Skip to main content

Load Balancer with HAProxy SSL Termination

The Load Balancer is like the sister of clustering. If you make Ant Media Server instances run in cluster mode, then a load balancer will be required to balance the load.

In this documentation, you will learn how to install HAProxy Load Balancer with SSL termination.

The configuration below balances RTMP, HLS, HTTP/HTTPS and WebSocket(WS/WSS) connections to use for RTMP, HLS and WebRTC streaming.

HAProxy Installation​

Run the commands below to install HAProxy

sudo apt-get install software-properties-common -y
sudo add-apt-repository ppa:vbernat/haproxy-2.0
sudo apt-get update
sudo apt-get install haproxy=2.0.\*

SSL Certificate Installation​

Install the Certbot​

sudo apt-get update
sudo apt-get install software-properties-common
sudo add-apt-repository ppa:certbot/certbot
sudo apt-get update
sudo apt-get install certbot

Get the Certificate​

Please change example.com with your domain name

sudo certbot certonly --standalone -d example.com -d www.example.com

Combine the PEM files​

Combine fullchain.pem and privkey.pem and save it to /etc/haproxy/certs folder

sudo mkdir -p /etc/haproxy/certs
DOMAIN='example.com' 
sudo -E bash -c 'cat /etc/letsencrypt/live/$DOMAIN/fullchain.pem /etc/letsencrypt/live/$DOMAIN/privkey.pem >` /etc/haproxy/certs/$DOMAIN.pem'
sudo chmod -R go-rwx /etc/haproxy/certs

Now there is a valid pem file ready under /etc/haproxy/certs ready to be used by HAProxy.

Configuring HAProxy​

Backup the default configuration file​

mv /etc/haproxy/haproxy.cfg{,_backup}

Create a new configuration file​

nano /etc/haproxy/haproxy.cfg

Add global and default parameters to the configuration file​

global
    log 127.0.0.1 local0 notice
    maxconn 2000
    user haproxy
    group haproxy
defaults
    log global
    mode http
    option forwardfor
    option http-server-close
    option httplog
    option dontlognull
    timeout connect 5000
    timeout client  5000
    timeout server  5000
    timeout tunnel  2h  #this is for websocket connections, 2 hours inactivity timeout
    timeout client-fin 5000
    errorfile 400 /etc/haproxy/errors/400.http
    errorfile 403 /etc/haproxy/errors/403.http
    errorfile 408 /etc/haproxy/errors/408.http 
    errorfile 500 /etc/haproxy/errors/500.http
    errorfile 502 /etc/haproxy/errors/502.http
    errorfile 503 /etc/haproxy/errors/503.http
    errorfile 504 /etc/haproxy/errors/504.http

This configuration sets the maximum number of connections to 2000. Please change it according to your hardware and cluster size.

Add Monitoring Parameters​

Please change {WRITE_YOUR_USERNAME} and {WRITE_YOUR_PASSWORD} with your own username and password. You can use these parameters while entering the monitor panel

listen stats # Define a listen section called "stats"
  bind :6080 
  mode http
  stats enable  # Enable stats page
  stats hide-version  # Hide HAProxy version
  stats realm Haproxy\ Statistics  # Title text for popup window
  stats uri /haproxy_stats  # Stats URI
  stats auth {WRITE_YOUR_USERNAME}:{WRITE_YOUR_PASSWORD}  # Authentication credentials

With the configuration above you can visit http://HAPROXY_LB:6080/haproxy_stats URL to monitor the HAProxy

RTMP Load Balancing​

Add the following lines for RTMP Load balancing. Please change {WRITE_YOUR_FIRST_AMS_SERVER_IP_ADDRESS} and {WRITE_YOUR_SECOND_AMS_SERVER_IP_ADDRESS} with your Ant Media Server addresses.

frontend rtmp_lb
    bind *:1935 
    mode tcp
    default_backend backend_rtmp

backend backend_rtmp
    mode tcp
    server ams1 {WRITE_YOUR_FIRST_AMS_SERVER_IP_ADDRESS}:1935 check  # Ant Media Server instance 1
    server ams2 {WRITE_YOUR_SECOND_AMS_SERVER_IP_ADDRESS}:1935 check  # Ant Media Server instance 2
    # you can add more instances

HTTP Load Balancing​

Add following lines to add HTTP Load Balancing

frontend http_lb_origin
  bind *:80
  mode http
  reqadd X-Forwarded-Proto:\ http
  origin_backend_http
  
frontend http_lb_edge
  bind *:5080
  mode http
  reqadd X-Forwarded-Proto:\ http
  edge_backend_http

HTTPS Load Balancing​

Add following lines to add HTTPS Load Balancing. Please change {DOMAIN_NAME} with your full qualified domain name.

frontend frontend_origin_https
  bind *:443 ssl crt  /etc/haproxy/certs/{DOMAIN_NAME}.pem
  reqadd X-Forwarded-Proto:\ https
  origin_backend_http

frontend frontend_edge_https
  bind *:5443 ssl crt /etc/haproxy/certs/{DOMAIN_NAME}.pem
  reqadd X-Forwarded-Proto:\ https
  edge_backend_http

HTTP Backend Servers​

Specify the backend servers for HTTP Load Balancing. Please change {WRITE_YOUR_FIRST_AMS_SERVER_IP_ADDRESS} and {WRITE_YOUR_SECOND_AMS_SERVER_IP_ADDRESS} with your Ant Media Server addresses.

backend origin_backend_http
  leastconn
  # below line forwards http requests to https, if you do not have SSL termination, remove it
  redirect scheme https if ! { ssl_fc }
  # below line provides session stickiness
  cookie JSESSIONID prefix nocache
  server origin1 {WRITE_YOUR_FIRST_AMS_SERVER_IP_ADDRESS}:5080 check cookie origin1  #if you do not use session stickiness, remove cookie ams1
  server origin2 {WRITE_YOUR_SECOND_AMS_SERVER_IP_ADDRESS}:5080 check cookie origin2  #if you do not use session stickiness, remove cookie ams2
  # you can add more instances

backend edge_backend_http
  leastconn
  # below line forwards http requests to https, if you do not have SSL termination, remove it
  redirect scheme https if ! { ssl_fc }
  # below line provides session stickiness
  cookie JSESSIONID prefix nocache
  server edge1 {WRITE_YOUR_FIRST_AMS_SERVER_IP_ADDRESS}:5080 check cookie edge1  #if you do not use session stickiness, remove cookie ams1
  server edge2 {WRITE_YOUR_SECOND_AMS_SERVER_IP_ADDRESS}:5080 check cookie edge2  #if you do not use session stickiness, remove cookie ams2
  # you can add more instances

RTMPS Load Balancing​

In order to encrypt your RTMP traffic, follow the instructions below.

If you're using let's encrypt, run the following command. Replace $DOMAIN with your own FQDN

sudo -E bash -c 'cat /etc/letsencrypt/live/$DOMAIN/fullchain.pem /etc/letsencrypt/live/$DOMAIN/privkey.pem >` /etc/haproxy/certs/$DOMAIN.pem'

If you're using a third party certificate, you can even generate the pem file as follows.

Append KEY and CRT to ssl.pem. Replace $DOMAIN with your own FQDN

cat ssl.key ssl.crt >`>` /etc/haproxy/certs/$DOMAIN.pem

Now add the following lines in haproxy.conf

listen rtmps
  mode tcp
      #Replace $DOMAIN with your own FQDN 
  bind :8443 ssl crt /etc/haproxy/certs/$DOMAIN.pem # Your cert file.
  server rtmp {WRITE_YOUR_FIRST_AMS_SERVER_IP_ADDRESS}:1935
      server rtmp {WRITE_YOUR_SECOND_AMS_SERVER_IP_ADDRESS}:1935

Starting HAProxy​

When everything is complete, restart the HAProxy

systemctl restart haproxy

and you can view status of the instance through http://HAPROXY_LB:6080/haproxy_stats URL