Load Balancer

# /etc/haproxy/haproxy.cfg - HAProxy 고급 설정

global
    maxconn 50000
    log stdout format raw local0
    stats socket /var/run/haproxy.sock mode 660

defaults
    mode http
    log global
    option httplog
    option dontlognull
    option http-server-close
    option forwardfor
    timeout connect 5s
    timeout client  30s
    timeout server  30s
    retries 3

# 프론트엔드: 클라이언트 요청 수신
frontend http_front
    bind *:80
    bind *:443 ssl crt /etc/ssl/certs/example.pem

    # HTTP → HTTPS 리다이렉트
    redirect scheme https if !{ ssl_fc }

    # ACL 기반 라우팅 (L7)
    acl is_api path_beg /api
    acl is_static path_beg /static /images /css /js
    acl is_websocket hdr(Upgrade) -i websocket

    # ACL에 따른 백엔드 분기
    use_backend api_backend if is_api
    use_backend static_backend if is_static
    use_backend ws_backend if is_websocket
    default_backend web_backend

# 백엔드: 웹 서버 그룹
backend web_backend
    balance roundrobin
    option httpchk GET /health HTTP/1.1\r\nHost:\ localhost

    # Sticky Session (쿠키 기반)
    cookie SERVERID insert indirect nocache

    server web1 10.0.1.10:8080 check cookie web1 weight 100
    server web2 10.0.1.11:8080 check cookie web2 weight 100
    server web3 10.0.1.12:8080 check cookie web3 weight 50 backup

# 백엔드: API 서버 그룹
backend api_backend
    balance leastconn
    option httpchk GET /api/health
    http-check expect status 200

    server api1 10.0.2.10:3000 check inter 3s fall 3 rise 2
    server api2 10.0.2.11:3000 check inter 3s fall 3 rise 2

# 백엔드: 정적 파일 (캐시 서버)
backend static_backend
    balance uri  # URL 해시로 캐시 효율 극대화
    server cache1 10.0.3.10:80 check
    server cache2 10.0.3.11:80 check

# 통계 대시보드
listen stats
    bind *:8404
    stats enable
    stats uri /stats
    stats refresh 10s
    stats admin if TRUE

# AWS Application Load Balancer (ALB) with Terraform

# ALB 생성
resource "aws_lb" "main" {
  name               = "my-app-alb"
  internal           = false
  load_balancer_type = "application"  # "network" for NLB
  security_groups    = [aws_security_group.alb.id]
  subnets            = var.public_subnet_ids

  enable_deletion_protection = true
  enable_http2              = true

  access_logs {
    bucket  = aws_s3_bucket.alb_logs.id
    prefix  = "alb-logs"
    enabled = true
  }

  tags = { Name = "my-app-alb" }
}

# 타겟 그룹 (백엔드 서버 풀)
resource "aws_lb_target_group" "app" {
  name        = "my-app-tg"
  port        = 8080
  protocol    = "HTTP"
  vpc_id      = var.vpc_id
  target_type = "instance"  # "ip" for Fargate

  # Health Check 설정
  health_check {
    enabled             = true
    path                = "/health"
    port                = "traffic-port"
    protocol            = "HTTP"
    healthy_threshold   = 2
    unhealthy_threshold = 3
    timeout             = 5
    interval            = 30
    matcher             = "200-299"
  }

  # Sticky Session (쿠키 기반)
  stickiness {
    type            = "lb_cookie"
    cookie_duration = 86400  # 1일
    enabled         = true
  }

  # 느린 시작 (새 인스턴스 워밍업)
  slow_start = 60
}

# HTTPS 리스너 (L7)
resource "aws_lb_listener" "https" {
  load_balancer_arn = aws_lb.main.arn
  port              = 443
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-2021-06"
  certificate_arn   = var.acm_certificate_arn

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.app.arn
  }
}

# 경로 기반 라우팅 규칙
resource "aws_lb_listener_rule" "api" {
  listener_arn = aws_lb_listener.https.arn
  priority     = 100

  condition {
    path_pattern { values = ["/api/*"] }
  }

  action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.api.arn
  }
}

# HTTP → HTTPS 리다이렉트
resource "aws_lb_listener" "http_redirect" {
  load_balancer_arn = aws_lb.main.arn
  port              = 80
  protocol          = "HTTP"

  default_action {
    type = "redirect"
    redirect {
      port        = "443"
      protocol    = "HTTPS"
      status_code = "HTTP_301"
    }
  }
}

# 출력
output "alb_dns_name" {
  value = aws_lb.main.dns_name
}