Answer the question
In order to leave comments, you need to log in
How to fix nextcloud authorization via haproxy?
Good afternoon, Linux masters! :)
So, we have the following scheme on board:
x1 Load Balancer (HAProxy)172.17.70.55
x2 Nextcloud servers 172.17.70.58 and 172.17.70.59
x1 Redis
x1 Minio
x2 Mysql master + Salve
Nextcloud servers work synchronously, individually, it enters each web interface without problems, under the same login, too, LDAP authorization is screwed, but has not yet been
enabled - enter the login password, and obviously false - the page is updated and that's it, then nothing happens
SSL until the
Logs are screwed below
- HAProxy config
global
log /dev/log local0
log /dev/log local1 notice
chroot /var/lib/haproxy
stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
stats timeout 30s
user haproxy
group haproxy
daemon
# Default SSL material locations
ca-base /etc/ssl/certs
crt-base /etc/ssl/private
# Default ciphers to use on SSL-enabled listening sockets.
# For more information, see ciphers(1SSL). This list is from:
# https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
# An alternative list with additional directives can be obtained from
# https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=haproxy
ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS
ssl-default-bind-options no-sslv3
defaults
log global
mode http
option httplog
option dontlognull
timeout connect 5000
timeout client 50000
timeout server 50000
errorfile 400 /etc/haproxy/errors/400.http
errorfile 403 /etc/haproxy/errors/403.http
errorfile 408 /etc/haproxy/errors/408.http
errorfile 500 /etc/haproxy/errors/500.http
errorfile 502 /etc/haproxy/errors/502.http
errorfile 503 /etc/haproxy/errors/503.http
errorfile 504 /etc/haproxy/errors/504.http
frontend Local_Server
bind 172.17.70.55:80
mode http
default_backend My_Web_Servers
backend My_Web_Servers
mode http
balance roundrobin
option forwardfor
# http-request set-header X-Forwarded-Port %[dst_port]
# http-request add-header X-Forwarded-Proto https if { ssl_fc }
# option httpchk HEAD / HTTP/1.1rnHost:localhost
server web1 172.17.70.59:80
server web2 172.17.70.58:80
<?php
$CONFIG = array (
'instanceid' => 'oceetf******',
'passwordsalt' => 't2Zu4RO5cDNtVFzkmucOL572/tKasp',
'secret' => '9Gah9dRITODJgiS53OVY2XjgdALew0RjikvndFFLO3m4SEpH',
'trusted_domains' =>
array (
0 => '172.17.70.58',
1 => '172.17.70.55',
2 => '172.17.70.59',
),
'trusted_proxies' => '172.17.70.55',
'datadirectory' => '/var/www/html/nextcloud/data',
'dbtype' => 'mysql',
'version' => '21.0.0.18',
'overwrite.cli.url' => 'http://172.17.70.55',
'dbname' => 'nextcloud',
'dbhost' => '172.17.70.53',
'dbport' => '3306',
'dbtableprefix' => 'oc_',
'dbuser' => '*******',
'dbpassword' => '*********',
'installed' => true,
'memcache.local' => '\\OC\\Memcache\\APCu',
'memcache.distributed' => '\\OC\\Memcache\\Redis',
'redis' =>
array (
'host' => '172.17.70.57',
'port' => 6379,
),
'memcache.locking' => '\\OC\\Memcache\\Redis',
'theme' => '',
'loglevel' => 2,
'maintenance' => false,
'updater.release.channel' => 'stable',
'ldapProviderFactory' => 'OCA\\User_LDAP\\LDAPProviderFactory',
'overwritecondaddr' => '^172\.17\.70\.55',
);
Answer the question
In order to leave comments, you need to log in
Problem solved
Added cookie to HAProxy config (/etc/haproxy/haproxy.cfg)
server1 172.17.70.58 cookie SA
server2 172.17.70.58 cookie SB
may be useful to someone in the future
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question