Load Balancing

Distribute traffic across application servers for high availability, scalability, and fault tolerance.

When to Use

• Distributing HTTP/HTTPS traffic across multiple backend servers.
• Implementing health checks to route around unhealthy instances.
• Terminating TLS at the load balancer for simplified certificate management.
• Enabling blue/green or canary deployments with traffic shifting.
• Scaling horizontally behind a single entry point.

Prerequisites

• Two or more backend servers running the same application.
• TLS certificate for HTTPS termination (ACM, Let's Encrypt, or self-signed for internal).
• For AWS: VPC with public and private subnets across availability zones.
• For nginx/HAProxy: Linux server with root access.

nginx Load Balancer

Basic Round-Robin

# /etc/nginx/conf.d/loadbalancer.conf
upstream app_backend {
    server 10.0.1.10:8080;
    server 10.0.1.11:8080;
    server 10.0.1.12:8080;
}

server {
    listen 80;
    server_name app.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name app.example.com;

    ssl_certificate     /etc/ssl/certs/app.example.com.pem;
    ssl_certificate_key /etc/ssl/private/app.example.com-key.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    location / {
        proxy_pass http://app_backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_connect_timeout 5s;
        proxy_read_timeout 30s;
        proxy_send_timeout 30s;
    }

    location /health {
        access_log off;
        return 200 "OK";
    }
}

Weighted and Backup Servers

upstream app_backend {
    least_conn;  # Route to server with fewest active connections

    server 10.0.1.10:8080 weight=5;      # Gets 5x traffic
    server 10.0.1.11:8080 weight=3;      # Gets 3x traffic
    server 10.0.1.12:8080 weight=1;      # Gets 1x traffic
    server 10.0.1.20:8080 backup;        # Only used when others are down
    server 10.0.1.21:8080 down;          # Temporarily removed from pool
}

Health Checks (nginx Plus / OpenResty)

upstream app_backend {
    zone backend 64k;  # Shared memory zone for health data

    server 10.0.1.10:8080;
    server 10.0.1.11:8080;
    server 10.0.1.12:8080;
}

# Health check (requires nginx Plus or third-party module)
# match healthy {
#     status 200;
#     body ~ "OK";
# }
# health_check interval=5s fails=3 passes=2 match=healthy;

Sticky Sessions (IP Hash)

upstream app_backend {
    ip_hash;  # Same client IP always goes to the same server
    server 10.0.1.10:8080;
    server 10.0.1.11:8080;
    server 10.0.1.12:8080;
}

HAProxy Configuration

Full Production Config

# /etc/haproxy/haproxy.cfg
global
    log /dev/log local0
    maxconn 4096
    daemon
    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11
    tune.ssl.default-dh-param 2048

defaults
    mode http
    log global
    option httplog
    option dontlognull
    option forwardfor
    timeout connect 5s
    timeout client  30s
    timeout server  30s
    timeout http-request 10s
    timeout http-keep-alive 5s
    retries 3

frontend http_front
    bind *:80
    redirect scheme https code 301 if !{ ssl_fc }

frontend https_front
    bind *:443 ssl crt /etc/ssl/certs/app.example.com.pem
    http-request set-header X-Forwarded-Proto https

    # Route based on path
    acl is_api path_beg /api/
    acl is_ws  path_beg /ws/

    use_backend api_servers if is_api
    use_backend ws_servers  if is_ws
    default_backend web_servers

backend web_servers
    balance roundrobin
    option httpchk GET /health HTTP/1.1\r\nHost:\ app.example.com
    http-check expect status 200

    cookie SERVERID insert indirect nocache
    server web1 10.0.1.10:8080 check inter 5s fall 3 rise 2 cookie web1
    server web2 10.0.1.11:8080 check inter 5s fall 3 rise 2 cookie web2
    server web3 10.0.1.12:8080 check inter 5s fall 3 rise 2 cookie web3

backend api_servers
    balance leastconn
    option httpchk GET /api/health
    http-check expect status 200

    server api1 10.0.2.10:8080 check inter 5s fall 3 rise 2
    server api2 10.0.2.11:8080 check inter 5s fall 3 rise 2


…