Load balancing PHP web application with three servers

Question

I have 2 web servers and 1 server that is intended to be used as reverse proxy or load balancer. 2 web servers have real/public IPs as well as the load balancer. Load balancer server is not configured yet because I did not decide which option will be best for my web applications. I am aware of one load balancer is risky because "single point of failure" but I want to go with it.

2 web servers contain more than one PHP application/vhost (Apache + fastcgi) with same domain and different subdomains. They all use sessions, cookies and some of them require SSL. My main goal is purely divide incoming connections in half and forward them to 2 web nodes. And if one web node goes offline, the other should accept all connections. And I think if needed we can do session sharing with memcache.

I read about Nginx, HaProxy and any other application I can find on the net. But I cannot decide because :

1) I have 1 server that I can use as load balancer but all configuration I found on the net needs 2 load balancer nodes. 2) I am not sure where should I install SSL certificates (on load balancer or web nodes) and which solution is the best while using HTTPS connections.

Any help/idea is needed, thanks a lot.

Answer 1

I've used HAProxy in a similar setup and I highly recommend it. It can run very well on a single server and you only need two servers for load balancing in case you want high availability.

There are many tutorials such as this that provides detailed explanations on how to set it up in the configuration you seek.

Answer 2

I just yesterday created a configuration where NGINX server as a load balancer, behind which there are 2 PHP-FPM servers, 1 Memcache server and 1 MySQL server. NGINX was configured using Upstreaming feature and the related configuration lines are something like this:

html {

    ...

    # loadbalancing        
    upstream myLoadBalancer {
        ip_hash; # makes sure same user uses the same server, not 100% effective - application
                 # should handle this; in my case 1 Memcached and 1 MySQL servers commonly used
                 # by all App-servers work just fine. I store sessions in Memcache, so Session 
                 # management isn't a problem at all. Its shared across all App-servers.
        server 192.168.1.10:9000; # location of my first php-fpm server
        server 192.168.1.11:9000; # second php-fpm server
        # server aaa.bbb.ccc.ddd:80; # let's say, an Apache server
    }

    #vhost
    server {
        listen 80;
        server_name mydomain.com;
        index index.php;

        location ~* \.php$ {
            gzip on;
            try_files $uri =404;
            include fastcgi_params;
            fastcgi_pass myLoadBalancer;
            fastcgi_index index.php;
            fastcgi_param SCRIPT_FILENAME /path/to/webdir$fastcgi_script_name;
            fastcgi_param PATH_INFO $fastcgi_script_name;
        }
    }
}

HTTPS: They should be installed on NGINX load-balancer if I am not mistaken - never tried myself. Once client request is passed down to App-server, it will process it, fetch the request and send it back to NGINX. And NGINX, before relaying the response to the client, will encrypt the content. Its a theory of course. But I am 100% positive NGINX can handle SSL quite easily. It is the fastest and the most robust proxy/balancer and good webserver when combined with FASTCGI capabilities of various CLIs.

NOTE: This is not a configuration for production environment, but a test-case scenario. Production environment would require much secure settings. Following resources could be of use:

• Top 20 NGINX Webserver Best Security Practices
• PHP-FPM and NGINX

Answer 3

In any situation where you want HTTPS to more than 1 web server, your ideal solution would be to have Nginx installed in front of your web servers. It can also be used for load-balancing, but if you need more complexe configuration options, then it's a good idea to have Nginx requests forwarded to your HAProxy instance. Both services use minimal resources so don't worry about running both.

I'm familiar with the idea of only having 3 servers and not wanting redundant load-balancers. I actually wrote an eBook for scaling architectures and it includes some examples with 2-3-4 servers and only 1 load-balancer. Maybe it can provide more information and help you get started.

Answer 4

You can do what you need with just one HAProxy node (although this still leaves you with a single point of failure).

I have written a tutorial for installing HAProxy on Rackspace Cloud, which can be adapted to any Ubuntu setup. By using the cookie option you can also enforce session persistence, so no need to share sessions between boxes, users will only lose their session if the box they are on goes down mid session.

Once you have your standard HTTP traffic balanced through HAProxy you can then send your SSL through as well using the mode tcp option. This can't insert cookies into the request so use the balance mode of source. This balances based on the user's IP, so won't change mid-session unless you add additional nodes.

Your SSL certs are then installed on both your web nodes as HAProxy is just balancing the TCP traffic. Incidentally, you can use this balance mode with anything over TCP, including MySQL connections for some real high availability solutions.