Estoy intentando configurar el balanceador de carga HAproxy en centos 7, sin embargo, no puedo hacerlo funcionar. Desde los servicios dice que se está ejecutando, pero la página de estadísticas no se abre y tampoco dirige a ninguna parte. Lo que intento hacer es usarlo como equilibrador de carga para mover el tráfico al primer o segundo servidor protegido por https. El propio HAproxy no necesita estar protegido por https y actualmente no lo está. En este momento tengo la siguiente configuración:
#---------------------------------------------------------------------
# Example configuration for a possible web application. See the
# full configuration options online.
#
# http://haproxy.1wt.eu/download/1.4/doc/configuration.txt
#
#---------------------------------------------------------------------
#---------------------------------------------------------------------
# Global settings
#--------------------------------------------------------------------- global
# to have these messages end up in /var/log/haproxy.log you will
# need to:
#
# 1) configure syslog to accept network log events. This is done
# by adding the '-r' option to the SYSLOGD_OPTIONS in
# /etc/sysconfig/syslog
#
# 2) configure local2 events to go to the /var/log/haproxy.log
# file. A line like the following can be added to
# /etc/sysconfig/syslog
#
# local2.* /var/log/haproxy.log
#
log 127.0.0.1 local2
chroot /var/lib/haproxy
pidfile /var/run/haproxy.pid
maxconn 4000
user haproxy
group haproxy
daemon
# turn on stats unix socket
stats socket /var/lib/haproxy/stats
#---------------------------------------------------------------------
# common defaults that all the 'listen' and 'backend' sections will
# use if not designated in their block
#--------------------------------------------------------------------- defaults
mode http
log global
option httplog
option dontlognull
option http-server-close
option forwardfor except 127.0.0.0/8
option redispatch
retries 3
timeout http-request 10s
timeout queue 1m
timeout connect 10s
timeout client 1m
timeout server 1m
timeout http-keep-alive 10s
timeout check 10s
maxconn 3000
stats enable
stats auth haproxy:haproxy
stats uri /haproxy
#---------------------------------------------------------------------
# main frontend which proxys to the backends
#--------------------------------------------------------------------- frontend front
redirect scheme https code 301 if !{ ssl_fc }
bind *:80
mode http
default_backend app
#---------------------------------------------------------------------
# static backend for serving up images, stylesheets and such
#--------------------------------------------------------------------- backend app
mode http
balance roundrobin
option forwardfor
http-request set-header X-Forwarded-Port %[dst_port]
http-request add-header X-Forwarded-Proto https if { ssl_fc }
option httpchk HEAD / HTTP/1.1rnHost:localhost
server s1 192.168.14.65:443 check
server s2 192.168.14.200:443 check
#---------------------------------------------------------------------
# round robin balancing between the various backends
#--------------------------------------------------------------------- listen stats *:8080
mode http
log global
maxconn 10
clitimeout 100s
srvtimeout 100s
contimeout 100s
timeout queue 100s
stats refresh 30s stats show-node
los registros solo muestran lo siguiente:
Aug 21 16:06:00 localhost haproxy[11177]: Proxy front started.
Aug 21 16:06:00 localhost haproxy[11177]: Proxy app started.
Aug 21 16:10:08 localhost haproxy[11275]: Proxy front started.
Aug 21 16:10:08 localhost haproxy[11275]: Proxy app started.
Aug 21 16:10:08 localhost haproxy[11275]: Proxy stats started.
... pero nada más útil. Cuando voy a cualquiera de las direcciones IP descritas en el archivo de configuración cuando el servicio se está ejecutando, no obtengo absolutamente nada (se agotó el tiempo de espera).
También intenté eliminar los tiempos de espera, pero no sirvió de nada. Recibí estos mensajes sin tiempo de espera:
Aug 21 16:52:27 localhost haproxy[11413]: Server app/s1 is DOWN, reason: Layer7 invalid response, info: "<15><03><03>", check duration: 399ms. 1 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue.
Aug 21 16:52:28 localhost haproxy[11413]: Server app/s2 is DOWN, reason: Layer7 invalid response, info: "<15><03><03>", check duration: 227ms. 0 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue.
¿Algunas ideas?
Respuesta1
Yo tengo que trabajar ahora. El principal culpable fue el firewall que ejecutaba centos7, que bloqueó todos los puertos que necesitaba. También necesitaba modificar un poco mi configuración, para que se reenviara al backend ssh. La configuración final quedó así:
[root@rimilb ~]# cat /etc/haproxy/haproxy.cfg
#---------------------------------------------------------------------
# Example configuration for a possible web application. See the
# full configuration options online.
#
# http://haproxy.1wt.eu/download/1.4/doc/configuration.txt
#
#---------------------------------------------------------------------
#---------------------------------------------------------------------
# Global settings
#---------------------------------------------------------------------
global
# to have these messages end up in /var/log/haproxy.log you will
# need to:
#
# 1) configure syslog to accept network log events. This is done
# by adding the '-r' option to the SYSLOGD_OPTIONS in
# /etc/sysconfig/syslog
#
# 2) configure local2 events to go to the /var/log/haproxy.log
# file. A line like the following can be added to
# /etc/sysconfig/syslog
#
# local2.* /var/log/haproxy.log
#
log 127.0.0.1 local2
chroot /var/lib/haproxy
pidfile /var/run/haproxy.pid
maxconn 4000
user haproxy
group haproxy
daemon
# turn on stats unix socket
stats socket /var/lib/haproxy/stats
#---------------------------------------------------------------------
# common defaults that all the 'listen' and 'backend' sections will
# use if not designated in their block
#---------------------------------------------------------------------
defaults
mode http
log global
option httplog
option dontlognull
option http-server-close
option forwardfor except 127.0.0.0/8
option redispatch
retries 3
maxconn 3000
stats enable
stats auth haproxy:haproxy
stats uri /haproxy
#---------------------------------------------------------------------
# main frontend which proxys to the backends
#---------------------------------------------------------------------
frontend front
bind 192.168.14.251:80
reqadd X-Forwarded-Proto:\ http
default_backend app
#---------------------------------------------------------------------
# static backend for serving up images, stylesheets and such
#---------------------------------------------------------------------
backend app
balance roundrobin
server s1 192.168.14.65:443 weight 1 maxconn 100 check ssl verify none
server s2 192.168.14.200:443 weight 1 maxconn 100 check ssl verify none
#---------------------------------------------------------------------
# round robin balancing between the various backends
#---------------------------------------------------------------------
listen stats *:8080
mode http
log global
maxconn 10
clitimeout 100s
srvtimeout 100s
contimeout 100s
timeout queue 100s
stats refresh 30s
stats show-node