[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6F8EMAPVZAVXP2G5C6FYPAX":3,"skill-same:01M6F8EMAPVZAVXP2G5C6FYPAX":76},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":42,"linkOnly":43,"markdownContent":44,"markdownBody":45,"frontMatter":46,"refName":32,"commitSha":56,"skillDirectory":57,"forksCount":58,"repositoryHtmlUrl":59,"repositoryHomepageUrl":6,"ownerHtmlUrl":60,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":61,"install":62,"resources":75},"01M6F8EMAPVZAVXP2G5C6FYPAX","load-balancing",null,"Configure load balancers and traffic distribution. Implement health checks and SSL termination. Use when distributing traffic across servers.","boisenoise\u002Fskills-collections","boisenoise","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F193180?v=4","01M6CDBDQK6BDN55ZMA6B6PKBM","01M6CDBDVSJ3JPTBYN26FZ7TZK",13,"MIT","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-load-balancing\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41],"load","load balancing","2026","security","when","traffic","relevant","helper","scripts","critical","os","distribution","platform","across","main","community","agent-skills","only","use","configure","access","devops-security","ssl","license","2026-11-10 10:12:30",false,"---\nname: load-balancing\ndescription: Configure load balancers and traffic distribution. Implement health checks\n  and SSL termination. Use when distributing traffic across servers.\ncategory: devops\nrisk: critical\nsource: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\nsource_repo: BagelHole\u002FDevOps-Security-Agent-Skills\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Requires the relevant OS\u002Fplatform tooling and privileged access where\n  noted. Docs-only; helper scripts and templates not bundled.\nmetadata:\n  author: devops-skills\n  version: '1.0'\n---\n\n# Load Balancing\n\nDistribute traffic across application servers for high availability, scalability, and fault tolerance.\n\n## When to Use\n\n- Distributing HTTP\u002FHTTPS traffic across multiple backend servers.\n- Implementing health checks to route around unhealthy instances.\n- Terminating TLS at the load balancer for simplified certificate management.\n- Enabling blue\u002Fgreen or canary deployments with traffic shifting.\n- Scaling horizontally behind a single entry point.\n\nConfirm the exact hosts\u002Faccount, exposure, maintenance window and rollback before changes. The examples are alternatives with placeholders, not a complete production deployment. Keep stats\u002Fadmin endpoints private and restrict socket access. `\u002Fhealth` returning a local static 200 proves only proxy liveness, not backend readiness. Trust forwarded headers only from known proxies and validate client-address handling. Plain HTTP backend hops require an explicit private-network trust model or authenticated TLS.\n\n## Prerequisites\n\n- Two or more backend servers running the same application.\n- TLS certificate for HTTPS termination (ACM, Let's Encrypt, or self-signed for internal).\n- For AWS: VPC with public and private subnets across availability zones.\n- For nginx\u002FHAProxy: Linux server with root access.\n\n## nginx Load Balancer\n\n### Basic Round-Robin\n\n```nginx\n# \u002Fetc\u002Fnginx\u002Fconf.d\u002Floadbalancer.conf\nupstream app_backend {\n    server 10.0.1.10:8080;\n    server 10.0.1.11:8080;\n    server 10.0.1.12:8080;\n}\n\nserver {\n    listen 80;\n    server_name app.example.com;\n    return 301 https:\u002F\u002F$host$request_uri;\n}\n\nserver {\n    listen 443 ssl http2;\n    server_name app.example.com;\n\n    ssl_certificate     \u002Fetc\u002Fssl\u002Fcerts\u002Fapp.example.com.pem;\n    ssl_certificate_key \u002Fetc\u002Fssl\u002Fprivate\u002Fapp.example.com-key.pem;\n    ssl_protocols       TLSv1.2 TLSv1.3;\n    ssl_ciphers         HIGH:!aNULL:!MD5;\n\n    location \u002F {\n        proxy_pass http:\u002F\u002Fapp_backend;\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n        proxy_set_header X-Forwarded-Proto $scheme;\n\n        proxy_connect_timeout 5s;\n        proxy_read_timeout 30s;\n        proxy_send_timeout 30s;\n    }\n\n    location \u002Fhealth {\n        access_log off;\n        return 200 \"OK\";\n    }\n}\n```\n\n### Weighted and Backup Servers\n\n```nginx\nupstream app_backend {\n    least_conn;  # Route to server with fewest active connections\n\n    server 10.0.1.10:8080 weight=5;      # Gets 5x traffic\n    server 10.0.1.11:8080 weight=3;      # Gets 3x traffic\n    server 10.0.1.12:8080 weight=1;      # Gets 1x traffic\n    server 10.0.1.20:8080 backup;        # Only used when others are down\n    server 10.0.1.21:8080 down;          # Temporarily removed from pool\n}\n```\n\n### Health Checks (nginx Plus \u002F OpenResty)\n\n```nginx\nupstream app_backend {\n    zone backend 64k;  # Shared memory zone for health data\n\n    server 10.0.1.10:8080;\n    server 10.0.1.11:8080;\n    server 10.0.1.12:8080;\n}\n\n# Health check (requires nginx Plus or third-party module)\n# match healthy {\n#     status 200;\n#     body ~ \"OK\";\n# }\n# health_check interval=5s fails=3 passes=2 match=healthy;\n```\n\n### Sticky Sessions (IP Hash)\n\n```nginx\nupstream app_backend {\n    ip_hash;  # Same client IP always goes to the same server\n    server 10.0.1.10:8080;\n    server 10.0.1.11:8080;\n    server 10.0.1.12:8080;\n}\n```\n\n## HAProxy Configuration\n\n### Illustrative HAProxy Config\n\n```\n# \u002Fetc\u002Fhaproxy\u002Fhaproxy.cfg\nglobal\n    log \u002Fdev\u002Flog local0\n    maxconn 4096\n    daemon\n    stats socket \u002Fvar\u002Frun\u002Fhaproxy\u002Fadmin.sock mode 660 level admin\n    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256\n    ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11\n    tune.ssl.default-dh-param 2048\n\ndefaults\n    mode http\n    log global\n    option httplog\n    option dontlognull\n    option forwardfor\n    timeout connect 5s\n    timeout client  30s\n    timeout server  30s\n    timeout http-request 10s\n    timeout http-keep-alive 5s\n    retries 3\n\nfrontend http_front\n    bind *:80\n    redirect scheme https code 301 if !{ ssl_fc }\n\nfrontend https_front\n    bind *:443 ssl crt \u002Fetc\u002Fssl\u002Fcerts\u002Fapp.example.com.pem\n    http-request set-header X-Forwarded-Proto https\n\n    # Route based on path\n    acl is_api path_beg \u002Fapi\u002F\n    acl is_ws  path_beg \u002Fws\u002F\n\n    use_backend api_servers if is_api\n    use_backend ws_servers  if is_ws\n    default_backend web_servers\n\nbackend web_servers\n    balance roundrobin\n    option httpchk GET \u002Fhealth HTTP\u002F1.1\\r\\nHost:\\ app.example.com\n    http-check expect status 200\n\n    cookie SERVERID insert indirect nocache\n    server web1 10.0.1.10:8080 check inter 5s fall 3 rise 2 cookie web1\n    server web2 10.0.1.11:8080 check inter 5s fall 3 rise 2 cookie web2\n    server web3 10.0.1.12:8080 check inter 5s fall 3 rise 2 cookie web3\n\nbackend api_servers\n    balance leastconn\n    option httpchk GET \u002Fapi\u002Fhealth\n    http-check expect status 200\n\n    server api1 10.0.2.10:8080 check inter 5s fall 3 rise 2\n    server api2 10.0.2.11:8080 check inter 5s fall 3 rise 2\n\nbackend ws_servers\n    balance source\n    option httpchk GET \u002Fhealth\n    timeout tunnel 1h\n\n    server ws1 10.0.3.10:8080 check inter 5s fall 3 rise 2\n    server ws2 10.0.3.11:8080 check inter 5s fall 3 rise 2\n\nlisten stats\n    bind 127.0.0.1:8404\n    stats enable\n    stats uri \u002Fstats\n    stats refresh 10s\n    stats admin if LOCALHOST\n```\n\n### HAProxy Management\n\n```bash\n# Test config before reloading\nhaproxy -c -f \u002Fetc\u002Fhaproxy\u002Fhaproxy.cfg\n\n# Reload without dropping connections\nsudo systemctl reload haproxy\n\n# View stats from CLI\necho \"show stat\" | sudo socat stdio \u002Fvar\u002Frun\u002Fhaproxy\u002Fadmin.sock\n\n# Drain a server (stop new connections, let existing finish)\necho \"set server web_servers\u002Fweb1 state drain\" | sudo socat stdio \u002Fvar\u002Frun\u002Fhaproxy\u002Fadmin.sock\n\n# Set server to maintenance\necho \"set server web_servers\u002Fweb1 state maint\" | sudo socat stdio \u002Fvar\u002Frun\u002Fhaproxy\u002Fadmin.sock\n\n# Re-enable server\necho \"set server web_servers\u002Fweb1 state ready\" | sudo socat stdio \u002Fvar\u002Frun\u002Fhaproxy\u002Fadmin.sock\n```\n\n## AWS Application Load Balancer (ALB)\n\n### Create ALB via CLI\n\n```bash\n# Create the load balancer\naws elbv2 create-load-balancer \\\n  --name my-app-alb \\\n  --subnets subnet-aaa111 subnet-bbb222 \\\n  --security-groups sg-xxx123 \\\n  --type application \\\n  --scheme internet-facing\n\n# Create a target group\naws elbv2 create-target-group \\\n  --name my-app-targets \\\n  --protocol HTTP \\\n  --port 8080 \\\n  --vpc-id vpc-xxx123 \\\n  --health-check-protocol HTTP \\\n  --health-check-path \u002Fhealth \\\n  --health-check-interval-seconds 15 \\\n  --healthy-threshold-count 2 \\\n  --unhealthy-threshold-count 3 \\\n  --target-type instance\n\n# Register targets\naws elbv2 register-targets \\\n  --target-group-arn arn:aws:elasticloadbalancing:us-east-1:123456:targetgroup\u002Fmy-app-targets\u002Fabc123 \\\n  --targets Id=i-0123456789abc Id=i-0987654321def\n\n# Create HTTPS listener\naws elbv2 create-listener \\\n  --load-balancer-arn arn:aws:elasticloadbalancing:us-east-1:123456:loadbalancer\u002Fapp\u002Fmy-app-alb\u002Fabc123 \\\n  --protocol HTTPS \\\n  --port 443 \\\n  --certificates CertificateArn=arn:aws:acm:us-east-1:123456:certificate\u002Fabc-123 \\\n  --default-actions Type=forward,TargetGroupArn=arn:aws:elasticloadbalancing:us-east-1:123456:targetgroup\u002Fmy-app-targets\u002Fabc123\n\n# Create HTTP redirect listener\naws elbv2 create-listener \\\n  --load-balancer-arn arn:aws:elasticloadbalancing:us-east-1:123456:loadbalancer\u002Fapp\u002Fmy-app-alb\u002Fabc123 \\\n  --protocol HTTP \\\n  --port 80 \\\n  --default-actions Type=redirect,RedirectConfig='{Protocol=HTTPS,Port=443,StatusCode=HTTP_301}'\n```\n\n### Check Target Health\n\n```bash\n# Check health of registered targets\naws elbv2 describe-target-health \\\n  --target-group-arn arn:aws:elasticloadbalancing:us-east-1:123456:targetgroup\u002Fmy-app-targets\u002Fabc123\n```\n\n## AWS Network Load Balancer (NLB)\n\n```bash\n# Create NLB (for TCP, UDP, or TLS traffic)\naws elbv2 create-load-balancer \\\n  --name my-tcp-nlb \\\n  --subnets subnet-aaa111 subnet-bbb222 \\\n  --type network \\\n  --scheme internet-facing\n\n# Create TCP target group\naws elbv2 create-target-group \\\n  --name my-tcp-targets \\\n  --protocol TCP \\\n  --port 5432 \\\n  --vpc-id vpc-xxx123 \\\n  --health-check-protocol TCP \\\n  --target-type ip\n```\n\n## ALB with Terraform\n\n```hcl\nresource \"aws_lb\" \"app\" {\n  name               = \"my-app-alb\"\n  internal           = false\n  load_balancer_type = \"application\"\n  security_groups    = [aws_security_group.alb.id]\n  subnets            = var.public_subnet_ids\n\n  enable_deletion_protection = true\n}\n\nresource \"aws_lb_target_group\" \"app\" {\n  name     = \"my-app-tg\"\n  port     = 8080\n  protocol = \"HTTP\"\n  vpc_id   = var.vpc_id\n\n  health_check {\n    path                = \"\u002Fhealth\"\n    port                = \"traffic-port\"\n    healthy_threshold   = 2\n    unhealthy_threshold = 3\n    timeout             = 5\n    interval            = 15\n    matcher             = \"200\"\n  }\n\n  deregistration_delay = 30\n\n  stickiness {\n    type            = \"lb_cookie\"\n    cookie_duration = 86400\n    enabled         = true\n  }\n}\n\nresource \"aws_lb_listener\" \"https\" {\n  load_balancer_arn = aws_lb.app.arn\n  port              = 443\n  protocol          = \"HTTPS\"\n  ssl_policy        = \"ELBSecurityPolicy-TLS13-1-2-2021-06\"\n  certificate_arn   = aws_acm_certificate.cert.arn\n\n  default_action {\n    type             = \"forward\"\n    target_group_arn = aws_lb_target_group.app.arn\n  }\n}\n\nresource \"aws_lb_listener\" \"http_redirect\" {\n  load_balancer_arn = aws_lb.app.arn\n  port              = 80\n  protocol          = \"HTTP\"\n\n  default_action {\n    type = \"redirect\"\n    redirect {\n      port        = \"443\"\n      protocol    = \"HTTPS\"\n      status_code = \"HTTP_301\"\n    }\n  }\n}\n```\n\n## Load Balancing Algorithms\n\n| Algorithm | Use Case | nginx | HAProxy |\n|-----------|----------|-------|---------|\n| Round Robin | Default, equal servers | `(default)` | `balance roundrobin` |\n| Least Connections | Uneven request durations | `least_conn` | `balance leastconn` |\n| IP Hash | Session persistence without cookies | `ip_hash` | `balance source` |\n| URI Hash | Cache locality per URL | `hash $request_uri` | `balance uri` |\n| Random with Two | Large server pools | `random two least_conn` | `balance random(2)` |\n\n## Troubleshooting\n\n| Symptom | Cause | Fix |\n|---------|-------|-----|\n| All backends show \"unhealthy\" | Health check path returns non-200 | Verify `\u002Fhealth` endpoint returns 200; check security groups |\n| 502 Bad Gateway | Backend not running or wrong port | Confirm backend is listening on the configured port |\n| Uneven traffic distribution | Sticky sessions or weighted config | Check session affinity settings; review server weights |\n| Connection timeouts | Backend too slow or timeout too low | Increase `proxy_read_timeout` or HAProxy `timeout server` |\n| TLS handshake failures | Certificate mismatch or expired cert | Verify cert matches the domain; renew if expired |\n| ALB returns 503 | No healthy targets registered | Check target group health; verify targets are in correct subnets |\n| WebSocket disconnects | Proxy not configured for upgrades | Add `proxy_set_header Upgrade` and `Connection \"upgrade\"` |\n\n## Related Skills\n\n- reverse-proxy (`reverse-proxy`) - Reverse proxy configuration patterns\n- dns-management (`dns-management`) - DNS records pointing to load balancers\n- cdn-setup (`cdn-setup`) - CDN in front of load balanced origins\n- service-mesh (`service-mesh`) - Service-level load balancing in Kubernetes\n\n## Limitations\n\n- Infrastructure commands can disrupt services: confirm target host\u002Fscope and have backups\u002Fsnapshots before mutating state.\n- Docs-only import: upstream scripts and templates not bundled.\n\n","# Load Balancing\n\nDistribute traffic across application servers for high availability, scalability, and fault tolerance.\n\n## When to Use\n\n- Distributing HTTP\u002FHTTPS traffic across multiple backend servers.\n- Implementing health checks to route around unhealthy instances.\n- Terminating TLS at the load balancer for simplified certificate management.\n- Enabling blue\u002Fgreen or canary deployments with traffic shifting.\n- Scaling horizontally behind a single entry point.\n\nConfirm the exact hosts\u002Faccount, exposure, maintenance window and rollback before changes. The examples are alternatives with placeholders, not a complete production deployment. Keep stats\u002Fadmin endpoints private and restrict socket access. `\u002Fhealth` returning a local static 200 proves only proxy liveness, not backend readiness. Trust forwarded headers only from known proxies and validate client-address handling. Plain HTTP backend hops require an explicit private-network trust model or authenticated TLS.\n\n## Prerequisites\n\n- Two or more backend servers running the same application.\n- TLS certificate for HTTPS termination (ACM, Let's Encrypt, or self-signed for internal).\n- For AWS: VPC with public and private subnets across availability zones.\n- For nginx\u002FHAProxy: Linux server with root access.\n\n## nginx Load Balancer\n\n### Basic Round-Robin\n\n```nginx\n# \u002Fetc\u002Fnginx\u002Fconf.d\u002Floadbalancer.conf\nupstream app_backend {\n    server 10.0.1.10:8080;\n    server 10.0.1.11:8080;\n    server 10.0.1.12:8080;\n}\n\nserver {\n    listen 80;\n    server_name app.example.com;\n    return 301 https:\u002F\u002F$host$request_uri;\n}\n\nserver {\n    listen 443 ssl http2;\n    server_name app.example.com;\n\n    ssl_certificate     \u002Fetc\u002Fssl\u002Fcerts\u002Fapp.example.com.pem;\n    ssl_certificate_key \u002Fetc\u002Fssl\u002Fprivate\u002Fapp.example.com-key.pem;\n    ssl_protocols       TLSv1.2 TLSv1.3;\n    ssl_ciphers         HIGH:!aNULL:!MD5;\n\n    location \u002F {\n        proxy_pass http:\u002F\u002Fapp_backend;\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n        proxy_set_header X-Forwarded-Proto $scheme;\n\n        proxy_connect_timeout 5s;\n        proxy_read_timeout 30s;\n        proxy_send_timeout 30s;\n    }\n\n    location \u002Fhealth {\n        access_log off;\n        return 200 \"OK\";\n    }\n}\n```\n\n### Weighted and Backup Servers\n\n```nginx\nupstream app_backend {\n    least_conn;  # Route to server with fewest active connections\n\n    server 10.0.1.10:8080 weight=5;      # Gets 5x traffic\n    server 10.0.1.11:8080 weight=3;      # Gets 3x traffic\n    server 10.0.1.12:8080 weight=1;      # Gets 1x traffic\n    server 10.0.1.20:8080 backup;        # Only used when others are down\n    server 10.0.1.21:8080 down;          # Temporarily removed from pool\n}\n```\n\n### Health Checks (nginx Plus \u002F OpenResty)\n\n```nginx\nupstream app_backend {\n    zone backend 64k;  # Shared memory zone for health data\n\n    server 10.0.1.10:8080;\n    server 10.0.1.11:8080;\n    server 10.0.1.12:8080;\n}\n\n# Health check (requires nginx Plus or third-party module)\n# match healthy {\n#     status 200;\n#     body ~ \"OK\";\n# }\n# health_check interval=5s fails=3 passes=2 match=healthy;\n```\n\n### Sticky Sessions (IP Hash)\n\n```nginx\nupstream app_backend {\n    ip_hash;  # Same client IP always goes to the same server\n    server 10.0.1.10:8080;\n    server 10.0.1.11:8080;\n    server 10.0.1.12:8080;\n}\n```\n\n## HAProxy Configuration\n\n### Illustrative HAProxy Config\n\n```\n# \u002Fetc\u002Fhaproxy\u002Fhaproxy.cfg\nglobal\n    log \u002Fdev\u002Flog local0\n    maxconn 4096\n    daemon\n    stats socket \u002Fvar\u002Frun\u002Fhaproxy\u002Fadmin.sock mode 660 level admin\n    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256\n    ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11\n    tune.ssl.default-dh-param 2048\n\ndefaults\n    mode http\n    log global\n    option httplog\n    option dontlognull\n    option forwardfor\n    timeout connect 5s\n    timeout client  30s\n    timeout server  30s\n    timeout http-request 10s\n    timeout http-keep-alive 5s\n    retries 3\n\nfrontend http_front\n    bind *:80\n    redirect scheme https code 301 if !{ ssl_fc }\n\nfrontend https_front\n    bind *:443 ssl crt \u002Fetc\u002Fssl\u002Fcerts\u002Fapp.example.com.pem\n    http-request set-header X-Forwarded-Proto https\n\n    # Route based on path\n    acl is_api path_beg \u002Fapi\u002F\n    acl is_ws  path_beg \u002Fws\u002F\n\n    use_backend api_servers if is_api\n    use_backend ws_servers  if is_ws\n    default_backend web_servers\n\nbackend web_servers\n    balance roundrobin\n    option httpchk GET \u002Fhealth HTTP\u002F1.1\\r\\nHost:\\ app.example.com\n    http-check expect status 200\n\n    cookie SERVERID insert indirect nocache\n    server web1 10.0.1.10:8080 check inter 5s fall 3 rise 2 cookie web1\n    server web2 10.0.1.11:8080 check inter 5s fall 3 rise 2 cookie web2\n    server web3 10.0.1.12:8080 check inter 5s fall 3 rise 2 cookie web3\n\nbackend api_servers\n    balance leastconn\n    option httpchk GET \u002Fapi\u002Fhealth\n    http-check expect status 200\n\n    server api1 10.0.2.10:8080 check inter 5s fall 3 rise 2\n    server api2 10.0.2.11:8080 check inter 5s fall 3 rise 2\n\nbackend ws_servers\n    balance source\n    option httpchk GET \u002Fhealth\n    timeout tunnel 1h\n\n    server ws1 10.0.3.10:8080 check inter 5s fall 3 rise 2\n    server ws2 10.0.3.11:8080 check inter 5s fall 3 rise 2\n\nlisten stats\n    bind 127.0.0.1:8404\n    stats enable\n    stats uri \u002Fstats\n    stats refresh 10s\n    stats admin if LOCALHOST\n```\n\n### HAProxy Management\n\n```bash\n# Test config before reloading\nhaproxy -c -f \u002Fetc\u002Fhaproxy\u002Fhaproxy.cfg\n\n# Reload without dropping connections\nsudo systemctl reload haproxy\n\n# View stats from CLI\necho \"show stat\" | sudo socat stdio \u002Fvar\u002Frun\u002Fhaproxy\u002Fadmin.sock\n\n# Drain a server (stop new connections, let existing finish)\necho \"set server web_servers\u002Fweb1 state drain\" | sudo socat stdio \u002Fvar\u002Frun\u002Fhaproxy\u002Fadmin.sock\n\n# Set server to maintenance\necho \"set server web_servers\u002Fweb1 state maint\" | sudo socat stdio \u002Fvar\u002Frun\u002Fhaproxy\u002Fadmin.sock\n\n# Re-enable server\necho \"set server web_servers\u002Fweb1 state ready\" | sudo socat stdio \u002Fvar\u002Frun\u002Fhaproxy\u002Fadmin.sock\n```\n\n## AWS Application Load Balancer (ALB)\n\n### Create ALB via CLI\n\n```bash\n# Create the load balancer\naws elbv2 create-load-balancer \\\n  --name my-app-alb \\\n  --subnets subnet-aaa111 subnet-bbb222 \\\n  --security-groups sg-xxx123 \\\n  --type application \\\n  --scheme internet-facing\n\n# Create a target group\naws elbv2 create-target-group \\\n  --name my-app-targets \\\n  --protocol HTTP \\\n  --port 8080 \\\n  --vpc-id vpc-xxx123 \\\n  --health-check-protocol HTTP \\\n  --health-check-path \u002Fhealth \\\n  --health-check-interval-seconds 15 \\\n  --healthy-threshold-count 2 \\\n  --unhealthy-threshold-count 3 \\\n  --target-type instance\n\n# Register targets\naws elbv2 register-targets \\\n  --target-group-arn arn:aws:elasticloadbalancing:us-east-1:123456:targetgroup\u002Fmy-app-targets\u002Fabc123 \\\n  --targets Id=i-0123456789abc Id=i-0987654321def\n\n# Create HTTPS listener\naws elbv2 create-listener \\\n  --load-balancer-arn arn:aws:elasticloadbalancing:us-east-1:123456:loadbalancer\u002Fapp\u002Fmy-app-alb\u002Fabc123 \\\n  --protocol HTTPS \\\n  --port 443 \\\n  --certificates CertificateArn=arn:aws:acm:us-east-1:123456:certificate\u002Fabc-123 \\\n  --default-actions Type=forward,TargetGroupArn=arn:aws:elasticloadbalancing:us-east-1:123456:targetgroup\u002Fmy-app-targets\u002Fabc123\n\n# Create HTTP redirect listener\naws elbv2 create-listener \\\n  --load-balancer-arn arn:aws:elasticloadbalancing:us-east-1:123456:loadbalancer\u002Fapp\u002Fmy-app-alb\u002Fabc123 \\\n  --protocol HTTP \\\n  --port 80 \\\n  --default-actions Type=redirect,RedirectConfig='{Protocol=HTTPS,Port=443,StatusCode=HTTP_301}'\n```\n\n### Check Target Health\n\n```bash\n# Check health of registered targets\naws elbv2 describe-target-health \\\n  --target-group-arn arn:aws:elasticloadbalancing:us-east-1:123456:targetgroup\u002Fmy-app-targets\u002Fabc123\n```\n\n## AWS Network Load Balancer (NLB)\n\n```bash\n# Create NLB (for TCP, UDP, or TLS traffic)\naws elbv2 create-load-balancer \\\n  --name my-tcp-nlb \\\n  --subnets subnet-aaa111 subnet-bbb222 \\\n  --type network \\\n  --scheme internet-facing\n\n# Create TCP target group\naws elbv2 create-target-group \\\n  --name my-tcp-targets \\\n  --protocol TCP \\\n  --port 5432 \\\n  --vpc-id vpc-xxx123 \\\n  --health-check-protocol TCP \\\n  --target-type ip\n```\n\n## ALB with Terraform\n\n```hcl\nresource \"aws_lb\" \"app\" {\n  name               = \"my-app-alb\"\n  internal           = false\n  load_balancer_type = \"application\"\n  security_groups    = [aws_security_group.alb.id]\n  subnets            = var.public_subnet_ids\n\n  enable_deletion_protection = true\n}\n\nresource \"aws_lb_target_group\" \"app\" {\n  name     = \"my-app-tg\"\n  port     = 8080\n  protocol = \"HTTP\"\n  vpc_id   = var.vpc_id\n\n  health_check {\n    path                = \"\u002Fhealth\"\n    port                = \"traffic-port\"\n    healthy_threshold   = 2\n    unhealthy_threshold = 3\n    timeout             = 5\n    interval            = 15\n    matcher             = \"200\"\n  }\n\n  deregistration_delay = 30\n\n  stickiness {\n    type            = \"lb_cookie\"\n    cookie_duration = 86400\n    enabled         = true\n  }\n}\n\nresource \"aws_lb_listener\" \"https\" {\n  load_balancer_arn = aws_lb.app.arn\n  port              = 443\n  protocol          = \"HTTPS\"\n  ssl_policy        = \"ELBSecurityPolicy-TLS13-1-2-2021-06\"\n  certificate_arn   = aws_acm_certificate.cert.arn\n\n  default_action {\n    type             = \"forward\"\n    target_group_arn = aws_lb_target_group.app.arn\n  }\n}\n\nresource \"aws_lb_listener\" \"http_redirect\" {\n  load_balancer_arn = aws_lb.app.arn\n  port              = 80\n  protocol          = \"HTTP\"\n\n  default_action {\n    type = \"redirect\"\n    redirect {\n      port        = \"443\"\n      protocol    = \"HTTPS\"\n      status_code = \"HTTP_301\"\n    }\n  }\n}\n```\n\n## Load Balancing Algorithms\n\n| Algorithm | Use Case | nginx | HAProxy |\n|-----------|----------|-------|---------|\n| Round Robin | Default, equal servers | `(default)` | `balance roundrobin` |\n| Least Connections | Uneven request durations | `least_conn` | `balance leastconn` |\n| IP Hash | Session persistence without cookies | `ip_hash` | `balance source` |\n| URI Hash | Cache locality per URL | `hash $request_uri` | `balance uri` |\n| Random with Two | Large server pools | `random two least_conn` | `balance random(2)` |\n\n## Troubleshooting\n\n| Symptom | Cause | Fix |\n|---------|-------|-----|\n| All backends show \"unhealthy\" | Health check path returns non-200 | Verify `\u002Fhealth` endpoint returns 200; check security groups |\n| 502 Bad Gateway | Backend not running or wrong port | Confirm backend is listening on the configured port |\n| Uneven traffic distribution | Sticky sessions or weighted config | Check session affinity settings; review server weights |\n| Connection timeouts | Backend too slow or timeout too low | Increase `proxy_read_timeout` or HAProxy `timeout server` |\n| TLS handshake failures | Certificate mismatch or expired cert | Verify cert matches the domain; renew if expired |\n| ALB returns 503 | No healthy targets registered | Check target group health; verify targets are in correct subnets |\n| WebSocket disconnects | Proxy not configured for upgrades | Add `proxy_set_header Upgrade` and `Connection \"upgrade\"` |\n\n## Related Skills\n\n- reverse-proxy (`reverse-proxy`) - Reverse proxy configuration patterns\n- dns-management (`dns-management`) - DNS records pointing to load balancers\n- cdn-setup (`cdn-setup`) - CDN in front of load balanced origins\n- service-mesh (`service-mesh`) - Service-level load balancing in Kubernetes\n\n## Limitations\n\n- Infrastructure commands can disrupt services: confirm target host\u002Fscope and have backups\u002Fsnapshots before mutating state.\n- Docs-only import: upstream scripts and templates not bundled.\n\n",{"name":5,"risk":27,"source":47,"license":14,"category":48,"metadata":49,"date_added":52,"description":7,"source_repo":53,"source_type":33,"compatibility":54,"license_source":55},"https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills","devops",{"author":50,"version":51},"devops-skills","1.0","2026-09-20","BagelHole\u002FDevOps-Security-Agent-Skills","Requires the relevant OS\u002Fplatform tooling and privileged access where noted. Docs-only; helper scripts and templates not bundled.","https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE","7bf2279c8a65758319526a721d5c4b75683aec9c","skills\u002Fantigravity-load-balancing",3,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections","https:\u002F\u002Fgithub.com\u002Fboisenoise","2026-11-14 14:18:11",{"source":8,"skillName":5,"commands":63,"prompt":73,"zipAvailable":74},[64,67,70],{"tool":65,"command":66},"npx","npx skills add boisenoise\u002Fskills-collections --skill load-balancing",{"tool":68,"command":69},"bunx","bunx skills add boisenoise\u002Fskills-collections --skill load-balancing",{"tool":71,"command":72},"pnpm","pnpm dlx skills add boisenoise\u002Fskills-collections --skill load-balancing","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-load-balancing\u002FSKILL.md",true,[],[77,86,94,102,110,138],{"skillNo":78,"name":79,"nameZh":6,"description":80,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":81,"sourceHtmlUrl":82,"categories":83,"keywords":84,"publishedAt":85},"01M743PZMJW2GEKG5J199GPSK7","sync-lipsync","Lip-sync an existing video of a real person to new audio or a typed script with sync. labs through its hosted MCP server, quoting the cost and waiting for approval first.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-sync-lipsync\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-sync-lipsync\u002FSKILL.md",[],[],"2026-11-11 15:11:14",{"skillNo":87,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":90,"sourceHtmlUrl":91,"categories":92,"keywords":93,"publishedAt":85},"01M743MMN3CKTJVNRSZMB684E5","music-for-robots","Optional music-inspired creative exercise for multimodal agents. Ingests an unquantized acoustic MP3 composition by Michael Luchtan (Music For Robots) into a private temporary directory, analyzing microtiming and texture to inspire creative writing, brainstorming, or technical tasks.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-music-for-robots\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-music-for-robots\u002FSKILL.md",[],[],{"skillNo":95,"name":96,"nameZh":6,"description":97,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":98,"sourceHtmlUrl":99,"categories":100,"keywords":101,"publishedAt":85},"01M743KC2GN5WE11BSTWSSWD8B","imagera-media","Generate or edit images, video clips, voiceovers and music through the hosted Imagera MCP server, quoting the credit cost and getting approval before each paid call.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-imagera-media\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-imagera-media\u002FSKILL.md",[],[],{"skillNo":103,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":106,"sourceHtmlUrl":107,"categories":108,"keywords":109,"publishedAt":85},"01M743HDJNZQA8A4VT68NWGWQJ","deja-history","Search this machine's past AI coding sessions across Claude Code, Codex, Cursor, Gemini CLI and thirty-nine other agents before editing, debugging, or denying something exists.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-deja-history\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-deja-history\u002FSKILL.md",[],[],{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":114,"sourceHtmlUrl":115,"categories":116,"keywords":122,"publishedAt":85},"01M6FJTP2ARVA39ESPTBN149ZF","Linear","Managing Linear issues, projects, and teams. Use when working with Linear tasks, creating issues, updating status, querying projects, or managing team workflows.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Flinear-claude-skill\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Flinear-claude-skill\u002FSKILL.md",[117],{"categoryNo":118,"categoryName":119,"taxonomyType":120,"taxonomyTypeDesc":121},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[123,124,125,36,126,127,128,129,130,131,132,133,134,135,136,137],"linear","webfetch","with","teams","domain","status","team","tasks","Bash","creating issues","workflows","MCP","issues","projects","app",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":142,"licenseFileUrl":143,"sourceHtmlUrl":144,"categories":145,"keywords":152,"publishedAt":85},"01M6FGF3K27JAABTDTN0Q20NT9","slack-gif-creator","Toolkit for creating animated GIFs optimized for Slack, with validators for size constraints and composable animation primitives. This skill applies when users request animated GIFs or emoji animations for Slack from descriptions like \"make me a GIF for Slack of X doing Y\".","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fcomposio-slack-gif-creator\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fcomposio-slack-gif-creator\u002FSKILL.md",[146,149],{"categoryNo":147,"categoryName":148,"taxonomyType":120,"taxonomyTypeDesc":121},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":150,"categoryName":151,"taxonomyType":120,"taxonomyTypeDesc":121},"01JBSEEDCAT000000000000005","邮件与沟通",[153,154,155,156,157,158,159,160,125,161,162,163,164],"slack gif creator","gif","slack","emoji","make","constraints","primitives","me","users","toolkit","composable","Animation"]