Configure Lighttpd 1.4 load balancing with multiple backend servers for high availability

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Default values
BACKEND1_IP=""
BACKEND2_IP=""
BACKEND3_IP=""
DOMAIN="localhost"
ENABLE_SSL=false

# Usage message
usage() {
    echo "Usage: $0 -b1 BACKEND1_IP -b2 BACKEND2_IP -b3 BACKEND3_IP [-d DOMAIN] [-s]"
    echo "  -b1: Backend server 1 IP address"
    echo "  -b2: Backend server 2 IP address"  
    echo "  -b3: Backend server 3 IP address"
    echo "  -d:  Domain name (optional, default: localhost)"
    echo "  -s:  Enable SSL termination (optional)"
    exit 1
}

# Parse arguments
while getopts "b1:b2:b3:d:sh" opt; do
    case $opt in
        1) BACKEND1_IP="$OPTARG" ;;
        2) BACKEND2_IP="$OPTARG" ;;
        3) BACKEND3_IP="$OPTARG" ;;
        d) DOMAIN="$OPTARG" ;;
        s) ENABLE_SSL=true ;;
        h) usage ;;
        *) usage ;;
    esac
done

# Validate required arguments
if [[ -z "$BACKEND1_IP" || -z "$BACKEND2_IP" || -z "$BACKEND3_IP" ]]; then
    echo -e "${RED}Error: All three backend IPs are required${NC}"
    usage
fi

# Check if running as root
if [[ $EUID -ne 0 ]]; then
    echo -e "${RED}Error: This script must be run as root${NC}"
    exit 1
fi

# Cleanup function for rollback
cleanup() {
    echo -e "${YELLOW}Cleaning up on failure...${NC}"
    systemctl stop lighttpd 2>/dev/null || true
}
trap cleanup ERR

# Detect distro and set package manager
echo -e "${YELLOW}[1/8] Detecting distribution...${NC}"
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian) 
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            LIGHTTPD_USER="www-data"
            LIGHTTPD_GROUP="www-data"
            ENABLE_MOD_CMD="lighty-enable-mod"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            LIGHTTPD_USER="lighttpd"
            LIGHTTPD_GROUP="lighttpd"
            ENABLE_MOD_CMD=""
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            LIGHTTPD_USER="lighttpd"
            LIGHTTPD_GROUP="lighttpd"
            ENABLE_MOD_CMD=""
            ;;
        *)
            echo -e "${RED}Unsupported distro: $ID${NC}"
            exit 1
            ;;
    esac
    echo -e "${GREEN}Detected: $PRETTY_NAME${NC}"
else
    echo -e "${RED}Error: Cannot detect distribution${NC}"
    exit 1
fi

# Update package manager
echo -e "${YELLOW}[2/8] Updating package manager...${NC}"
if [[ "$PKG_MGR" == "apt" ]]; then
    apt update
else
    $PKG_MGR update -y
fi

# Install Lighttpd
echo -e "${YELLOW}[3/8] Installing Lighttpd...${NC}"
if [[ "$PKG_MGR" == "apt" ]]; then
    $PKG_INSTALL lighttpd lighttpd-mod-deflate
else
    $PKG_INSTALL lighttpd
fi

# Create necessary directories
mkdir -p /var/www/html
mkdir -p /var/cache/lighttpd/uploads
mkdir -p /var/log/lighttpd

# Set proper ownership
chown -R $LIGHTTPD_USER:$LIGHTTPD_GROUP /var/www/html
chown -R $LIGHTTPD_USER:$LIGHTTPD_GROUP /var/cache/lighttpd
chown -R $LIGHTTPD_USER:$LIGHTTPD_GROUP /var/log/lighttpd

# Configure main Lighttpd settings
echo -e "${YELLOW}[4/8] Configuring main Lighttpd settings...${NC}"
cat > /etc/lighttpd/lighttpd.conf << EOF
server.modules = (
    "mod_indexfile",
    "mod_access",
    "mod_alias",
    "mod_redirect",
    "mod_proxy",
    "mod_compress",
    "mod_accesslog"
)

server.document-root = "/var/www/html"
server.upload-dirs = ( "/var/cache/lighttpd/uploads" )
server.errorlog = "/var/log/lighttpd/error.log"
server.pid-file = "/run/lighttpd.pid"
server.username = "$LIGHTTPD_USER"
server.groupname = "$LIGHTTPD_GROUP"
server.port = 80

# Performance optimizations for load balancing
server.max-connections = 2048
server.max-fds = 2048
server.event-handler = "linux-sysepoll"
server.network-backend = "linux-sendfile"

# Index files
index-file.names = ( "index.php", "index.html", "index.htm" )

# URL access controls
url.access-deny = ( "~", ".inc" )

# Include MIME types
include_shell "/usr/share/lighttpd/include-conf-enabled.pl"
EOF

# Configure proxy settings
echo -e "${YELLOW}[5/8] Configuring load balancer settings...${NC}"
if [[ "$PKG_MGR" == "apt" ]]; then
    PROXY_CONF="/etc/lighttpd/conf-available/10-proxy.conf"
    mkdir -p /etc/lighttpd/conf-available
    mkdir -p /etc/lighttpd/conf-enabled
else
    PROXY_CONF="/etc/lighttpd/conf.d/10-proxy.conf"
    mkdir -p /etc/lighttpd/conf.d
fi

cat > "$PROXY_CONF" << EOF
# Backend server pool configuration
proxy.balance = "round-robin"
proxy.server = (
    "" => (
        "backend1" => (
            "host" => "$BACKEND1_IP",
            "port" => 8080,
            "check-local" => "disable"
        ),
        "backend2" => (
            "host" => "$BACKEND2_IP", 
            "port" => 8080,
            "check-local" => "disable"
        ),
        "backend3" => (
            "host" => "$BACKEND3_IP",
            "port" => 8080,
            "check-local" => "disable"
        )
    )
)

# Health check configuration
proxy.header = (
    "upgrade" => "enable",
    "connect" => "enable"
)

# Connection timeout settings
proxy.server-timeout = 30
proxy.connect-timeout = 10
EOF

# Enable proxy module
if [[ "$PKG_MGR" == "apt" ]]; then
    ln -sf /etc/lighttpd/conf-available/10-proxy.conf /etc/lighttpd/conf-enabled/
fi

# Configure SSL if requested
if [[ "$ENABLE_SSL" == true ]]; then
    echo -e "${YELLOW}[6/8] Configuring SSL termination...${NC}"
    mkdir -p /etc/lighttpd/ssl
    chmod 755 /etc/lighttpd/ssl
    
    # Generate self-signed certificate
    openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
        -keyout /etc/lighttpd/ssl/server.key \
        -out /etc/lighttpd/ssl/server.crt \
        -subj "/C=US/ST=State/L=City/O=Organization/CN=$DOMAIN" 2>/dev/null
    
    chmod 644 /etc/lighttpd/ssl/server.crt
    chmod 600 /etc/lighttpd/ssl/server.key
    chown $LIGHTTPD_USER:$LIGHTTPD_GROUP /etc/lighttpd/ssl/server.*
    
    # SSL configuration
    if [[ "$PKG_MGR" == "apt" ]]; then
        SSL_CONF="/etc/lighttpd/conf-available/10-ssl.conf"
    else
        SSL_CONF="/etc/lighttpd/conf.d/10-ssl.conf"
    fi
    
    cat > "$SSL_CONF" << EOF
\$HTTP["scheme"] == "http" {
    url.redirect = (".*" => "https://%0\$0")
}

\$SERVER["socket"] == ":443" {
    ssl.engine = "enable"
    ssl.pemfile = "/etc/lighttpd/ssl/server.crt"
    ssl.privkey = "/etc/lighttpd/ssl/server.key"
    ssl.cipher-list = "ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:!aNULL:!SHA1:!AESCCM"
    ssl.honor-cipher-order = "enable"
    ssl.disable-client-renegotiation = "enable"
    ssl.use-sslv2 = "disable"
    ssl.use-sslv3 = "disable"
}
EOF
    
    if [[ "$PKG_MGR" == "apt" ]]; then
        ln -sf /etc/lighttpd/conf-available/10-ssl.conf /etc/lighttpd/conf-enabled/
    fi
else
    echo -e "${YELLOW}[6/8] Skipping SSL configuration...${NC}"
fi

# Test configuration
echo -e "${YELLOW}[7/8] Testing configuration...${NC}"
lighttpd -t -f /etc/lighttpd/lighttpd.conf

# Start and enable Lighttpd
echo -e "${YELLOW}[8/8] Starting Lighttpd service...${NC}"
systemctl enable lighttpd
systemctl restart lighttpd

# Verification checks
echo -e "${GREEN}Installation completed successfully!${NC}"
echo -e "${GREEN}Backend servers configured:${NC}"
echo -e "  Backend 1: $BACKEND1_IP:8080"
echo -e "  Backend 2: $BACKEND2_IP:8080"
echo -e "  Backend 3: $BACKEND3_IP:8080"
echo -e "${GREEN}Load balancing method: round-robin${NC}"

if [[ "$ENABLE_SSL" == true ]]; then
    echo -e "${GREEN}SSL termination enabled for domain: $DOMAIN${NC}"
    echo -e "${YELLOW}Note: Using self-signed certificate. Replace with valid certificate for production.${NC}"
fi

# Show service status
systemctl status lighttpd --no-pager