Load Balancers

// Layer 4 (TCP/UDP) — AWS Network Load Balancer (NLB)
// Routes based on: destination IP + port + protocol
// Does NOT read HTTP headers, paths, or cookies
// Use cases: non-HTTP protocols (gRPC, WebSocket raw, gaming, IoT),
//            ultra-low latency, millions of concurrent connections
// Connection: client ↔ NLB ↔ backend (TCP passthrough)

// Layer 7 (HTTP/HTTPS) — AWS Application Load Balancer (ALB)
// Reads: URL path, Host header, HTTP method, cookies, query params
// Use cases: microservices routing, A/B testing, auth offload, WebSocket
// Routing rules example:

// Nginx L7 load balancer config:
upstream api_servers {
  least_conn;                     // least-connections algorithm
  server 10.0.1.1:8080 weight=3; // gets 3x more traffic
  server 10.0.1.2:8080 weight=1;
  server 10.0.1.3:8080 backup;   // only used if others are down
}

server {
  listen 443 ssl;
  location /api/     { proxy_pass http://api_servers; }
  location /static/  { proxy_pass http://cdn_servers; }  // content-aware routing
}

// Round Robin — requests distributed sequentially
// Req 1 → Server A, Req 2 → Server B, Req 3 → Server C, Req 4 → Server A...
// Good for: homogeneous requests, stateless apps

// Least Connections — new request goes to server with fewest active connections
// Good for: long-lived connections (WebSocket, file uploads), variable request durations
upstream backend { least_conn; server 10.0.1.1:8080; server 10.0.1.2:8080; }

// IP Hash — hash(client_IP) % n_servers → same server every time
// Good for: session affinity without shared session store
upstream backend { ip_hash; server 10.0.1.1:8080; server 10.0.1.2:8080; }

// Weighted Round Robin — blue/green or canary deployments
upstream backend {
  server 10.0.1.1:8080 weight=95;  // v1 — 95% of traffic
  server 10.0.1.2:8080 weight=5;   // v2 — 5% canary
}

// Random with Two Choices (Power of Two) — pick 2 random servers,
// route to the one with fewer connections. Scales better than least-conn
// (avoids "thundering herd" on the globally least-loaded server)

// Nginx active health check (nginx-plus / openresty):
upstream api_servers {
  server 10.0.1.1:8080;
  server 10.0.1.2:8080;
  check interval=3000 rise=2 fall=3 timeout=1000 type=http;
  check_http_send "GET /health HTTP/1.0\r\n\r\n";
  check_http_expect_alive http_2xx http_3xx;
}
// rise=2: mark healthy after 2 consecutive successes
// fall=3: mark unhealthy after 3 consecutive failures

// AWS ALB health check (Terraform):
resource "aws_lb_target_group" "api" {
  health_check {
    path                = "/actuator/health"
    interval            = 30           // check every 30s
    healthy_threshold   = 2
    unhealthy_threshold = 3
    timeout             = 5
    matcher             = "200"
  }
  deregistration_delay = 30           // 30s connection draining
}

// Spring Boot health endpoint:
// GET /actuator/health → { "status": "UP" }

// SSL Termination at load balancer:
// Client ──HTTPS──▶ [Load Balancer: decrypt TLS] ──HTTP──▶ Backend
// Benefits: offloads crypto from backends, centralise certificate management
// Nginx SSL termination:
server {
  listen 443 ssl;
  ssl_certificate     /etc/ssl/aicancode.org.crt;
  ssl_certificate_key /etc/ssl/aicancode.org.key;
  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
  location / { proxy_pass http://api_servers; }
}

// Sticky Sessions (session affinity) — AWS ALB:
resource "aws_lb_target_group" "api" {
  stickiness {
    type            = "lb_cookie"
    cookie_duration = 86400    // 1 day
    enabled         = true
  }
}
// ALB sets AWSALB cookie on first response
// Subsequent requests with same cookie → same backend

// Better alternative: externalise session state
// Store session in Redis → any backend can serve any request (stateless)