Implement Apache load balancing with SSL termination and health checks

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Global variables
DOMAIN=""
BACKEND1=""
BACKEND2=""
PKG_MGR=""
PKG_INSTALL=""
APACHE_SERVICE=""
APACHE_CONF_DIR=""
APACHE_LOG_DIR=""
SITES_DIR=""

# Usage function
usage() {
    echo "Usage: $0 <domain> <backend1_ip:port> <backend2_ip:port>"
    echo "Example: $0 example.com 192.168.1.10:8080 192.168.1.11:8080"
    exit 1
}

# Cleanup function
cleanup() {
    echo -e "${RED}[ERROR] Script failed. Cleaning up...${NC}"
    if [[ -f "${SITES_DIR}/lb-${DOMAIN}.conf" ]]; then
        rm -f "${SITES_DIR}/lb-${DOMAIN}.conf"
    fi
    if [[ "$PKG_MGR" == "apt" ]] && [[ -L "/etc/apache2/sites-enabled/lb-${DOMAIN}.conf" ]]; then
        a2dissite "lb-${DOMAIN}.conf" >/dev/null 2>&1 || true
    fi
}

# Set error trap
trap cleanup ERR

# Check arguments
if [[ $# -ne 3 ]]; then
    usage
fi

DOMAIN="$1"
BACKEND1="$2"
BACKEND2="$3"

# Validate domain format
if [[ ! "$DOMAIN" =~ ^[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]*\.[a-zA-Z]{2,}$ ]]; then
    echo -e "${RED}[ERROR] Invalid domain format${NC}"
    exit 1
fi

# Validate backend format
for backend in "$BACKEND1" "$BACKEND2"; do
    if [[ ! "$backend" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}:[0-9]+$ ]]; then
        echo -e "${RED}[ERROR] Invalid backend format: $backend${NC}"
        exit 1
    fi
done

# Check if running as root
if [[ $EUID -ne 0 ]]; then
    echo -e "${RED}[ERROR] This script must be run as root${NC}"
    exit 1
fi

echo -e "${GREEN}Apache Load Balancer with SSL Termination Setup${NC}"

# Detect distribution
echo "[1/8] Detecting distribution..."
if [[ -f /etc/os-release ]]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian) 
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            APACHE_SERVICE="apache2"
            APACHE_CONF_DIR="/etc/apache2"
            APACHE_LOG_DIR="/var/log/apache2"
            SITES_DIR="/etc/apache2/sites-available"
            ;;
        almalinux|rocky|centos|rhel|ol)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            APACHE_SERVICE="httpd"
            APACHE_CONF_DIR="/etc/httpd"
            APACHE_LOG_DIR="/var/log/httpd"
            SITES_DIR="/etc/httpd/conf.d"
            ;;
        fedora)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            APACHE_SERVICE="httpd"
            APACHE_CONF_DIR="/etc/httpd"
            APACHE_LOG_DIR="/var/log/httpd"
            SITES_DIR="/etc/httpd/conf.d"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            APACHE_SERVICE="httpd"
            APACHE_CONF_DIR="/etc/httpd"
            APACHE_LOG_DIR="/var/log/httpd"
            SITES_DIR="/etc/httpd/conf.d"
            ;;
        *)
            echo -e "${RED}[ERROR] Unsupported distribution: $ID${NC}"
            exit 1
            ;;
    esac
    echo -e "${GREEN}Detected: $PRETTY_NAME${NC}"
else
    echo -e "${RED}[ERROR] Cannot detect distribution${NC}"
    exit 1
fi

# Update system packages
echo "[2/8] Updating system packages..."
if [[ "$PKG_MGR" == "apt" ]]; then
    apt update && apt upgrade -y
else
    $PKG_INSTALL update -y
fi

# Install Apache and required packages
echo "[3/8] Installing Apache and required modules..."
if [[ "$PKG_MGR" == "apt" ]]; then
    $PKG_INSTALL apache2 certbot python3-certbot-apache
    a2enmod proxy
    a2enmod proxy_http
    a2enmod proxy_balancer
    a2enmod lbmethod_byrequests
    a2enmod ssl
    a2enmod headers
    a2enmod proxy_hcheck
    a2enmod rewrite
else
    $PKG_INSTALL httpd mod_ssl certbot python3-certbot-apache
fi

# Enable and start Apache
echo "[4/8] Starting Apache service..."
systemctl enable --now "$APACHE_SERVICE"

# Configure firewall
echo "[5/8] Configuring firewall..."
if command -v firewall-cmd >/dev/null 2>&1; then
    firewall-cmd --permanent --add-service=http
    firewall-cmd --permanent --add-service=https
    firewall-cmd --reload
elif command -v ufw >/dev/null 2>&1; then
    ufw allow 80/tcp
    ufw allow 443/tcp
fi

# Create virtual host configuration
echo "[6/8] Creating virtual host configuration..."
CONF_FILE="${SITES_DIR}/lb-${DOMAIN}.conf"

cat > "$CONF_FILE" << EOF
<VirtualHost *:80>
    ServerName $DOMAIN
    ServerAlias www.$DOMAIN
    
    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
</VirtualHost>

<VirtualHost *:443>
    ServerName $DOMAIN
    ServerAlias www.$DOMAIN
    
    SSLEngine on
    
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    
    ProxyPreserveHost On
    ProxyRequests Off
    
    ProxyHCMethod GET
    ProxyHCUri /health
    ProxyHCInterval 10
    
    ProxyPass /balancer-manager !
    ProxyPass / balancer://mycluster/
    ProxyPassReverse / balancer://mycluster/
    
    <Proxy balancer://mycluster>
        BalancerMember http://$BACKEND1 route=app1 hcmethod=GET hcuri=/health
        BalancerMember http://$BACKEND2 route=app2 hcmethod=GET hcuri=/health
        
        ProxySet lbmethod=byrequests
        ProxySet hcmethod=GET
        ProxySet hcuri=/health
        ProxySet hcinterval=10
        ProxySet retry=5
    </Proxy>
    
    <Location "/balancer-manager">
        SetHandler balancer-manager
        Require ip 127.0.0.1
        Require local
    </Location>
    
    ErrorLog ${APACHE_LOG_DIR}/loadbalancer_error.log
    CustomLog ${APACHE_LOG_DIR}/loadbalancer_access.log combined
</VirtualHost>
EOF

# Set proper permissions
chmod 644 "$CONF_FILE"
chown root:root "$CONF_FILE"

# Enable site (for Debian/Ubuntu)
if [[ "$PKG_MGR" == "apt" ]]; then
    a2ensite "lb-${DOMAIN}.conf"
fi

# Restart Apache to load configuration
echo "[7/8] Restarting Apache..."
systemctl restart "$APACHE_SERVICE"

# Verify configuration
echo "[8/8] Verifying configuration..."
if systemctl is-active --quiet "$APACHE_SERVICE"; then
    echo -e "${GREEN}✓ Apache is running${NC}"
else
    echo -e "${RED}✗ Apache failed to start${NC}"
    exit 1
fi

if "$APACHE_SERVICE" -t 2>/dev/null || httpd -t 2>/dev/null; then
    echo -e "${GREEN}✓ Apache configuration syntax is valid${NC}"
else
    echo -e "${RED}✗ Apache configuration has syntax errors${NC}"
    exit 1
fi

echo -e "${GREEN}Setup completed successfully!${NC}"
echo -e "${YELLOW}Next steps:${NC}"
echo "1. Point your domain DNS to this server's IP address"
echo "2. Run: certbot --apache -d $DOMAIN -d www.$DOMAIN"
echo "3. Access balancer manager at: https://$DOMAIN/balancer-manager"
echo "4. Ensure backend servers respond to /health endpoint"