Page MenuHomeVyOS Platform
Create Task
Maniphest T5222

Add load-balancing reverse-proxy based on haproxy
Closed, ResolvedPublicFEATURE REQUEST
Actions

Description

Add load-balancing based on haproxy.
Allows layer 4 and 7 balancing.

Proposed CLI

set load-balancing reverse-proxy server fr01 backend 'bk01'
set load-balancing reverse-proxy server fr01 mode 'http'
set load-balancing reverse-proxy server fr01 port '8888'

set load-balancing reverse-proxy backend bk01 balance-mode 'least-connection'
set load-balancing reverse-proxy backend bk01 mode 'http'
set load-balancing reverse-proxy backend bk01 server srv01 address '192.168.122.11'
set load-balancing reverse-proxy backend bk01 server srv01 port '8881'
set load-balancing reverse-proxy backend bk01 server srv02 address '192.168.122.11'
set load-balancing reverse-proxy backend bk01 server srv02 port '8882'

config haproxy

vyos@r14# cat /run/haproxy/haproxy.cfg 
# Generated by /usr/libexec/vyos/conf_mode/load-balancing-haproxy.py

defaults
    log     global
    mode    http
    option  httplog
    option  dontlognull
    timeout connect 5s
    timeout client  50s
    timeout server  50s

# Frontend
frontend fr01
    bind :8888
    mode http
    default_backend bk01

# Backend
backend bk01
    mode http
    server srv01 192.168.122.11:8881
    server srv02 192.168.122.11:8882

Details

Version
-
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Feature (new functionality)

Related Objects
Search...

StatusSubtypeAssignedTask
 ResolvedFEATURE REQUESTViacheslavT5222 Add load-balancing reverse-proxy based on haproxy
ResolvedFEATURE REQUESTViacheslavT5231 Add op-mode for load-balancing reverse-proxy

Event Timeline

Viacheslav created this task.May 12 2023, 1:30 PM
Viacheslav renamed this task from Add loadbalancing based on haproxy to Add load-balancing based on haproxy .
Viacheslav claimed this task.
Viacheslav updated the task description. (Show Details)May 12 2023, 6:01 PM
Viacheslav updated the task description. (Show Details)May 12 2023, 6:09 PM
Viacheslav updated the task description. (Show Details)May 12 2023, 6:20 PM
pasik subscribed.May 12 2023, 6:21 PM
c-po subscribed.EditedMay 12 2023, 7:50 PM

We should make the ssl-bind ciphers and ssl-bind-options configurable (<multi/> node) by the user

On a different setup I used to have TLS1.2

ssl-default-bind-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets

but now I limit it to TLSv1.3 only

tune.ssl.default-dh-param  2048
ssl-default-bind-ciphers TLS13-AES-256-GCM-SHA384:TLS13-AES-128-GCM-SHA256:TLS13-CHACHA20-POLY1305-SHA256:EECDH+AESGCM:EECDH+CHACHA20
ssl-default-bind-options force-tlsv13

So maybe have a tls-version-min CLI node (similar to OpenVPN) which expands to the above options. In order to make the world more secure, we should start off by using minimum supported version on the CLI = TLS1.2

Viacheslav added a comment.May 13 2023, 1:19 PM

PR https://github.com/vyos/vyos-1x/pull/2004

Viacheslav updated the task description. (Show Details)May 15 2023, 12:02 PM
Viacheslav updated the task description. (Show Details)May 15 2023, 12:29 PM
Restricted Repository Identity mentioned this in rVYOSONEX9e9794a763e7: Merge pull request #2004 from sever-sever/T5222.May 17 2023, 4:46 PM
Viacheslav mentioned this in rVYOSONEX6d0325190fce: T5222: Add load-balancing for web traffic.May 17 2023, 4:46 PM
c-po mentioned this in rVYOSONEXf06fdc347c85: reverse-proxy: T5222: use common XML building blocks for alpha numeric….May 17 2023, 4:48 PM
c-po mentioned this in rVYOSONEXd1edf6850823: reverse-proxy: T5222: combine ipv4/ipv6-address validators.May 17 2023, 5:04 PM
c-po mentioned this in rVYOSONEX23118d7b4e1c: reverse-proxy: T5222: improve help strings.
Viacheslav added a comment.May 19 2023, 10:15 AM

PR refactoring https://github.com/vyos/vyos-1x/pull/2012

set load-balancing reverse-proxy service http description 'bind port 80 and redirect to 443'
set load-balancing reverse-proxy service http mode 'http'
set load-balancing reverse-proxy service http port '80'
set load-balancing reverse-proxy service http redirect-http-to-https

set load-balancing reverse-proxy service https description 'bind port 80'
set load-balancing reverse-proxy service https mode 'http'
set load-balancing reverse-proxy service https port '443'

set load-balancing reverse-proxy service https rule 10 domain-name 'r11.example.com'
set load-balancing reverse-proxy service https rule 10 domain-name 'r12.example.com'
set load-balancing reverse-proxy service https rule 10 domain-name 'r13.example.com'
set load-balancing reverse-proxy service https rule 10 set backend 'bk-01'
set load-balancing reverse-proxy service https rule 20 domain-name 'r22.example.com'
set load-balancing reverse-proxy service https rule 20 set backend 'bk-02'

set load-balancing reverse-proxy backend bk-01 description 'My API-1'
set load-balancing reverse-proxy backend bk-01 mode 'http'
set load-balancing reverse-proxy backend bk-01 server srv-01 address '192.168.122.11'
set load-balancing reverse-proxy backend bk-01 server srv-01 port '5000'
set load-balancing reverse-proxy backend bk-02 description 'My API-2'
set load-balancing reverse-proxy backend bk-02 mode 'http'
set load-balancing reverse-proxy backend bk-02 server srv-01 address '192.168.122.12'
set load-balancing reverse-proxy backend bk-02 server srv-01 port '5000'

set load-balancing reverse-proxy global-parameters max-connections '1100'
set load-balancing reverse-proxy global-parameters tls-version-min 1.2
Restricted Repository Identity mentioned this in rVYOSONEXa66648596dc1: Merge pull request #2012 from sever-sever/T5222-mod.May 19 2023, 10:21 AM
Viacheslav mentioned this in rVYOSONEXe201bd35511e: T5222: Refactoring load-balancing reverse-proxy.May 19 2023, 10:21 AM
Viacheslav added a comment.May 19 2023, 4:29 PM

PR listen-address fixes https://github.com/vyos/vyos-1x/pull/2013

Restricted Repository Identity mentioned this in rVYOSONEX63380de9b57e: Merge pull request #2013 from sever-sever/T5222.May 19 2023, 6:52 PM
Viacheslav mentioned this in rVYOSONEXe9dce894eec2: T5222: load-balancing reverse-proxy add smoketest domains.May 19 2023, 6:52 PM
Viacheslav mentioned this in rVYOSONEX62ce80bd0cb4: T5222: reverse-proxy add send-proxy option for backend server.
Viacheslav mentioned this in rVYOSONEX9ffbc8d8f9a2: T5222: reverse-proxy fix template for listen-address.
Viacheslav changed the task status from Open to Needs testing.May 20 2023, 7:32 AM
Viacheslav renamed this task from Add load-balancing based on haproxy to Add load-balancing reverse-proxy based on haproxy .May 20 2023, 8:20 AM
Viacheslav changed the status of subtask T5231: Add op-mode for load-balancing reverse-proxy from Open to In progress.May 25 2023, 8:36 AM
Viacheslav closed subtask T5231: Add op-mode for load-balancing reverse-proxy as Resolved.Jun 10 2023, 8:03 AM
Viacheslav closed this task as Resolved.Jun 13 2023, 11:00 AM
Viacheslav moved this task from Open to Finished on the VyOS 1.4 Sagitta board.
dongjunbo subscribed.Jul 25 2023, 2:08 AM

Would you please backport this feature to VyOS 1.3.x?

Viacheslav added a comment.Jul 25 2023, 12:59 PM

@dongjunbo It requires more tests and reviews

indrajitr mentioned this in rVYOSONEXde1aedac060d: haproxy: T5222: Enable backend completion in service ruleset.Jan 9 2025, 3:20 PM
Restricted Repository Identity mentioned this in rVYOSONEX8470f7d07639: Merge pull request #4293 from indrajitr/haproxy-backend-completion.Jan 9 2025, 3:20 PM