linuxexpert-practice-labs/labs/lfcs/2-8-reverse-proxies-load-balancers

LFCS 2.8: Reverse proxies and load balancers

nginx as a reverse proxy and load balancer, sticky balancing, HAProxy with health checks, and passing on the client's address.

Before you start

The lab runs three back ends on this VM, on 127.0.0.1:8081, 8082 and 8083 (units le-backend@8081 and so on). Each answers with a page that names it, such as Back end 8081, and logs the X-Forwarded-For header it receives (journalctl -u le-backend@8081). nginx and HAProxy aren't installed.

The peer, at 10.99.0.2, is the other VM: test from there with sudo ip netns exec lepeer curl http://10.99.0.1/.

Tasks

1. Put nginx on port 80 in front of the back end on 8081 (on the RHEL family with SELinux enforcing), so curl http://10.99.0.1/ from the peer returns the back end's page. If firewalld is running, allow it through.
2. Balance the requests to port 80 across the back ends with nginx: 8081 and 8082 in turn, with 8083 as a backup.
3. On port 81, balance across the same back ends with nginx, sticky by client address (without backup), so repeated requests from one host always reach the same back end. Allow port 81 through the firewall too, if one runs.
4. Ubuntu: do the balancing of task 2 with HAProxy on port 8080, with health checks, so a stopped back end leaves the rotation within a few seconds. Allow port 8080 through ufw if it's active.
5. Make the back ends behind port 80 receive the real client's address in an X-Forwarded-For header.

Hints

• upstream, proxy_pass, server ... backup, ip_hash; nginx -t, then reload. On Ubuntu, the default site in sites-enabled is the default server for port 80.
• RHEL: a 502 with SELinux enforcing means ausearch -m avc and setsebool -P httpd_can_network_connect.
• frontend, backend, balance roundrobin, server ... check, option httpchk GET /; haproxy -c -f /etc/haproxy/haproxy.cfg.
• proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for.
• systemctl stop le-backend@8081 to test failover.