{"id":30749766,"url":"https://github.com/ozturkeniss/enterprise-load-balancer","last_synced_at":"2025-09-04T06:46:20.428Z","repository":{"id":311358525,"uuid":"1043464751","full_name":"ozturkeniss/enterprise-load-balancer","owner":"ozturkeniss","description":"This project implements a comprehensive high-availability load balancing system with Web Application Firewall (WAF), SSL/TLS encryption, and advanced monitoring capabilities.","archived":false,"fork":false,"pushed_at":"2025-08-23T23:09:20.000Z","size":29,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-08-24T10:26:58.462Z","etag":null,"topics":["configuration","linux","load-balancer","monitoring","nginx","rate-limiting","ssl","waf"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ozturkeniss.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-08-23T23:06:46.000Z","updated_at":"2025-08-23T23:12:31.000Z","dependencies_parsed_at":"2025-08-24T10:37:35.718Z","dependency_job_id":"36354524-cf7a-47cb-9767-282523f67c8f","html_url":"https://github.com/ozturkeniss/enterprise-load-balancer","commit_stats":null,"previous_names":["ozturkeniss/enterprise-load-balancer"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/ozturkeniss/enterprise-load-balancer","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ozturkeniss%2Fenterprise-load-balancer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ozturkeniss%2Fenterprise-load-balancer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ozturkeniss%2Fenterprise-load-balancer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ozturkeniss%2Fenterprise-load-balancer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ozturkeniss","download_url":"https://codeload.github.com/ozturkeniss/enterprise-load-balancer/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ozturkeniss%2Fenterprise-load-balancer/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":273567607,"owners_count":25128631,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-04T02:00:08.968Z","response_time":61,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["configuration","linux","load-balancer","monitoring","nginx","rate-limiting","ssl","waf"],"created_at":"2025-09-04T06:46:18.972Z","updated_at":"2025-09-04T06:46:20.413Z","avatar_url":"https://github.com/ozturkeniss.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# High Availability Load Balancer with WAF and Monitoring\n\nThis project implements a comprehensive high-availability load balancing system with Web Application Firewall (WAF), SSL/TLS encryption, and advanced monitoring capabilities.\n\n## System Architecture\n\n```mermaid\ngraph TB\n    subgraph \"Internet\"\n        Client[Client Browser]\n        Attacker[Malicious Requests]\n    end\n    \n    subgraph \"Load Balancer Layer\"\n        LB[NGINX Load Balancer\u003cbr/\u003ePort 80/443]\n        SSL[SSL/TLS Termination]\n        WAF[Web Application Firewall\u003cbr/\u003eModSecurity]\n        RL[Rate Limiting\u003cbr/\u003eDDoS Protection]\n    end\n    \n    subgraph \"Backend Servers\"\n        B1[Backend Server 1\u003cbr/\u003ePort 8001]\n        B2[Backend Server 2\u003cbr/\u003ePort 8002]\n        B3[Backend Server 3\u003cbr/\u003ePort 8003]\n    end\n    \n    subgraph \"Monitoring Stack\"\n        Prom[Prometheus\u003cbr/\u003eMetrics Collection]\n        Graf[Grafana\u003cbr/\u003eDashboards]\n        NE[Node Exporter\u003cbr/\u003eSystem Metrics]\n    end\n    \n    subgraph \"Security Features\"\n        FW[Firewall Rules]\n        SSL_Cert[SSL Certificates]\n        Headers[Security Headers]\n    end\n    \n    Client --\u003e LB\n    Attacker --\u003e LB\n    LB --\u003e SSL\n    SSL --\u003e WAF\n    WAF --\u003e RL\n    RL --\u003e B1\n    RL --\u003e B2\n    RL --\u003e B3\n    \n    B1 --\u003e Prom\n    B2 --\u003e Prom\n    B3 --\u003e Prom\n    Prom --\u003e Graf\n    NE --\u003e Prom\n    \n    WAF --\u003e FW\n    SSL --\u003e SSL_Cert\n    RL --\u003e Headers\n    \n    style LB fill:#e1f5fe\n    style WAF fill:#fff3e0\n    style Prom fill:#e8f5e8\n    style Graf fill:#f3e5f5\n```\n\n## Project Structure\n\n```\nnginx-loadbalancer/\n├── configs/                    # Configuration files\n│   ├── nginx.conf             # Main load balancer config\n│   ├── nginx_ssl.conf         # SSL-enabled load balancer\n│   ├── nginx_selfsigned.conf  # Self-signed SSL config\n│   ├── nginx_waf.conf         # WAF configuration\n│   ├── nginx_rate_limit.conf  # Rate limiting config\n│   ├── modsecurity.conf       # ModSecurity WAF rules\n│   ├── backend1.conf          # Backend server 1\n│   ├── backend2.conf          # Backend server 2\n│   ├── backend3.conf          # Backend server 3\n│   ├── prometheus.yml         # Prometheus configuration\n│   ├── prometheus.service     # Prometheus systemd service\n│   └── node_exporter.service  # Node Exporter systemd service\n├── scripts/                    # Monitoring and test scripts\n│   ├── health_check.sh        # Basic health check\n│   ├── ssl_health_check.sh    # SSL health check\n│   ├── waf_test.sh            # WAF testing\n│   ├── rate_limit_test.sh     # Rate limiting test\n│   └── monitoring_dashboard.sh # Comprehensive monitoring\n├── logs/                       # Log files\n├── ssl/                        # SSL certificates\n└── README.md                   # This file\n```\n\n## Installation and Setup\n\n### 1. NGINX Installation\n```bash\nsudo apt update\nsudo apt install nginx\n```\n\n### 2. SSL Certificate Setup\n```bash\n# Install Certbot\nsudo apt install certbot python3-certbot-nginx\n\n# Create self-signed certificate\nsudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 \\\n  -keyout /etc/ssl/private/nginx-selfsigned.key \\\n  -out /etc/ssl/certs/nginx-selfsigned.crt \\\n  -subj \"/C=US/ST=State/L=City/O=LoadBalancer/OU=IT/CN=localhost\"\n```\n\n### 3. WAF (ModSecurity) Installation\n```bash\n# Install ModSecurity WAF module\nsudo apt install libnginx-mod-http-modsecurity -y\n```\n\n### 4. Monitoring System Setup\n```bash\n# Basic monitoring tools\nsudo apt install htop iotop nethogs\n\n# Prometheus installation\nwget https://github.com/prometheus/prometheus/releases/download/v2.48.0/prometheus-2.48.0.linux-amd64.tar.gz\ntar -xzf prometheus-2.48.0.linux-amd64.tar.gz\nsudo mv prometheus-2.48.0.linux-amd64 /opt/prometheus\n\n# Node Exporter installation\nwget https://github.com/prometheus/node_exporter/releases/download/v1.6.1/node_exporter-1.6.1.linux-amd64.tar.gz\ntar -xzf node_exporter-1.6.1.linux-amd64.tar.gz\nsudo mv node_exporter-1.6.1.linux-amd64/node_exporter /usr/local/bin/\n\n# Grafana installation\nwget -q -O - https://packages.grafana.com/gpg.key | sudo apt-key add -\necho \"deb https://packages.grafana.com/oss/deb stable main\" | sudo tee /etc/apt/sources.list.d/grafana.list\nsudo apt update\nsudo apt install grafana\n```\n\n### 5. Configuration File Setup\n```bash\n# Copy configuration files\nsudo cp configs/nginx_waf.conf /etc/nginx/nginx.conf\nsudo cp configs/modsecurity.conf /etc/nginx/\nsudo cp configs/backend*.conf /etc/nginx/sites-available/\nsudo cp configs/prometheus.yml /opt/prometheus/\nsudo cp configs/prometheus.service /etc/systemd/system/\nsudo cp configs/node_exporter.service /etc/systemd/system/\n```\n\n### 6. Service Startup\n```bash\n# Reload systemd\nsudo systemctl daemon-reload\n\n# NGINX\nsudo systemctl reload nginx\n\n# Prometheus\nsudo systemctl start prometheus\nsudo systemctl enable prometheus\n\n# Node Exporter\nsudo systemctl start node_exporter\nsudo systemctl enable node_exporter\n\n# Grafana\nsudo systemctl start grafana-server\nsudo systemctl enable grafana-server\n```\n\n### 7. Backend Server Startup\n```bash\npython3 -m http.server 8001 \u0026\npython3 -m http.server 8002 \u0026\npython3 -m http.server 8003 \u0026\n```\n\n### 8. Testing\n```bash\n# Test WAF\n./scripts/waf_test.sh\n\n# Test rate limiting\n./scripts/rate_limit_test.sh\n\n# Test monitoring dashboard\n./scripts/monitoring_dashboard.sh\n```\n\n## Security Features\n\n### SSL/TLS Security\n- **TLS 1.2 and 1.3** support\n- **Strong encryption** algorithms\n- **HSTS** (HTTP Strict Transport Security)\n- **HTTP → HTTPS** automatic redirection\n- **Self-signed certificate** (for testing)\n\n### Web Application Firewall (WAF)\n- **ModSecurity** integration\n- **SQL Injection** protection\n- **XSS (Cross-Site Scripting)** protection\n- **Path Traversal** protection\n- **Security headers** implementation\n\n### Rate Limiting\n- **Multiple zones** for different endpoints\n- **DDoS protection** with connection limiting\n- **Configurable thresholds** per endpoint\n- **Custom error pages** for blocked requests\n\n### Security Headers\n```nginx\nadd_header X-Frame-Options \"SAMEORIGIN\" always;\nadd_header X-Content-Type-Options \"nosniff\" always;\nadd_header X-XSS-Protection \"1; mode=block\" always;\nadd_header Strict-Transport-Security \"max-age=31536000; includeSubDomains\" always;\nadd_header Content-Security-Policy \"default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';\" always;\n```\n\n## Monitoring System\n\n### Monitoring Tools\n- **Prometheus**: Metric collection and storage\n- **Grafana**: Visual dashboards\n- **Node Exporter**: System metrics\n- **htop/iotop/nethogs**: Real-time system monitoring\n\n### Collected Metrics\n- CPU usage\n- RAM usage\n- Disk usage\n- Network traffic\n- SSL certificate status\n- Load balancer performance\n- Backend server statuses\n\n### Monitoring Dashboard\n```bash\n./scripts/monitoring_dashboard.sh\n```\n\n## Rate Limiting Configuration\n\n### Rate Limiting Zones\n- **Main page**: 10 requests/second (burst: 20)\n- **Login**: 1 request/second (burst: 3) - Brute force protection\n- **API**: 20 requests/second (burst: 30)\n- **Admin**: 5 requests/second (burst: 5)\n\n### Connection Limiting\n- Maximum concurrent connections per IP\n- Configurable thresholds per endpoint\n\n## How It Works\n\n1. **Load Balancer (Port 80)**: Redirects HTTP requests to HTTPS\n2. **HTTPS Load Balancer (Port 443)**: SSL-enabled load balancing\n3. **WAF Layer**: ModSecurity filters malicious requests\n4. **Rate Limiting**: DDoS protection and request throttling\n5. **Backend Servers**: Run on ports 8001, 8002, 8003\n6. **Monitoring**: Continuous monitoring with Prometheus + Grafana\n7. **Health Check**: Monitors each backend server status\n8. **Failover**: Continues service if one server fails\n\n## Testing\n\n### HTTP Test\n```bash\ncurl -I http://localhost:80\n# 301 Moved Permanently → HTTPS redirection\n```\n\n### HTTPS Test\n```bash\ncurl -k https://localhost:443\n# -k: Ignore self-signed certificate warning\n```\n\n### WAF Test\n```bash\n./scripts/waf_test.sh\n```\n\n### Rate Limiting Test\n```bash\n./scripts/rate_limit_test.sh\n```\n\n### Monitoring Test\n```bash\n# Prometheus\ncurl http://localhost:9090\n\n# Node Exporter\ncurl http://localhost:9100/metrics\n\n# Grafana\ncurl http://localhost:3000\n```\n\n## Web Interfaces\n\n- **Prometheus**: http://localhost:9090\n- **Grafana**: http://localhost:3000 (admin/admin)\n- **WAF Status**: https://localhost:443/waf-status\n- **Rate Limit Status**: https://localhost:443/rate-limit-status\n\n## Performance Metrics\n\nThe monitoring system collects:\n- **System Performance**: CPU, RAM, Disk, Network\n- **Load Balancer Performance**: Response time, throughput\n- **Security Metrics**: SSL handshake, failed requests, WAF blocks\n- **Backend Health**: Health check, availability\n- **Rate Limiting**: Blocked requests, DDoS attempts\n\n## Next Steps\n\n- **Real domain** with Let's Encrypt certificate\n- **Alerting system** (Prometheus Alertmanager)\n- **Log analysis** (ELK Stack)\n- **Advanced load balancing** algorithms\n- **IP whitelist/blacklist** functionality\n- **Custom WAF rules** development\n- **Backup and disaster recovery** plans\n- **Performance optimization** and tuning\n\n## Troubleshooting\n\n### Common Issues\n1. **502 Bad Gateway**: Backend servers not running\n2. **SSL errors**: Certificate path issues\n3. **WAF blocks**: Legitimate requests being blocked\n4. **Rate limiting**: Too many requests from single IP\n\n### Log Files\n- NGINX: `/var/log/nginx/`\n- ModSecurity: `/var/log/nginx/modsec_audit.log`\n- Prometheus: `/opt/prometheus/`\n- System: `/var/log/syslog`\n\n## Contributing\n\nThis project demonstrates enterprise-grade load balancing, security, and monitoring. Feel free to extend it with additional features or optimizations.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fozturkeniss%2Fenterprise-load-balancer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fozturkeniss%2Fenterprise-load-balancer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fozturkeniss%2Fenterprise-load-balancer/lists"}