HAProxy 302 eya kuhlelo lokusebenza langasese: ubani uvula igxathu lesibili?

Othile uqondisa isikhungo somphakathi se-HAProxy ohlelweni lwangaphakathi futhi ubuza ukuthi kungani isiphequluli singakwazi ukulandela. I-proxy ifinyelela uhlelo nge-VPN yayo, ukuqondisa kabusha kubuyisela isihloko se-Location, futhi isiphequluli sizama ikheli elikhona ngaphakathi komhubhe kuphela. Ngaphandle, ikhasi limane lixhuge. Isinqumo simayelana nokuthi yiluphi uhlangothi oluvula ukuxhumana kwesibili, futhi yilokho okuhlukanisa ukuqondisa kabusha kwi-backend.

Izindlela ezimbili ezibukeka zifana ekulungisweni

Ukuqondisa kabusha kuphelisa ukushintshana ngempendulo. Iklayenti lifunda i-Location futhi liqala isicelo esisha lapho likhona, okuyinxanxela ongakaze uyilawule. I-proxy ayisaba yingxenye. Konke okulandelayo kuncike kwi-DNS yeklayenti uqobo, indlela nokwethemba, ngakho umphumela uyahluka kuye ngokuthi umsebenzisi uvule kuphi isiphequluli:

GET /app        client -> proxy
302 Location    proxy  -> client   (http://10.40.0.20:8080/)
GET /app        client -> 10.40.0.20:8080   client network, no route

I-backend ye-proxy igcina umlenze wesibili ohlangothini lweseva. I-proxy iwuvula ngendlela esenayo, futhi iklayenti liqhubeka likhuluma negama elilodwa lomphakathi. Uma umhubhe uwa, iklayenti lithola iphutha esikhundleni se-URL elingakwazi ukuyilandela. Lowo mehluko futhi yiwona owenza ukwehluleka kutholakale, ngoba iphutha livela lapho kukhona amalogi:

GET /app        client -> proxy
GET /app        proxy  -> 10.40.0.20:8080   over the VPN
response        proxy  -> client

Imibhalo ye-HAProxy yokuqondisa kabusha idweba impela lo mngcele: ukuphendula iklayenti ngokuqondisa kabusha kuyisenzo esihlukile ekudluliseni isicelo ku-backend. Imiyalo emibili isendaweni engamagama ambalwa emugqeni kufayela lokulungisa futhi ayiziphathi ngokufanayo nhlobo. Eyodwa iphelisa isicelo, enye iqala isicelo sesibili esiphethwe i-proxy.

Lokho isiphequluli esikudingayo i-VPN yeseva engakunikezi

Isicelo sesiphequluli uqobo sidinga izinto ezine okungenzeka singenazo: impendulo ye-DNS yegama langasese, indlela eya kulelo kheli, imvume yokufinyelela insizakalo elalelayo, nokwethemba noma yisiphi isitifiketi insizakalo leyo esiyethulayo. Isikhungo se-proxy sinezo zozine ngenxa yomhubhe waso. Akukho nokukodwa okudluliselwa kuklayenti elingakaze libe kulowo mhubhe, ngoba umhubhe uyisici sesikhungo, hhayi se-URL.

Leso sikhala sichaza uphawu «cishe siyasebenza». Isicelo sokuqala siyaphumelela, ibha yekheli iyashintsha, bese ukuxhumana kuxhuga noma kwehluleka kuyilapho i-proxy iphilile ngaso sonke isikhathi. Akukho okonakele ekulungisweni kwe-proxy, futhi ukukulungisa akukwazi ukusiza iklayenti elingenayo indlela eya kulelo 10.40.0.20. Kusuke iklayenti lithole indlela, noma i-proxy kumele yenze ukuxhumana esikhundleni sayo.

Lapho i-proxy kuphela engafinyelela uhlelo

Susa isenzo sokuqondisa kabusha bese uthumela lezo zicelo ku-backend ekhomba ikheli langasese. I-frontend igcina igama layo lomphakathi kuyilapho i-backend inquma ukuthi isicelo siya kuphi ngempela. Akukho okushintshayo endleleni yeklayenti, ngoba i-proxy iyeka ukuchaza indawo bese yona uqobo iba yindawo. Ohlelweni olulalela ngamabomu embobeni wangaphakathi 8080, ibhloko leseva lifushane:

backend private_app
    mode http
    option httpchk GET /health
    server app1 10.40.0.20:8080 check

Funda lelo bhloko njengesitatimende mayelana nethebula yezindlela ye-proxy: ikheli 10.40.0.20 kumele lifinyeleleke kusukela kusikhungo se-proxy uqobo, lokhu okusho ukuthi ngokusebenzisa isixhumanisi se-VPN hhayi indlela ezenzakalelayo. Igama elingukhiye check libika kuphela lokho okwenzayo leyondlela, futhi indlela yokuhlola impilo kumele ibe khona ohlelweni, ngaphandle kwalokho ukuhlola ngakunye kumaka iseva njengephansi. Ukuhlola okuphumelelayo akufakazi lutho mayelana neklayenti futhi akuthathi indawo yenqubomgomo enquma ukuthi ubani angasebenzisa i-backend.

Lesi siqeshana akusona i-frontend ephelele. Gcina isilaleli, ukuqinisekisa, ukukhethwa kwesikhungo nendlela okuvunyelwe, kanye nomthetho onquma ukuthi ubani angafinyelela uhlelo nhlobo. Fanisa neprotocol ye-backend futhi, ngoba i-backend ye-HTTPS idinga ukuqinisekiswa kwesitifiketi nokulungiswa kobunikazi baseseva, futhi ukweqa lokho kuhlola kuguqula ukuxhumana langasese kube okungaqinisekisiwe.

Qinisekisa indlela yokubuya kuzinhlangothi zombili ngaphambi kokumemezela ukunqoba. Uhlelo manje lubona ukuxhumana okuvela ku-proxy, ngakho amalogi alo nanoma iyiphi imethadatha yekheli leklayenti ichaza i-proxy ngaphandle uma uhlela ngenye indlela. Nquma ukuthi ubunikazi namakheli adlulisiwe aphathwa kanjani, futhi uhlole leso sinqumo esikhundleni sokusicabangela.

Ukuqondisa kabusha kohlelo uqobo kusakhomba ngaphakathi

Ukudlulisa isicelo sokuqala kuyingxenye eyodwa kuphela yokuhlanganisa. Uhlelo lungakhipha ukuqondisa kabusha okuphelele, ama-URL ezinsiza abhalwe ngokuqinile, noma amakhukhi abekelwe umkhawulo egameni elilazi ngaphakathi, futhi ngakunye kwalokho kubuyisela isiphequluli ekhelini elingakwazi ukulifinyelela. Isihloko se-Location esikhomba egameni langaphakathi sibukeka sifana ncamashi nenkinga yokuqala, yingakho kutholwa ngokungalungile njengokwehluleka kwe-proxy.

Setha i-URL yangaphandle ebhalwe phansi yohlelo nezinketho zayo ze-proxy, bese wenza isihloko se-Host sivumelane nesikhungo esibonakalayo nokulindelwe kwesitifiketi. Ikhukhi elibekelwe umkhawulo egameni langaphakathi ngeke libuye ngokusebenzisa igama lomphakathi, futhi umjikelezo wokungena olandelayo ufundwa njengephutha lokuqinisekisa. Shintsha kuqala i-URL yangaphandle, hlola futhi kusukela kuphrofayela yesiphequluli ehlanzekile, futhi ulindele ukuthi izilungiselelo ezidluliswe ingxenye zizoveza ukungena okuphumelelayo kanye nesikhathi esifa ngokushesha.

Themba imethadatha edlulisiwe kuphela evela ku-proxy eqokiwe. Isihloko esingasethwa yinoma yiliphi iklayenti akumele neze sibe yinani lokugunyaza, ngaphandle kwalokho i-proxy iphenduka indlela yokuthi umfoni afune ubunikazi bomunye umuntu. Lowo mthetho awuncikile embuzweni wokuqondisa kabusha futhi uhlala kukho konke ukwakhiwa kabusha kwakamuva.

Nquma ukuthi yiluphi uhlobo lomklamo onalo ngempela

Uma bonke abasebenzisi sebenokufinyelela kwe-VPN okugunyaziwe, ukuqondisa kabusha ku-URL yasese kungaba umklamo wamabomu. Qinisekisa leyo mfuneko ngokusobala esikhundleni sokuyicabangela, ngoba imiklamo emibili isebenzela imiphakathi ehluke ngokuphelele. Omunye wayo awusebenzi nhlobo kunethiwekhi yasehhotela, kanti omunye ubeka uhlelo obala kunoma ubani ongakwazi ukulayisha i-URL yomphakathi. Lowo mehluko kufanele ube kusiphawuli somklamo.

Gijimisa ukuhlola kusukela kumshini osenethiwekhi yabasebenzisi futhi ulandele zonke izigxathu ezenziwa isiphequluli, hhayi impendulo yokuqala kuphela. Bheka ibha yekheli naso sonke isicelo esilandelayo, ngoba i-URL eyodwa ephelele kuthagi yensiza yanele ukuphula ukuhamba okwedlulwa yigxathu lokuqala. Ukungena kumele kusebenze ngokusebenzisa igama lomphakathi, futhi izinsiza okufanele zenqatshwe kumele zihlale zenqatshiwe.

Ukushicilela i-reverse proxy kuyisinqumo esihlukile sokufinyelela, hhayi ukwandiswa okusobala kwe-VPN ye-proxy uqobo kunoma ubani ongakwazi ukulayisha i-URL yayo yomphakathi. Zombili zibukeka zifana kumdwebo, futhi ziyahluka ngokuthi ubani ovunyelwe ukungena. Ukunquma lowo mbuzo ngemva kokusetshenziswa yindlela uhlelo lwangaphakathi oluba ngolomphakathi ngengozi.

Bhala phansi ukuthi wakhe yiphi futhi kungani. Umuntu olandelayo ozothinta ukulungiswa uzocabanga enye. Ukuqondisa kabusha okukodwa okwengezwe ukuze kube lula kwanele ukuphinda kudale ukwehluleka kokuqala, futhi uphawu luzobukeka lufana ncamashi nalolo osanda kulungisa.