Skip to main content
Version: 2.12-SNAPSHOT

Load Balancer with HAProxy SSL Termination

The load balancer is the main part of the cluster. If you make Ant Media Server instances run in cluster mode, then a load balancer will be required to balance the load.

In this documentation, we will learn how to install HAProxy Load Balancer with SSL termination.

HAProxy Installation

Run the below commands to install HAProxy.

sudo apt-get update
sudo apt-get install haproxy

SSL Certificate Installation

Install the Certbot

sudo apt-get update
sudo apt-get install software-properties-common
sudo add-apt-repository ppa:certbot/certbot
sudo apt-get update
sudo apt-get install certbot

Get the Certificate

Please change example.com with your domain name:

sudo certbot certonly --standalone -d example.com -d www.example.com

Combine the PEM files

Combine fullchain.pem and privkey.pem and save it to the /etc/haproxy/certs folder.

sudo mkdir -p /etc/haproxy/certs
DOMAIN='example.com'
sudo -E bash -c "cat /etc/letsencrypt/live/$DOMAIN/fullchain.pem /etc/letsencrypt/live/$DOMAIN/privkey.pem > /etc/haproxy/certs/$DOMAIN.pem"
sudo chmod -R go-rwx /etc/haproxy/certs

A valid pem file is now available under /etc/haproxy/certs, ready for use by HAProxy.

Configure HAProxy

In this step, HAProxy will be set up as a load balancer.

Backup default configuration file

sudo mv /etc/haproxy/haproxy.cfg{,_backup}

Create new configuration file

sudo nano /etc/haproxy/haproxy.cfg

HAProxy configuration as Load Balancer

global
log 127.0.0.1 local0 notice
maxconn 2000
user haproxy
group haproxy

defaults
log global
mode http
option forwardfor
option http-server-close
option httplog
option dontlognull
timeout connect 5000
timeout client 5000
timeout server 5000
timeout tunnel 2h # This is for websocket connections, 2 hours inactivity timeout
timeout client-fin 5000
errorfile 400 /etc/haproxy/errors/400.http
errorfile 403 /etc/haproxy/errors/403.http
errorfile 408 /etc/haproxy/errors/408.http
errorfile 500 /etc/haproxy/errors/500.http
errorfile 502 /etc/haproxy/errors/502.http
errorfile 503 /etc/haproxy/errors/503.http
errorfile 504 /etc/haproxy/errors/504.http

# Put the username and password for authentication

listen stats
bind :6080
mode http
stats enable
stats hide-version
stats realm Haproxy\ Statistics
stats uri /haproxy_stats
stats auth username:password

frontend rtmp_lb
bind *:1935
mode tcp
default_backend backend_rtmp

backend backend_rtmp
mode tcp
server ams1 {AMS_ORIGIN1_IP}:1935 check
server ams2 {AMS_ORIGIN2_IP}:1935 check

frontend http_lb_origin
bind *:80
mode http
http-request add-header X-Forwarded-Proto http
default_backend origin_backend_http

frontend http_lb_edge
bind *:5080
mode http
http-request add-header X-Forwarded-Proto http
default_backend edge_backend_http

frontend frontend_origin_https
bind *:443 ssl crt /etc/haproxy/certs/$DOMAIN.pem
http-request add-header X-Forwarded-Proto https
default_backend origin_backend_http

frontend frontend_edge_https
bind *:5443 ssl crt /etc/haproxy/certs/$DOMAIN.pem
http-request add-header X-Forwarded-Proto https
default_backend edge_backend_http

backend origin_backend_http
balance leastconn
redirect scheme https if !{ ssl_fc }
cookie JSESSIONID prefix nocache
server origin1 {AMS_ORIGIN1_IP}:5080 check cookie origin1

backend edge_backend_http
balance leastconn
redirect scheme https if !{ ssl_fc }
cookie JSESSIONID prefix nocache
server edge1 {AMS_EDGE1_IP}:5080 check cookie edge1

frontend frontend_dashboard
bind *:4444 ssl crt /etc/haproxy/certs/$DOMAIN.pem
http-request add-header X-Forwarded-Proto https
default_backend dashboard_backend_http

backend dashboard_backend_http
balance leastconn
redirect scheme https if !{ ssl_fc }
cookie JSESSIONID prefix nocache
server dashboard1 {AMS_ORIGIN1_IP}:5080 check cookie dashboard1
server dashboard2 {AMS_EDGE1_IP}:5080 check cookie dashboard2

Start HAProxy

When everything is complete, restart the HAProxy

sudo systemctl restart haproxy

Access Ant Media Server

You can access the Ant Media Server dashboard at https://haproxy-domain:4444

Access the HAProxy web panel

You can view status of the Ant Media Server backend through http://haproxy-domain:6080/haproxy_stats URL.

You need to use the username and password as defined in the configuration above.