Load Balancer

All WebApp URL should point to an AWS Elastic Load Balancer (ELB). Currently we only have one ELB which is in Sydney region. ELB in other regions will be added when we expanded overseas.

Sydney Region ELB

AWS Public DNS: WebApps-497531c79456f302.elb.ap-southeast-2.amazonaws.com

SportLogic CNAME: webapps-sydney.sportlogic.net.au

SVN URL for Nginx config: https://fig.sportlogic.net.au:8443/svn/webapps.nginx/sydney-region/conf.d

Targets:

• adelaide 52.62.74.0

CNAME for WebApp URL

E.g. “tennisdemo1.intennis.com.au” runs in Sydney region. It should be a CNAME to “webapps-sydney.sportlogic.net.au”.

ELB Listeners and Targets

Each ELB is a Network Load Balancer. Each is setup to have 2 listeners:

• TCP port 80 forward to a target on port 80
• TCP port 443 forward to a target on port 443

Multiple targets should be created to provide redundancy i.e. avoid single-point-of-failure.

Nginx

A target is an EC2 instance running Nginx server. The NGINX server acts as reverse-proxy. It contains all virtual server config information (in “/home/ec2-user/nginx/conf.d” directory). Each virtual server simply forward requests to the actual WebApp Tomcat host & port.

Config files in conf.d should be checked in to SVN, e.g. for Sydney region the SVN URL is https://fig.sportlogic.net.au:8443/svn/webapps.nginx/sydney-region/conf.d.

This is a sample config file “ata.intennis.com.au.conf”:

server {
     listen       80;
     server_name  ata.intennis.com.au;
     return 301 https://$host$request_uri;
}	
server {
    listen       443 ssl http2;
    server_name  ata.intennis.com.au;

    ssl_certificate     conf.d/ssl/intennis.com.au/STAR_intennis_com_au.chained.crt;
    ssl_certificate_key  conf.d/ssl/intennis.com.au/privatekey.openssl;
    ssl_session_cache shared:SSL:1m;
    ssl_session_timeout 4h;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_protocols TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;

    location / {
        proxy_pass        https://singapore2.sportlogic.net.au:16123;
        proxy_set_header  X-Real-IP $remote_addr;
        proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header  Host $http_host;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

SSL

NGINX is responsible for SSL so certificates must be configured in the NGINX “/etc/nginx/conf.d/ssl” directory.

WebApp Tomcat

WebApp is a Spring Boot Tomcat application that runs on an EC2 instance. WebApp runs on a port which is 10000 plus the dbserver’s remoting port. E.g. for customer “999010” the remoting port is 6351 then the WebApp will run on port 16351 (10000 + 6351).

WebApp runs behind Nginx so there is no need to open port numbers to the public Internet. This is by design so we only have Nginx that is public facing and all WebApps are running internally in a private network. However the ports need to be opened to Nginx server. We can do this by configuring the WebApp EC2 instance’s security group. E.g. say our Nginx server Public IP is 52.62.74.0 and Private IP is 172.16.1.32. We should create a security group as follow and add this security group to the WebApp EC2 instance. Note – if the WebAPP EC2 instance is in the same VPC as the Nginx server then it is important to add the Private IP of the Nginx server to the rule.

For Public IP
Type: Custom TCP Rule
Protocol: TCP
Port Range: 16000 - 16999
Source: 52.62.74.0/32

Type: Custom TCP Rule
Protocol: TCP
Port Range: 40000 - 49999
Source: 52.62.74.0/32

For Private IP

Type: Custom TCP Rule
Protocol: TCP
Port Range: 16000 - 16999
Source: 172.16.1.32/32

Type: Custom TCP Rule
Protocol: TCP
Port Range: 40000 - 49999
Source: 172.16.1.32/32