⑤ Load Balancing

firewall adjustment #

• I needed to permit traffic from internal hosts to the VIP on tcp:443
• I needed to permit traffic from the firewalls to the proxmox nodes on TCP:7480

OPNsense Haproxy config #

Real Servers (Backends) #

Main info #

• Name or Prefix

  px-m-40-7080

• Description

  px-m-40-rados

• Type

  static

Static Server #

• FQDN or IP

  px-m-40.dog.wolfspyre.io

• Port

  7480

• Mode

  active [default]

• Multiplexer Protocol

  auto-selection [recommended]

• Prefer IP Family

  prefer IPv4

Common Options #

• SSL

  [ ]

• SSL SNI

  px-m-40.dog.wolfspyre.io

• Verify SSL Certificate

  [ ]

• SSL Verify CA

  Nothing Selected

• SSL Verify CRL

  None

• SSL Client Certificate

  None

• Max Connections

  N/A

• Weight

  N/A

• Check Interval

  N/A

• Down Interval

  N/A

• Port to check

  N/A

• Source address

  198.18.198.1

• Option pass-through

  N/A

Backend Pools #

• advanced mode

  [ x ]

• Enabled

  [ x ]

• Name

  PXMCeph-S3-Pool

• Description

  Proxmox Ceph S3 Backend Pool

• Mode

  HTTP (Layer 7) [default]

• Balancing Algorithm

  Source-IP Hash [default]

• Random Draws

  2

• Proxy Protocol

  none

• Servers

  • pxm-40-8006
  • pxm-41-8006
  • pxm-42-8006
  • pxm-43-8006
  • pxm-44-8006
  • pxm-45-8006

• FastCGI Application

  none

• Resolver

  none

• Resolver Options

  none

• Prefer IP Family

  prefer IPv4

• Source address

  198.19.198.1

• Enable Health Checking

  [x]

Health Checking #

• Health Monitor

  PXM UI Port 8006 Check

• Log Status Changes

  a

• Check Interval

  a

• Down Interval

  a

• Unhealthy Threshold

  a

• Healthy Threshold

  a

• E-Mail Alert

  none

HTTP(S) settings #

• Enable HTTP/2

  [ ]

• HTTP/2 without TLS

  [ ]

• Advertise Protocols (ALPN)

  • HTTP/1.1
  • HTTP/1.0

Persistence #

• Persistence type

  Stick-table persistence [default]

Stick-table persistence #

• Table type

  none

• Stored data types

  Connection count

• Expiration time

  30m

• Size

  50k

• Cookie name

  none

• Cookie length

  none

• Connection rate period

  60s

• Session rate period

  60s

• HTTP request rate period

  60s

• HTTP error rate period

  60s

• Bytes in rate period

  60s

• Bytes out rate period

  60s

Basic Authentication #

• Enable

  [ ]

• Allowed Users

  Nothing selected

• Allowed Groups

  Nothing selected

Tuning Options #

• Connection Timeout

  20s

• Check Timeout

  10s

• Server Timeout

  20s

• Retries

  1

• Option pass-through

  none

• Default for server

  none

• Use Frontend port

  [ ]

• HTTP reuse

  Always

• Enable Caching

  [ X ]

Rules #

• Select Rules

  noneyet

Error Messages #

• Select Error Messages

  Nothing selected

Condition #

COND:HostEndsWith-dog_wolfspyre_io COND:HostMatches-dog_wolfspyre_io

Rules #

RUL-AllowHTTPReq-EndsWith-dog_wolfspyre_io

Health Check #

readiness check on TCP:7480

Backend Pool #

Ceph-S3-VIP-Pool

Frontend Pools #

Internal pool #

External pool #

Testing #

Maintenance #