Score:0

503 Service Unavailable when Load Balancer is active

in flag

We have two cloud servers from Hetzner. The web server is Nginx. Both servers are identical (hardware, software and our web application).

LetsEncrypt certificate is installed on both servers. Nginx is configured to redirect http to https.

The DNS server is Cloudflare. We switch the IP address of our domain's A record manually from Server A to Server B or vice versa.

Now we have created a Load Balancer in Hetzer with our two servers and one service: https 443 -> 443.

As soon as we change the IP address of the A record of our domain to the IP address of LB, we receive 503 service unavailable.

Please assist.

in flag
Read log files on your webs server and your load balancer.
Saïmonn avatar
in flag
If you're using Hetzner's managed load-balancer, there should be somewhere in their web interface some way to get logs and/or status of backend connections (to server A and B). ALso, usually the load-balancer make the SSL termination, thus you may need to configurer let'sencrypt certificate there. https://community.hetzner.com/tutorials/configure-lb-cert-with-external-domain
Omid Shojaee avatar
in flag
@Saïmonn Thanks. Apparently there's no log, and the certificate is already configured. I think we should not have the SSL certificates installed on the server and we should let LB to handle that otherwise I don't understand why LB needs the CA and KEY of my certificate.
Saïmonn avatar
in flag
@OmidShojaee in that case, your load-balancer should be configured to use serverA and serverB as http backend on port 80, not 443.
Omid Shojaee avatar
in flag
@Saïmonn So LB for http 80 -> 80 and Nginx handles 80 -> 443 right?
Score:0
in flag

If you want to use a load-balancer for SSL termination, your nginx should not listen on tcp port 443 nor have a certificate. nginx should only listen on port 80, and the load-balancer shoud:

To manage the http to https redirection, if the load-balancers are able to do it, that's the best option. If not, then on nginx side you will have to detect if the client connects with https or http (sometimes the load-balancer can set a header with this information), and redirect if it's cleartext http.

Omid Shojaee avatar
in flag
Thank you. This is the type of answer I was looking for.
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.