HAProxy 動態路由系統 - HAProxy Dynamic Router

# HAProxy 配合 Quagga OSPF 實現動態路由流量調度
# HAProxy Dynamic Router with Quagga OSPF for Dynamic Traffic Steering

Description:
應對大規模 DDoS 攻擊並減輕邊緣節點（Edge）負載，開發 HAProxy 動態路由系統。透過內部路由協議 (OSPF) 切換，實現流量秒級導向至防護節點（Protect Edge），加速攻擊隔離與防護生效時間。
Developed a HAProxy-based dynamic routing system to mitigate large-scale DDoS attacks and offload edge node stress. By leveraging interior routing protocols (OSPF) instead of traditional DNS-based steering, the system enables second-level traffic redirection to protection edges.

Tech Stack:

• HAProxy + Data Plane API
• Python3 + FastAPI
• Quagga + OSPF
• Docker, Docker Compose
• Jenkins

Features:

• HAProxy Data Plane API 整合 (API Integration)
  利用 HAProxy Data Plane API 結合 FastAPI，實現前端 UI 自動化綁定服務 IP 至 HAProxy Frontend 並同步配置動態路由。
  Leveraged the HAProxy Data Plane API integrated with FastAPI to automate the binding of service IPs to HAProxy frontends.
• Rate-limiting 與 ACL 配置 (Traffic Control)
  開發專用 API 進行 HAProxy Rate-limiting 與 ACL 配置，提供即時的流量清洗與基礎攻擊防禦能力。
  Developed dedicated APIs for HAProxy rate-limiting and ACL configuration for real-time traffic scrubbing.
• 系統監控 (System Monitoring)
  監控 CPU 與 Router 配置等相關指標，確保系統穩定運行。
  Monitored CPU and Router configurations to ensure system stability.
• Jenkins CronJob Pipeline
  實作 Jenkins CronJob Pipeline，定時撈取並同步 Edge 節點資訊與 Frontend IP 配置，確保負載均衡器與 CDN 資源池狀態一致。
  Implemented Jenkins CronJob Pipelines to periodically fetch and synchronize Edge node info and frontend IP configurations.
• Quagga OSPF 配置 (Dynamic Routing)
  配置 Quagga 實作 OSPF 協議，將新生成的服務路由即時發布至網路環境中，實現自動化流量重定向。
  Configured Quagga to implement the OSPF protocol for automated traffic redirection.

Results:

• 將流量切換生效時間從原本 DNS 方式的 20 分鐘縮短至 30 秒以內，極大化攻擊防護效率。
  Reduced traffic failover latency from 20 minutes (DNS-based) to under 30 seconds.
• 透過介面化管理與自動化路由同步，減少手動配置路由的步驟，降低人為誤操作導致的服務中斷。
  Minimized manual routing configuration steps through UI-driven management and automated sync.
• 藉由 Jenkins 自動化排程，確保 HAProxy 後端集群資訊與實際 CDN 邊緣節點狀態即時同步。
  Utilized Jenkins automation to ensure real-time synchronization between HAProxy backend pools and CDN edge nodes.

Architecture Overview:

sequenceDiagram
    participant User as Operator
    participant Platform as FastAPI Platform
    participant HAProxy as HAProxy (Data Plane API)
    participant Quagga as Quagga (OSPF)
    participant Network as Network (OSPF Neighbors)
    participant Jenkins as Jenkins CronJob
    participant CDN as CDN Edge Nodes
    
    User->>Platform: Add Frontend (Service IP)
    Platform->>HAProxy: Bind IP to Frontend
    Platform->>Quagga: Set Route Config
    Quagga->>Network: Broadcast OSPF Route
    Network-->>Network: Route Propagation (~30s)
    
    Jenkins->>CDN: Fetch Edge Node Status
    CDN-->>Jenkins: Return Node Info
    Jenkins->>HAProxy: Sync Backend Pool