Hi everyone, A while ago we added support to Wildfly to allow it to be used as a front end mod_cluster based load balancer. I am going to blog about this once it appears in a released version, but for now if anyone wants to try it out I have an example in my github at https://github.com/stuartwdouglas/modcluster-example The example basically contains the CLI commands need to start a domain with two backend servers and a front end load balancer (with a simple deployment that prints the server name that handles the request, and can start counting requests to demonstrate sticky sessions and failover), although the deployment path and local IP address will need to be modified appropriately. I'm just posting about this here in case it is interesting to anyone, as it should provide a very simple way to get started with clustering. Stuart _______________________________________________ wildfly-dev mailing list wildfly-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/wildfly-dev

Yes, if you use this then it is no longer necessary to use apache as a load balancer.

Being able to use ByteMan to investigate what's happening in the load balancer rather than re-compiling a C module to add extra logging will be nice :)

Stuart, what version of wildfly can be used for test the cluster? I tried in 9.0.0.Alpha2-SNAPSHOT but don't find the mod-cluster filter inside the configuration=filter. -- View this message in context: http://wildfly-development.1055759.n5.nabble.com/Using-Wildfly-as-a-load-... Sent from the WildFly Development mailing list archive at Nabble.com. _______________________________________________ wildfly-dev mailing list wildfly-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/wildfly-dev

With something this new you'll probably be wanting to build from source or use a nightly. https://ci.jboss.org/hudson/job/WildFly-latest-master/lastBuild/ On Fri, Jan 16, 2015 at 1:02 PM, Tomaž Cerar <tomaz.cerar(a)gmail.com&gt; wrote: > Take a look at demo Stuart prepared > > http://blog.eisele.net/2015/01/developer-interview-di-11-stuart-douglas-a... > > On Fri, Jan 16, 2015 at 6:30 PM, filipepferraz <filipepferraz(a)gmail.com&gt; > wrote: > >> Stuart, what version of wildfly can be used for test the cluster? >> I tried in 9.0.0.Alpha2-SNAPSHOT but don't find the mod-cluster filter >> inside the configuration=filter. >> >> >> >> -- >> View this message in context: >> http://wildfly-development.1055759.n5.nabble.com/Using-Wildfly-as-a-load-... >> Sent from the WildFly Development mailing list archive at Nabble.com. >> _______________________________________________ >> wildfly-dev mailing list >> wildfly-dev(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/wildfly-dev >> > > > _______________________________________________ > wildfly-dev mailing list > wildfly-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/wildfly-dev > _______________________________________________ wildfly-dev mailing list wildfly-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/wildfly-dev

On Jan 16, 2015, at 4:34 PM, Jorge Solórzano <jorsol(a)gmail.com&gt; wrote: Hi Stuart, How will be handled the bind to low ports? will be needed to run the load-balancer as root or some user with privilege to bind in 80 or 443?

On Jan 16, 2015, at 5:37 PM, denstar <valliantster(a)gmail.com&gt; wrote: On 01/16/2015 04:19 PM, Jason Greene wrote: ... [snip helpful example rules] > > B. Using setcap to grant perms for java to bind lower ports: FWIW, this would open things up for Java in general, so while it should perform better, it'll also be a little more risky, which may or may not be a concern.

On Jan 17, 2015, at 8:27 AM, Jorge Solórzano <jorsol(a)gmail.com&gt; wrote: Is authbind or privbind a good alternative? it probably has the same effect of setcap but with a little more security. It seems the best choice is iptables. Jorge Solórzano http://www.jorsol.com On Fri, Jan 16, 2015 at 9:31 PM, Jason T. Greene <jason.greene(a)redhat.com&gt; wrote: > On Jan 16, 2015, at 5:37 PM, denstar <valliantster(a)gmail.com&gt; wrote: > > On 01/16/2015 04:19 PM, Jason Greene wrote: > ... > [snip helpful example rules] >> >> B. Using setcap to grant perms for java to bind lower ports: > > FWIW, this would open things up for Java in general, so while it should > perform better, it'll also be a little more risky, which may or may not > be a concern. Right all Java code using this JVM would have access to binding *all ports* (e.g a Java program could bind say the ssh port (assuming it's not running) and sniff passwords). So it would be a good idea to have a dedicated JVM just for WildFly and to limit the execution permission to just a dedicated WildFly user. That way you ensure only the wildfly process can bind these ports. Alternatively, you could use something like docker which automates capability assignment and provides some extra isolation. It's overkill though if the only thing running on a box is a wildfly process. Just a note that you will still get fantastic performance with iptables port forwarding since the particular rule is completely stateless, and the action is just to modify the packet in memory. It's only extreme scenarios where that overhead is worth avoiding. -Jason

Right all Java code using this JVM would have access to binding *all ports* (e.g a Java program could bind say the ssh port (assuming it's not running) and sniff passwords). So it would be a good idea to have a dedicated JVM just for WildFly and to limit the execution permission to just a dedicated WildFly user. That way you ensure only the wildfly process can bind these ports.