HAProxy adalah perangkat lunak open source yang berfungsi sebagai load balancing dan proxy untuk TCP dan HTTP. Load balancing adalah metode untuk mendistribusikan atau membagikan trafik ke beberapa server.
0.Perangkat yang digunakan
Perangkat yang digunakan di tutorial ini:
- OS Ubuntu 18.04 LTS
- HAProxy
- Nginx web server
- PHP-FPM 7.2
- Node1: 10.130.127.167
- Node2: 10.130.128.35
- LoadBalancer: 128.199.187.215
- Domain: defnex.com
Node1 dan Node2 sudah terinstall Nginx web server dan PHP-FPM 7.2. Masing-masing node dibuatkan file index.php yang berisi tulisan node1 dan node2 sebagai halaman pengujian untuk mengetahui halaman yang ditampilkan berasal dari node yang mana.
1.Install HAProxy
Update dan install HAProxy.
1 2 | sudo apt update sudo apt install haproxy –y |
2.Konfigurasi HAProxy
Buka file konfigurasi HAProxy.
1 | sudo vim /etc/haproxy/haproxy.cfg |
File konfigurasi default dari haproxy.cfg.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 | global log /dev/log local0 log /dev/log local1 notice chroot /var/lib/haproxy stats socket /run/haproxy/admin.sock mode 660 level admin expose–fd listeners stats timeout 30s user haproxy group haproxy daemon # Default SSL material locations ca–base /etc/ssl/certs crt–base /etc/ssl/private # Default ciphers to use on SSL-enabled listening sockets. # For more information, see ciphers(1SSL). This list is from: # https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/ # An alternative list with additional directives can be obtained from # https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=haproxy ssl–default–bind–ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS ssl–default–bind–options no–sslv3 defaults log global mode http option httplog option dontlognull timeout connect 5000 timeout client 50000 timeout server 50000 errorfile 400 /etc/haproxy/errors/400.http errorfile 403 /etc/haproxy/errors/403.http errorfile 408 /etc/haproxy/errors/408.http errorfile 500 /etc/haproxy/errors/500.http errorfile 502 /etc/haproxy/errors/502.http errorfile 503 /etc/haproxy/errors/503.http errorfile 504 /etc/haproxy/errors/504.http |
Tambahkan konfigurasi untuk HAProxy listener.
1 2 3 4 | frontend http_front bind *:80 mode http default_backend http_back |
Tambahkan konfigurasi untuk backend web server.
1 2 3 4 5 6 7 8 9 | backend http_back mode http balance roundrobin option forwardfor http–request set–header X–Forwarded–Port %[dst_port] http–request add–header X–Forwarded–Proto https if { ssl_fc } option httpchk HEAD / HTTP/1.1rnHost:localhost server node1 10.130.127.167:80 server node2 10.130.128.35:80 |
Konfigurasi tambahan untuk statistik HAProxy.
1 2 3 4 5 6 7 8 | listen stats bind *:1234 stats enable stats hide–version stats refresh 30s stats show–node stats auth username:password stats uri /stats |
Hasil akhir konfigurasi HAProxy secara lengkap.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 | global log /dev/log local0 log /dev/log local1 notice chroot /var/lib/haproxy stats socket /run/haproxy/admin.sock mode 660 level admin expose–fd listeners stats timeout 30s user haproxy group haproxy daemon # Default SSL material locations ca–base /etc/ssl/certs crt–base /etc/ssl/private # Default ciphers to use on SSL-enabled listening sockets. # For more information, see ciphers(1SSL). This list is from: # https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/ # An alternative list with additional directives can be obtained from # https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=haproxy ssl–default–bind–ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS ssl–default–bind–options no–sslv3 defaults log global mode http option httplog option dontlognull timeout connect 5000 timeout client 50000 timeout server 50000 errorfile 400 /etc/haproxy/errors/400.http errorfile 403 /etc/haproxy/errors/403.http errorfile 408 /etc/haproxy/errors/408.http errorfile 500 /etc/haproxy/errors/500.http errorfile 502 /etc/haproxy/errors/502.http errorfile 503 /etc/haproxy/errors/503.http errorfile 504 /etc/haproxy/errors/504.http frontend http_front bind *:80 mode http default_backend http_back backend http_back mode http balance roundrobin option forwardfor http–request set–header X–Forwarded–Port %[dst_port] http–request add–header X–Forwarded–Proto https if { ssl_fc } option httpchk HEAD / HTTP/1.1rnHost:localhost server node1 10.130.127.167:80 server node2 10.130.128.35:80 listen stats bind *:1234 stats enable stats hide–version stats refresh 30s stats show–node stats auth username:password stats uri /stats |
Verifikasi konfigurasi dan restart HAProxy.
1 2 | sudo haproxy –c –f /etc/haproxy/haproxy.cfg sudo systemctl restart haproxy |
3.Pengujian
Browse domain, refresh halaman berulang kali sampai menampilkan file index.php dari Node1 dan Node2.
4.Statistik
Browse http://domain.com:1234/stats untuk membaca statistik HAProxy.
