Haproxy 1.5 HTTPS termination and Load balancing

Create certificate files in /etc/haproxy

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/haproxy/apache.pem -out /etc/haproxy/apache.crt

 openssl req  $@  -new  -x509  -days  365  -nodes  -out  apache.pem -keyout  apache.pem

#here $@  =  '@' Expands to the positional parameters, starting from one.  When the expansion occurs within double quotes, each parameter expands to  a  separate  word.   That  is, "$@" is equivalent to "$1" "$2" ...

#chmod 600 /etc/apache2/apache.pem

cat   apache.pem   apache.key  >   apache.final.pem


#This is self signed

configuration file /etc/haproxy/haproxy.cfg

root@haserva:~# cat /etc/haproxy/haproxy.cfg
global
log /dev/log local0
log /dev/log local1 notice
chroot /var/lib/haproxy
stats socket /run/haproxy/admin.sock mode 660 level admin
stats timeout 30s
user haproxy
group haproxy
daemon
maxconn 256

# Default SSL material locations
ca-base /etc/ssl/certs
crt-base /etc/ssl/private

# Default ciphers to use on SSL-enabled listening sockets.
# For more information, see ciphers(1SSL).
ssl-default-bind-ciphers kEECDH+aRSA+AES:kRSA+AES:+AES256:RC4-SHA:!kEDH:!LOW:!EXP:!MD5:!aNULL:!eNULL
        ssl-default-bind-options no-sslv3

defaults
log global
mode http
option httplog
option dontlognull
option  forwardfor #enables the insertion of the X-Forwarded-For header to requests sent to servers.
        option redispatch
option http-server-close #reduces latency between HAProxy and your users by closing connections but maintaining keep-alives,Enable or disable HTTP connection closing on the server side,enables HTTP connection-close mode on the server side while keeping the ability to support HTTP keep-alive and pipelining on the client side.  This provides the lowest latency on the client side (slow network) and the fastest session reuse on the server side to save server resources
option tcp-smart-accept
option tcp-smart-connect
#option dontlog-normal
timeout connect 5000#amount of time HAProxy should spend trying to connect to a host so if a host died, HAProxy would try to connect to the same host for 30 seconds option specifies the maximum time to wait for a connection attempt to a VPS to succeed.
        timeout client  50000
        timeout server  50000
timeout http-keep-alive 10s
timeout check 5s
retries 3
compression algo gzip
compression type text/html text/html;charset=utf-8 text/plain text/css text/javascript application/x-javascript application/javascript application/ecmascript application/rss+xml application/atomsvc+xml application/atom+xml application/atom+xml;type=entry application/atom+xml;type=feed application/cmisquery+xml application/cmisallowableactions+xml application/cmisatom+xml application/cmistree+xml application/cmisacl+xml application/msword application/vnd.ms-excel application/vnd.ms-powerpoint
errorfile 400 /etc/haproxy/errors/400.http
errorfile 403 /etc/haproxy/errors/403.http
errorfile 408 /etc/haproxy/errors/408.http
errorfile 500 /etc/haproxy/errors/500.http
errorfile 502 /etc/haproxy/errors/502.http
errorfile 503 /etc/haproxy/errors/503.http
errorfile 504 /etc/haproxy/errors/504.http
#frontend defn
frontend www-http
bind *:80
reqadd X-Forwarded-Proto:\ http
default_backend apache
frontend www-https
bind *:443 ssl crt /etc/haproxy/apache.final.pem
reqadd X-Forwarded-Proto:\ https
default_backend apache

#backend definitions
backend apache
redirect scheme https if !{ ssl_fc }
mode http
###statistics page
stats enable
stats auth demo:p@ssw0rd
        stats hide-version
stats uri /monitor
stats refresh 2s
###statistics page end

# balance source
# cookie SRV_ID prefix
# server web1 192.168.163.40:80 check cookie web1
# server web2 192.168.163.41:80 check cookie web2
balance roundrobin
server web1 192.168.163.40:80 check

server web2 192.168.163.41:80 check

central php session directory
..............................................
 vim /etc/php5/apache2/php.ini

session.save_path = "/gmount/phpsession/"       #here gmount/phpsession is new directory to store session by default phpsession is /var/lib/php5


Now copy ownership and file permission

chmod --reference=/var/lib/php5/ /gmount/phpsession/
chown root:root /gmount/phpsession