Thursday, June 01, 2017
SSL termination and http caching with HAProxy, Varnish and Apache
A common requirement when setting up a development or staging server is to try to mimic production as much as possible. One scenario I've implemented a few times is to use Varnish in front of a web site but also use SSL. Since Varnish can't handle encrypted traffic, SSL needs to be terminated before it hits Varnish. One fairly easy way to do it is using HAProxy to terminate both HTTP and HTTPS traffic, then forwarding the unencrypted traffic to Varnish, which then forwards non-cached traffic to Apache or nginx. Here are the steps to achieve this on an Ubuntu 16.04 box.
1) Install HAProxy and Varnish
# apt-get install haproxy varnish
2) Get SSL certificates from Let’s Encrypt
# wget https://dl.eff.org/certbot-auto
# chmod +x certbot-auto
# ./certbot-auto -a webroot --webroot-path=/var/www/mysite.com -d mysite.com certonly
3) Generate combined chain + key PEM file to be used by HAProxy
# cat /etc/letsencrypt/live/mysite.com/fullchain.pem /etc/letsencrypt/live/mysite.com/privkey.pem > /etc/ssl/private/mysite.com.pem
4) Configure HAProxy
Edit haproxy.cfg and add frontend sections for ports 80 and 443 + backend section pointing to varnish on port 8888
# cat /etc/haproxy/haproxy.cfg
global
log /dev/log local0
log /dev/log local1 notice
chroot /var/lib/haproxy
stats socket /run/haproxy/admin.sock mode 660 level admin
stats timeout 30s
user haproxy
group haproxy
daemon
# Default SSL material locations
ca-base /etc/ssl/certs
crt-base /etc/ssl/private
# Default ciphers to use on SSL-enabled listening sockets.
# For more information, see ciphers(1SSL). This list is from:
# https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
ssl-default-bind-options no-sslv3
tune.ssl.default-dh-param 2048
defaults
log global
mode http
option httplog
option dontlognull
timeout connect 5000
timeout client 50000
timeout server 50000
errorfile 400 /etc/haproxy/errors/400.http
errorfile 403 /etc/haproxy/errors/403.http
errorfile 408 /etc/haproxy/errors/408.http
errorfile 500 /etc/haproxy/errors/500.http
errorfile 502 /etc/haproxy/errors/502.http
errorfile 503 /etc/haproxy/errors/503.http
errorfile 504 /etc/haproxy/errors/504.http
frontend www-http
bind 172.31.8.204:80
http-request set-header "SSL-OFFLOADED" "1"
reqadd X-Forwarded-Proto:\ http
default_backend varnish-backend
frontend www-https
bind 172.31.8.204:443 ssl crt mysite.com.pem
http-request set-header "SSL-OFFLOADED" "1"
reqadd X-Forwarded-Proto:\ https
default_backend varnish-backend
backend varnish-backend
redirect scheme https if !{ ssl_fc }
server varnish 172.31.8.204:8888 check
Enable UDP in rsyslog for haproxy logging by uncommenting 2 lines in /etc/rsyslog.conf:
# provides UDP syslog reception
module(load="imudp")
input(type="imudp" port="514")
Restart rsyslog and haproxy
# service rsyslog restart
# service haproxy restart
5) Configure varnish to listen on port 8888
Ubuntu 16.04 is using systemd for service management. You need to edit 2 files to configure the port varnish will listen on:
/lib/systemd/system/varnish.service
/etc/default/varnish
In both, set the port after the -a flag to 8888, then stop the varnish service, reload the systemctl daemon and restart the varnish service:
# systemctl stop varnish.service
# systemctl daemon-reload
# systemctl start varnish.service
By default, Varnish will send non-cached traffic to port 8080 on localhost.
6) Configure Apache or nginx to listen on 8080
For Apache, change port 80 to 8080 in all virtual hosts, and also change 80 to 8080 in /etc/apache2/ports.conf.
Subscribe to:
Post Comments (Atom)
Modifying EC2 security groups via AWS Lambda functions
One task that comes up again and again is adding, removing or updating source CIDR blocks in various security groups in an EC2 infrastructur...
-
Here's a good interview question for a tester: how do you define performance/load/stress testing? Many times people use these terms inte...
-
I've been using dnspython lately for transferring some DNS zone files from one name server to another. I found the package extremely us...
-
Update 02/26/07 -------- The link to the old httperf page wasn't working anymore. I updated it and pointed it to the new page at HP. Her...
No comments:
Post a Comment