Normally TLS for HTTP requests is terminated on built in reverse proxy, but if application needs to be scaled over multiple hosts, this can be changed.
To use external proxy and balance requests between nodes, issue the following commands.
For Authentication Server service (NtkAS):
$ ntk cfg setc nas.external_proxy on $ ntk redis start $ ntk cfg set :nas.redis_url redis://10.0.1.98:6379/cache $ ntk as restart
Replace the ip address 10.0.1.98 with your node address that will be running Redis accelerator. It is recommended to use VRRP service to configure Redis accelerator service high availability. See this tech note.
For SSO service (NtkSSO):
$ ntk cfg setc sso.external_proxy on $ ntk sso restart
Commands need to be executed on every node that will take part in external load balancer backend pool.
Services expect that the real remote IP address will be provided in X-Real-IP HTTP header. This is relevant if you are using different security policies depending on user location in network.
After reconfiguration NtkAS service will be exposed on tcp/5000 on node, service NtkSSO will be on
tcp/7000. These endpoints have to be added to external load balancer pool. Use "ntk net eth0 address" to discover the internal node IP address.
If management port setting is non-default and dual instance mode is active (:nas.dual_instance_mode = on), management interface will also be exposed on tcp/6000, but additional protection should be used to protect this service, if exposing administrative interface publicly. Otherwise you can use built-in proxy service to access management directly on internal node IP address. You can configure VRRP service to use single internal IP address for all nodes. See documentation for more details.
See below for configuration examples of common load balancing solutions.
HAProxy configuration for a NtkAS service
backend notakey-backend mode http balance roundrobin option forwardfor option httpchk http-request set-header X-Forwarded-Port %[dst_port] http-request set-header X-Real-IP %[src_addr] http-request add-header X-Forwarded-Proto https if { ssl_fc } server node01 10.0.1.71:5000 check server node02 10.0.1.72:5000 check server node03 10.0.1.73:5000 check
Nginx configuration for a NtkAS service
http { include conf/mime.types; index index.html index.htm index.php; access_log logs/access.log main; sendfile on; tcp_nopush on; server_names_hash_bucket_size 128; # this seems to be required for some vhosts upstream ntkservers { server 10.0.1.71:5000; server 10.0.1.72:5000; server 10.0.1.73:5000; # Nginx open source monitors backends by analyzing requests # If request times out, backend is marked as unavailable # This may lead to unintended failures during appliance updates } ; Nginx Plus config match server_ok { status 200; } server { listen 443 ssl http2; root /app/public; ssl_certificate /etc/nginx/ssl/ntkchain.pem; ssl_certificate_key /etc/nginx/ssl/ntk.key; ssl_session_timeout 1d; ssl_session_cache shared:MySSL:10m; ssl_session_tickets off; ssl_protocols TLSv1.3; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; ssl_prefer_server_ciphers off; location / { proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-Port $server_port; client_max_body_size 10m; client_body_buffer_size 128k; proxy_connect_timeout 10; proxy_send_timeout 90; proxy_read_timeout 90; proxy_buffers 32 4k; proxy_redirect off; proxy_pass http://ntkservers; # Nginx Plus config health_check interval=10 uri=/api/health match=server_ok; } } }