背景：

情况是这样的，我们要支撑高并发业务，需要多个web服务器来支持，如果一台机器只部署一个tomcat的话，那资源没有办法充分利用，所以我们的办法是在一台物理机部署数十个tomcat，前端使用haproxy做负载均衡，并且网站需要https访问，所以证书需要在haproxy中配置。

部署：

1、haproxy的配置

#---------------------------------------------------------------------
# Example configuration for a possible web application.  See the
# full configuration options online.
#
#   http://haproxy.1wt.eu/download/1.4/doc/configuration.txt
#
#---------------------------------------------------------------------
#---------------------------------------------------------------------
# Global settings
#---------------------------------------------------------------------
global# to have these messages end up in /var/log/haproxy.log you will# need to:## 1) configure syslog to accept network log events.  This is done#    by adding the '-r' option to the SYSLOGD_OPTIONS in#    /etc/sysconfig/syslog## 2) configure local2 events to go to the /var/log/haproxy.log#   file. A line like the following can be added to#   /etc/sysconfig/syslog##    local2.*                       /var/log/haproxy.log#log         127.0.0.1 local2chroot      /var/lib/haproxypidfile     /var/run/haproxy.pidmaxconn     400000user        haproxygroup       haproxydaemontune.ssl.default-dh-param  2048# turn on stats unix socketstats socket /var/lib/haproxy/stats
#---------------------------------------------------------------------
# common defaults that all the 'listen' and 'backend' sections will
# use if not designated in their block
#---------------------------------------------------------------------
defaultsmode                    httplog                     globaloption                  httplogoption                  dontlognulloption http-server-closeoption forwardfor       except 127.0.0.0/8option                  redispatchretries                 3option                  httpclosetimeout http-request    10stimeout queue           1mtimeout connect         10stimeout client          1mtimeout server          1mtimeout http-keep-alive 10stimeout check           10sstats enablestats hide-versionstats uri     /haproxy?statusstats realm   Haproxy\ Statisticsstats auth    admin:admin123
#---------------------------------------------------------------------
# main frontend which proxys to the backends
#---------------------------------------------------------------------
frontend  wzlinux_sslbind *:80bind *:443 ssl crt /etc/haproxy/wzlinux.pemmode httpdefault_backend  wzlinuxs
backend wzlinuxsmode httpbalance     roundrobinoption forwardfor
#    option httpchk HEAD / HTTP/1.1\r\nHost:localhostserver      tomcat01  127.0.0.1:8080 check inter 15000 rise 2 fall 4 weight 1server      tomcat02  127.0.0.1:8081 check inter 15000 rise 2 fall 4 weight 1server      tomcat03  127.0.0.1:8082 check inter 15000 rise 2 fall 4 weight 1server      tomcat04  127.0.0.1:8083 check inter 15000 rise 2 fall 4 weight 1server      tomcat05  127.0.0.1:8084 check inter 15000 rise 2 fall 4 weight 1server      tomcat06  127.0.0.1:8085 check inter 15000 rise 2 fall 4 weight 1server      tomcat07  127.0.0.1:8086 check inter 15000 rise 2 fall 4 weight 1
#    http-request set-header X-Forwarded-Port %[dst_port]
#    http-request add-header X-Forwarded-Proto https if { ssl_fc }

2、tomcat的配置设定

因为tomcat日志需要知道真正的来源IP是什么，所以默认的是不满足要求的，我们需要修改日志格式的内容如下。

<Host name="localhost"  appBase="/home/webapps"unpackWARs="true" autoDeploy="true"><Valve className="org.apache.catalina.valves.AccessLogValve" directory="/var/log/tomcat"prefix="wzlinux." suffix=".txt"pattern="%{X-Forwarded-For}i %l %u %t &quot;%r&quot; %s %b" />
</Host>