GitHub user daviftorres added a comment to the discussion: What things to do
after setting up load balancer on top of management servers.
Dear @anirudh09041,
I haven't used Oracle LB for ACS myself, but it is straightforward.
Note: you do not need to use the LB for port 8250, since the hosts will receive
a list of MGMT servers they can connect to. I would go this route because the
LB may close idle TCP connections, forcing hosts to reconnect frequently (this
may be adjustable in the settings, like stickiness or long timeouts). I'm not
saying it is a bad idea, it just needs some testing and adjustments.
For the UI/API, there is not much mystery: the LB can terminate TLS and manage
the certificate, then relay HTTP traffic to port 8080 as you described. ACS
does not really check which Host header is used or anything like that, so it
behaves as a simple web app. Still, it is good to have the headers proxied to
the targets so they get logged appropriately.
And, of course, create a rule to redirect requests that arrive on port 80 to
HTTPS on the same host and URI.
Here is an equivalent setup for NGINX, if you want to take a peek:
```
ssl_certificate /etc/nginx/fullchain.crt;
ssl_certificate_key /etc/nginx/privatekey.key;
ssl_ciphers HIGH:!aNULL:!MD5;
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name example.com;
location / {
proxy_pass http://10.10.10.10:8080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_connect_timeout 300;
proxy_send_timeout 300;
proxy_read_timeout 300;
send_timeout 300;
}
}
```
GitHub link:
https://github.com/apache/cloudstack/discussions/14400#discussioncomment-18925503
----
This is an automatically sent email for [email protected].
To unsubscribe, please send an email to: [email protected]
