S
S
StasStasov2021-08-04 15:39:00
Apache HTTP Server
StasStasov, 2021-08-04 15:39:00

How to fix nextcloud authorization via haproxy?

Good afternoon, Linux masters! :)
So, we have the following scheme on board:
x1 Load Balancer (HAProxy)172.17.70.55
x2 Nextcloud servers 172.17.70.58 and 172.17.70.59
x1 Redis
x1 Minio
x2 Mysql master + Salve

Nextcloud servers work synchronously, individually, it enters each web interface without problems, under the same login, too, LDAP authorization is screwed, but has not yet been

enabled - enter the login password, and obviously false - the page is updated and that's it, then nothing happens

SSL until the

Logs are screwed below

- HAProxy config

global
        log /dev/log    local0
        log /dev/log    local1 notice
        chroot /var/lib/haproxy
        stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
        stats timeout 30s
        user haproxy
        group haproxy
        daemon

        # Default SSL material locations
        ca-base /etc/ssl/certs
        crt-base /etc/ssl/private

        # Default ciphers to use on SSL-enabled listening sockets.
        # For more information, see ciphers(1SSL). This list is from:
        #  https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
        # An alternative list with additional directives can be obtained from
        #  https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=haproxy
        ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS
        ssl-default-bind-options no-sslv3

defaults
        log     global
        mode    http
        option  httplog
        option  dontlognull
        timeout connect 5000
        timeout client  50000
        timeout server  50000
        errorfile 400 /etc/haproxy/errors/400.http
        errorfile 403 /etc/haproxy/errors/403.http
        errorfile 408 /etc/haproxy/errors/408.http
        errorfile 500 /etc/haproxy/errors/500.http
        errorfile 502 /etc/haproxy/errors/502.http
        errorfile 503 /etc/haproxy/errors/503.http
        errorfile 504 /etc/haproxy/errors/504.http

frontend Local_Server
    bind 172.17.70.55:80
    mode http
    default_backend My_Web_Servers

backend My_Web_Servers
    mode http
    balance roundrobin
    option forwardfor
   # http-request set-header X-Forwarded-Port %[dst_port]
   # http-request add-header X-Forwarded-Proto https if { ssl_fc }
   # option httpchk HEAD / HTTP/1.1rnHost:localhost
    server web1  172.17.70.59:80
    server web2  172.17.70.58:80


Config of one of the NC server

<?php
$CONFIG = array (
  'instanceid' => 'oceetf******',
  'passwordsalt' => 't2Zu4RO5cDNtVFzkmucOL572/tKasp',
  'secret' => '9Gah9dRITODJgiS53OVY2XjgdALew0RjikvndFFLO3m4SEpH',
  'trusted_domains' =>
  array (
    0 => '172.17.70.58',
    1 => '172.17.70.55',
    2 => '172.17.70.59',

  ),
  'trusted_proxies' => '172.17.70.55',
  'datadirectory' => '/var/www/html/nextcloud/data',
  'dbtype' => 'mysql',
  'version' => '21.0.0.18',
  'overwrite.cli.url' => 'http://172.17.70.55',
  'dbname' => 'nextcloud',
  'dbhost' => '172.17.70.53',
  'dbport' => '3306',
  'dbtableprefix' => 'oc_',
  'dbuser' => '*******',
  'dbpassword' => '*********',
  'installed' => true,
  'memcache.local' => '\\OC\\Memcache\\APCu',
  'memcache.distributed' => '\\OC\\Memcache\\Redis',
  'redis' =>
  array (
    'host' => '172.17.70.57',
    'port' => 6379,
  ),
  'memcache.locking' => '\\OC\\Memcache\\Redis',
  'theme' => '',

  'loglevel' => 2,
  'maintenance' => false,
  'updater.release.channel' => 'stable',
  'ldapProviderFactory' => 'OCA\\User_LDAP\\LDAPProviderFactory',
  'overwritecondaddr' => '^172\.17\.70\.55',

);


I did not notice any errors in the logs, I can attach them in the comments
Please help, because I'm doing this for the first time, it's very interesting, but I can't understand this situation.
Thanks in advance

Answer the question

In order to leave comments, you need to log in

1 answer(s)
S
StasStasov, 2021-08-05
@StasStasov

Problem solved
Added cookie to HAProxy config (/etc/haproxy/haproxy.cfg)
server1 172.17.70.58 cookie SA
server2 172.17.70.58 cookie SB
may be useful to someone in the future

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question