An ansible swiss army knife to manage your higly available front proxies Are you struggling to keep in sync the configuration of all your front proxies or, worst, you don’t have a redundant infrastructure? HA²Proxy enables you to easily deploy a redundant configuration of the well-know open source software HAProxy either in a continuous or disaster recovery solution. This toolkit manages the SSL certificates and HAProxy configuration by keeping them in sync between all nodes, just with an “enter”.

1. HA²Proxy
11 November 2022 Marco Marinello
An ansible swiss army knife to manage your higly available front proxies

2. Portrait
Picture
$ whoami
●
(Freelance) Developer / SysAdmin
●
President of the Linux User Group of Bolzano
●
TDF Member
●
Former FUSS Project technical partner

3. What’s HA²proxy?
●
Solution originally developed for the FUSS project
●
Set of Ansible roles
●
Famous HAproxy deploying tool
●
Certificates manager
●
BC / DR ready infra tool

4. What can HA²proxy do for you?
●
Effortless SSL certificates replication between multiple proxies;
●
Support for certbot hook for renewals;
●
Balance incoming traffic between multiple application servers;
●
Roll-out HAproxy upgrades;
●
Add, remove or edit domains in a matter of seconds.

5. Use cases:
single front proxy
[PUBLIC IP]

Application
server 1
HA²proxy
Primary

Application
server 2


6. Use cases:
single front proxy
[PUBLIC IP]

Application 1
HA²proxy
Primary

Application 2


7. Use cases:
redundant front proxy
[PUBLIC IPs]

Application 1
HA²proxy
Primary
HA²proxy
Secondary

Application 2
 

8. Use cases:
BC / hot spare
[PUBLIC IP]

Application
server 1
HA²proxy
Primary

Application
server 2

[PUBLIC IP]

Application
server 1
HA²proxy
Primary

Application
server 2

:80 & :443
closed

9. Handling
of certbot
validation

Let’s Encrypt
server

Domain in A?
moodle.fuss.bz.it. 1037 IN CNAME fpx1-bz1.fuss.bz.it.
fpx1-bz1.fuss.bz.it. 1037 IN A 185.161.193.53
fpx1-bz1.fuss.bz.it. 1037 IN A 185.161.193.48
 Proxy #1
 Proxy #2
(random)

10. Handling
of certbot
validation on non primaries
Incoming traffic
port :80  HAProxy
frontend http_in
path begins with /.well-known/acme-challenge ?
No Yes
HTTP 302
https:// ...  Proxy to certbot standalone
running on primary:8079

11. Single
YAML
conf file

12. 1
2
Run time
Sync playbook runs relatively slow
even when all but 1 domains are
certified.
~37sec for 50 domains
Weaknesses
Optimization
Need to read both private and public
keys of every certificate and then
consistency-check the corresponding
file under /etc/haproxy/ssl

13. Thank you!
Resources:
●
GitLab repo
https://gitlab.com/mmaridev/ha2proxy
●
Original GitLab repo (unmaintained)
https://gitlab.fuss.bz.it/fuss-team/ha2proxy
●
Get in touch:
contact-nohuman@marinello.bz.it