Setting up the ELB

Process

AWS makes it easy to set up an SSL certificate to an ELB so that secure connections are possible. This guide will not cover how to request the certificate.

First, you will need to point your domain name to the ELB that you created. When you create the ELB, make it a classic load balancer. Use Route 53 to set the domain name to point to the DNS name of your ELB using type CNAME. Next, add instances to the ELB that it should load balance to, which should be the machines that are running HAProxy and the Manticore web app.

Manticore will not configure the security group for you, only the listeners ports. Therefore, you should add a security group to the ELB to how you see fit. At a minimum, port 443 should be open for HTTPS connections, and whatever port the environment variable ELB_SSL_PORT is should be open as well. The classic load balancer cannot have websockets running using the HTTPS listener so this is why the ports for HTTPS and SSL need to be different. Additionally, a range of TCP ports should be opened for TCP connections for connections from the user's phone to sdl_core. These port ranges are defined by the environment variables TCP_PORT_RANGE_START and TCP_PORT_RANGE_END that are passed in to the Manticore web app. Allow all traffic to come through these ports, since this is the internet-facing load balancer.

One last warning is that the number of listeners that can exist on one balancer is limited to 100. This means that the maximum number of cores and HMIs that can exist at once is 98. While this number should be more than reasonable for most situations, it's important to know not to extend your cluster of instances past the point where 98 cores and HMIs can be created. However, you could contact AWS support to increase this number for your situation.

The next article has some stats about the resources consumed