CODEWITHSUNDEEP
haproxy
Marcel Emblazoned
Marcel Emblazoned

Reputation: 633

HAProxy: multiple websites, but only one of them needs to use ALL backends

I currently have a HAproxy loadbalancer setup with 2 backends for a total of 3 websites. One of the websites needs an extra server (a new backend, backend #3), but the others don't have to use this backend. Is there any way to do this? Sadly, I was not able to figure this out using the documentation. Config added. New backend is going to be .77. Thanks!

global
	log /dev/log	local0
	log /dev/log	local1 notice
	chroot /var/lib/haproxy
	stats socket /run/haproxy/admin.sock mode 660 level admin
	stats timeout 30s
	user haproxy
	group haproxy
	maxconn 2000
	daemon

	# Default SSL material locations
	ca-base /etc/ssl/certs
	crt-base /etc/ssl/private

	# Default ciphers to use on SSL-enabled listening sockets.
	# For more information, see ciphers(1SSL). This list is from:
	#  https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
	ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
	ssl-default-bind-options no-sslv3

	# use 7 of 8 cores, bind stats to the 7th. We want one core for OS and stuff :)
	
	nbproc 7
        cpu-map 1 1
        cpu-map 2 2
        cpu-map 3 3
        cpu-map 4 4
        cpu-map 5 5
        cpu-map 6 6
        cpu-map 7 7
        stats bind-process 7

defaults
	log	global
	mode	http
	option	httplog
	option	dontlognull
	option  forwardfor
	option  http-server-close
        timeout connect 5000
        timeout client  50000
        timeout server  50000
	errorfile 400 /etc/haproxy/errors/400.http
	errorfile 403 /etc/haproxy/errors/403.http
	errorfile 408 /etc/haproxy/errors/408.http
	errorfile 500 /etc/haproxy/errors/500.http
	errorfile 502 /etc/haproxy/errors/502.http
	errorfile 503 /etc/haproxy/errors/503.http
	errorfile 504 /etc/haproxy/errors/504.http


listen stats 192.168.3.78:1936
	stats enable
	stats uri /

frontend www-http
	bind 1.2.3.4:80
	bind 192.168.3.78:80
	reqadd X-Forwarded-Proto:\ http
	bind-process 1
	default_backend www-backend

frontend www-https
	bind 1.2.3.4:443 ssl crt /etc/ssl/private/1.full-pem crt /etc/ssl/private/2.full-pem crt /etc/ssl/private/3.full-pem 
	reqadd X-Forwarded-Proto:\ https
	option forwardfor
	bind-process 2 3 4 5 6
	default_backend www-backend

backend www-backend
	redirect scheme https if !{ ssl_fc }
        cookie SERVERID insert indirect nocache
	server www-1 192.168.3.75:80 check cookie www-1
	server www-2 192.168.3.74:80 check cookie www-2

Upvotes: 1

Views: 1057

Answers (1)

David Duponchel
David Duponchel

Reputation: 4059

A note about the word "backend": you used it in your question to describe the service that will get forwarded requests. To avoid confusion, I'll use here server for that, backend will be a group of server (to match the HAProxy terms).

You need two backend blocks, one with two server the other with three. In your frontend, use the hostname to choose the correct one:

frontend www-http
  [...]
  acl host_website3 hdr(host) -i website3.com         # match the new website
  use_backend www-backend-with3 if host_website3      # send it to the correct backend
  default_backend www-backend

backend www-backend
  redirect scheme https if !{ ssl_fc }
  cookie SERVERID insert indirect nocache
  server www-1 192.168.3.75:80 check cookie www-1
  server www-2 192.168.3.74:80 check cookie www-2

backend www-backend-with3                             # new backend here
  redirect scheme https if !{ ssl_fc }
  cookie SERVERID insert indirect nocache
  server www-1 192.168.3.75:80 check cookie www-1
  server www-2 192.168.3.74:80 check cookie www-2
  server www-3 192.168.3.77:80 check cookie www-3     # with a new server here

Upvotes: 2

Related Questions