HAProxy

RemoteViz and HAProxy

RemoteViz and HAProxy

Summary

RemoteViz uses WebSocket protocol to make possible the communication between the client and the service. In production environments, the network traffic can be routed through a reverse proxy to guarantee security so that no information about your backend servers be visible outside your internal network. This document explains how to configure HAProxy as reverse proxy to route WebSocket requests to the RemoteViz service and web page requests to the web server over the same port and domain.

Compatibility

HAProxy supports Websocket proxing from the version 1.4.

HAProxy Installation

Please refer to the HAProxy official documentation to install HAProxy:

For Unix systems: http://www.haproxy.org/#down

HAProxy Configuration

In the next section, we consider that the front-end is bound to yourdomain:80 (public), the web server (Apache, NGinx, IIS, ...) is bound to 10.0.0.1:8000 (behind a firewall) and the RemoteViz service is bound to 10.0.0.2:8080 (behind a firewall). There are three ways to proxy WebSocket connections through HAProxy.

Proxy based on sub-domain

In this case, the websocket connection is differentiated from other requests by using a sub-domain. In the below example, all traffic going to remoteviz.yourdomain will be redirected to the RemoteViz service.

  frontend public
   bind *:80
   acl is_websocket hdr_end(host) -i remoteviz.yourdomain
   use_backend ws if is_websocket
   default_backend www

  backend www
   timeout server 30s
   server www1 10.0.0.1:8000

  backend ws
   timeout server 600s
   server ws1 10.0.0.2:8080

The websocket connection address has to be modified in the HTML client file. In the file index.html, replace the line:

   theRenderArea.connectTo("ws://127.0.0.1:8080/RenderAreaName");

by the line:

   theRenderArea.connectTo("ws://remoteviz.yourdomain/RenderAreaName");

Proxy based on URI

An alternative to the above setup is to proxy based on the URI. In the below example, all traffic going to yourdomain/remoteviz will be redirected to the RemoteViz service.

  frontend public
   bind *:80
   acl is_example hdr_end(host) -i yourdomain
   acl is_websocket path_beg -i /remoteviz
   use_backend ws if is_websocket is_example
   default_backend www

  backend www
   timeout server 30s
   server www1 10.0.0.1:8000

  backend ws
   timeout server 600s
   server ws1 10.0.0.2:8080

The websocket connection address has to be modified in the HTML client file. In the file index.html, replace the line:

   theRenderArea.connectTo("ws://127.0.0.1:8080/RenderAreaName");

by the line:

   theRenderArea.connectTo("ws://yourdomain/remoteviz/RenderAreaName");

Proxy using websocket detection

The last case uses an automatic detection of the websocket request by examining the HTTP header for the Upgrade: WebSocket line. All websocket traffic will be redirected to the RemoteViz service.

  frontend public
   bind *:80
   acl is_websocket hdr(Upgrade) -i WebSocket
   use_backend ws if is_websocket is_websocket_server
   default_backend www

  backend www
   timeout server 30s
   server www1 10.0.0.1:8000

  backend ws
   timeout server 600s
   server ws1 10.0.0.2:8080

The websocket connection address has to be modified in the HTML client file. In the file index.html, replace the line:

   theRenderArea.connectTo("ws://127.0.0.1:8080/RenderAreaName");

by the line:

   theRenderArea.connectTo("ws://yourdomain/RenderAreaName");