JIL india HA proxy

Auto-generated from the uploaded PDF JIL_india_HA_proxy.pdf. This is an extracted-text rendering for searchability; see the original PDF for exact formatting, diagrams, tables, and images.

HA proxy Installation and configuration

172.16.118.213 mta1.jalindia.co.in
172.16.118.214 mta2.jalindia.co.in
172.16.118.211 haproxy1.jalindia.co.in
172.16.118.212 haproxy2.jalindia.co.in
172.16.118.232 Virtual IP


Reference Doc -
https://wiki.zimbra.com/wiki/Zimbra_Proxy_HA

Configure Local repo

Add below entry in /etc/hosts
172.16.118.213 mta1.jalindia.co.in
172.16.118.214 mta2.jalindia.co.in
172.16.118.211 haproxy1.jalindia.co.in
172.16.118.212 haproxy2.jalindia.co.in


Install HA proxy package
   1.​yum install haproxy
Install keepalived package
   1.​yum install keepalived


Move existing haproxy file to .bkp

   1.​mv /etc/haproxy/haproxy.conf
      /etc/haproxy/haproxy.conf.bkp
Create new file
   1.​vi /etc/haproxy/haproxy.conf
Add below configuration
global

    log /dev/log local0
    log /dev/log local1 notice
    chroot /var/lib/haproxy
    stats socket /run/admin.sock mode 660 level admin
    stats timeout 30s
    user haproxy
    group haproxy
    daemon
    tune.ssl.default-dh-param    2048

defaults
    log global
    mode http
    option httplog
    option dontlognull
    option http-server-close
    option forwardfor
    timeout connect 5000ms
    timeout client 50000ms
    timeout server 50000ms

frontend https-in
     bind *:443 ssl crt /etc/haproxy/certs/bundle.pem
     default_backend nginx-backend

backend nginx-backend
    balance roundrobin
    http-request add-header X-Forwarded-Proto https
    http-request add-header X-Forwarded-Port 443
    option forwardfor
    http-response add-header Cache-Control no-cache
    cookie SERVER_USED insert indirect nocache
    server nginx1 172.16.118.213:443 check ssl verify none
    server nginx2 172.16.118.214:443 check ssl verify none

frontend smtp
     bind *:25
     mode tcp
     log global
     option tcplog
     default_backend bk_smtp

backend bk_smtp
    mode tcp
    log global
    balance leastconn
    option tcplog
    server mta1 172.16.118.213:25 check port 25
    server mta2 172.16.118.214:25 check port 25

frontend submission
     bind *:587
     mode tcp
     default_backend bk_submission

backend bk_submission
    mode tcp
    server submit1 172.16.118.213:587 check port 587
    server submit2 172.16.118.214:587 check port 587

frontend imap
     bind *:143
     mode tcp
     default_backend bk_imap

backend bk_imap
    mode tcp
    balance leastconn
    server imap1 172.16.118.213:143 check port 143
    server imap2 172.16.118.214:143 check port 143

frontend pop3
     bind *:110
     mode tcp
     default_backend bk_pop3s

backend bk_pop3s
    mode tcp
    balance leastconn
    stick store-request src
    stick-table type ip size 200k expire 30m
    server pop3s1 172.16.118.213:995 check port 995
    server pop3s2 172.16.118.214:995 check port 995


mv existing keepalived configuration file to .bkp
  1.​mv /etc/keepalived/keepalived.conf
     /etc/keepalived/keepalived.conf.bkp

Create new conf file
  1.​vi /etc/keepalived/keepalived.conf
Add below configuration

Change 10.1.100.7 to our virtual IP 172.16.118.232

Generate certificates via openssl command

and change ssl file path in haproxy configuration file

Restart service
systemctl restart keepalived haproxy
systemctl status keepalived haproxy

—-------------------------------------------------------------------------------------