocking # anyone but this the place to make those # chages Order Deny,Allow Deny from none Allow from all # Load Balancer Settings # We will be configuring a simple Round # Robin style load balancer. This means # that all webheads take an equal share of # of the load. ProxySet lbmethod=byrequests </Proxy> # balancer-manager # This tool is built into the mod_proxy_balancer # module and will allow you to do some simple # modifications to the balanced group via a gui # web interface. <Location /balancer-manager> SetHandler balancer-manager # I recommend locking this one down to your # your office Order deny,allow Allow from all </Location> # Point of Balance # This setting will allow to explicitly name the # the location in the site that we want to be # balanced, in this example we will balance "/" # or everything in the site. ProxyPass /balancer-manager ! ProxyPass / balancer://mycluster/ # mod_ssl # Here is the information that will allow you to Encrypt your # traffic behind the load balancer. Not a whole big change # but it will get you up and running.
SSLEngine on SSLCertificateFile /etc/httpd/conf/ssl.crt/domain.com.crt SSLCertificateKeyFile /etc/httpd/conf/ssl.key/domain.com.key </VirtualHost>
© 2011-2013 Rackspace US, Inc.
Except where otherwise noted, content on this site is licensed under a Creative Commons Attribution-NonCommercial-NoDerivs 3.0 Unported License