Deploying a web application on Yandex BareMetal servers with an L7 load balancer and Yandex Smart Web Security protection

In this tutorial, you will deploy a web application on Yandex BareMetal servers. To evenly distribute load across the application hosts, you will configure an L7 load balancer in Yandex Application Load Balancer. A Yandex Smart Web Security profile will ensure protection of your web application from bots, DDoS, and web attacks. A Yandex Cloud Interconnect routing instance will provide a private connection between the Yandex Virtual Private Cloud cloud network and the Yandex BareMetal private network.

You can see the solution architecture in the diagram below:

Where:

• BareMetal infrastructure components:

  • Private subnet in the ru-central1-m4 server pool: subnet-m4.
  • Virtual network segment (VRF), my-vrf.
  • Two BareMetal servers, alb-back-0 and alb-back-1, hosting the deployed application in the ru-central1-m4 server pool.

• Cloud Interconnect Routing Instance for connectivity between the Virtual Private Cloud and BareMetal networks.

• Virtual Private Cloud infrastructure components:

  • Cloud network, sample-network.
  • Subnets named vpc-subnet-a and vpc-subnet-b in the ru-central1-a and ru-central1-b availability zones, respectively.
  • L7 load balancer from Application Load Balancer , demo-alb-bms.
  • Smart Web Security profile, sws-demo-profile.
  • vm-validator VM for connectivity checks between the Virtual Private Cloud and BareMetal networks.

To deploy a web application on Yandex BareMetal servers with an L7 load balancer and Yandex Smart Web Security protection:

1. Get your cloud ready.
2. Set up your VPC environment.
3. Create a routing instance.
4. Set up your BareMetal environment.
5. Configure an L7 load balancer.
6. Set up protection against bots, DDoS, and web attacks.

If you no longer need the resources you created, delete them.

Getting startedGetting started

Sign up in Yandex Cloud and create a billing account:

1. Navigate to the management console and log in to Yandex Cloud or register a new account.
2. On the Yandex Cloud Billing page, make sure you have a linked billing account with an ACTIVE or TRIAL_ACTIVE status. If you do not have a billing account, create one and link a cloud to it.

If you have an active billing account, you can navigate to the cloud page to create or select a folder for your infrastructure to operate in.

Learn more about clouds and folders.

Required paid resourcesRequired paid resources

The infrastructure support cost for deploying a web application on BareMetal servers with an L7 load balancer and Smart Web Security protection includes:

• Fee for using the VM public IP address (see Yandex Virtual Private Cloud pricing).
• Fee for VM computing resources and disks (see Yandex Compute Cloud pricing).
• Fee for leasing the BareMetal servers (see Yandex BareMetal pricing).
• Fee for using an L7 load balancer’s computing resources (see Yandex Application Load Balancer pricing).
• Fee for requests processed by security profile rules (see Yandex Smart Web Security pricing).
• If using a log group for load balancer logging, the fee for writing and storing data (see Yandex Cloud Logging pricing).

Traffic transmitted via Yandex Cloud Interconnect between private Yandex BareMetal and Yandex Virtual Private Cloud addresses in either direction is not billable.

Set up your VPC environmentSet up your VPC environment

Configure the infrastructure on the Virtual Private Cloud side. In this step, you will create a cloud network, subnets, required security groups, and a VM.

Create a cloud networkCreate a cloud network

Create subnetsCreate subnets

Create security groupsCreate security groups

Create a VMCreate a VM

Create a routing instanceCreate a routing instance

To set up network connectivity between BareMetal subnets and Virtual Private Cloud subnets, you need to create a routing instance resource. To create a Routing Instance, contact support.

If your folder already has Cloud Interconnect network connectivity (VPC-to-On-Prem) configured, you can either use the existing Routing Instance or request a new additional Routing Instance to be created for standalone network connectivity.

Make sure you have a routing instance in your folderMake sure you have a routing instance in your folder

1. If you do not have the Yandex Cloud CLI installed yet, install and initialize it.

   By default, the CLI uses the folder specified when creating the profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also set a different folder for any specific command using the --folder-name or --folder-id parameter.

2. Make sure you have a routing instance in your default folder:

   CLI

   Run this command:

   yc cloudrouter routing-instance list
   

   If your folder already contains a routing instance, the command will output something like this:

   +----------------------+-------------------------------------------+--------+-----------------------+
   |          ID          |                    NAME                   | STATUS | PRIVATE CONNECTION ID |
   +----------------------+-------------------------------------------+--------+-----------------------+
   | cf35oot8f0eu******** | ajeol2afu1js********-enpcfncr6uld******** | ACTIVE | cf395uf8dg7h********  |
   +----------------------+-------------------------------------------+--------+-----------------------+
   

3. If you already have a Routing Instance, you may skip the next step and proceed to setting up your BareMetal environment.

   If you do not have a Routing Instance or you want to build additional dedicated network connectivity, request a new Routing Instance.

Request a new routing instanceRequest a new routing instance

Contact support to create a routing instance in your folder.

Fill out your request as follows:

Subject: [CIC for BareMetal] Creating a routing instance.

Request text:
Please create a routing instance in the specified cloud folder with the following parameters:

folder_id: <folder_ID>

vpc:
  vpc_net_id: <network_ID>
    vpc_subnets:
      ru-central1-a: [CIDR_a1, CIDR_a2, ..., CIDR_an]
      ru-central1-b: [CIDR_b1, CIDR_b2, ..., CIDR_bn]
      ru-central1-d: [CIDR_d1, CIDR_d2, ..., CIDR_dn]

Where:

• folder_id: Folder ID.

• vpc_net_id: Cloud network ID.

• vpc_subnets: List of announced address prefixes for each availability zone. For example, for the VPC subnet you created earlier, you will specify ru-central1-b: [192.168.11.0/24].

  You may announce aggregated address prefixes.

Set up your BareMetal environmentSet up your BareMetal environment

Configure the BareMetal infrastructure. In this step, you will create a virtual network segment (VRF) and private subnet, configure a private connection to the cloud network, and lease two BareMetal servers.

Create a VRF segment and a private subnetCreate a VRF segment and a private subnet

Create a VRF segment and a private subnet in the ru-central1-m4 server pool:

Configure a private connection to your cloud networkConfigure a private connection to your cloud network

Create a Cloud Interconnect private connection in BareMetal:

As a result, the VRF information page will display the newly created connection ID and its status under Private connection to cloud networks.

Private cloud netweork connections may show one of the following statuses:

• CREATING: Connection creation in progress.
• READY: Connection is up and ready to use.
• ERROR: Connection failure. Contact support.
• DELETING: Connection deletion in progress.
• UPDATING: Connection settings update in progress.

Lease BareMetal serversLease BareMetal servers

Deploy your web applicationDeploy your web application

In this step, you will deploy your web application on BareMetal servers. The web application will use the following server resources:

• /opt/mygoapp: Web server's working directory.
• /opt/mygoapp/server: Web server's executable.
• /etc/systemd/system/mygoapp.service: Configuration file to manage the web server via systemd.

To deploy your web application on the server:

1. Connect to the alb-back-0 BareMetal server over SSH:

   ssh root@<server_public_IP_address>
   

   You can look up the server's public IP address in the management console: see the BareMetal server info on the Overview page. You can find the address in the Public address field under Public network.

   You will perform all further actions under this step in the server terminal.

2. Prepare your working directory:

   mkdir -p /opt/mygoapp && cd /opt/mygoapp
   

3. Download the web server's executable:

   wget https://storage.yandexcloud.net/yc-public-share/server
   

4. Set the execute permission for the file you downloaded:

   chmod +x server
   

5. Create a new service in systemd:

   1. Open the service configuration file:

      nano /etc/systemd/system/mygoapp.service
      

   2. Paste the following into the file you opened:

      [Unit]
      Description=Simple Web Server on Go
      After=network.target
      [Service]
      Type=simple
      WorkingDirectory=/opt/mygoapp
      ExecStart=/opt/mygoapp/server
      Restart=always
      RestartSec=5
      [Install]
      WantedBy=multi-user.target
      

   3. Save the changes and close the file.

6. Initialize the service you created:

   systemctl daemon-reload
   

7. Run the service:

   systemctl start mygoapp.service
   

8. Test your web application. To do this, on your local computer, paste the alb-back-0 server's public IP address into the browser's address bar.

   Your browser will open a page with the host name and information about the web server’s running time since startup.

   Web application source code

   package main
   
   import (
     "context"
     "fmt"
     "net/http"
     "os"
     "os/signal"
     "syscall"
     "time"
     "github.com/gorilla/handlers"
   )
   
   var (
     hostname    string
     htmlContent []byte
   )
   
   const (
     serverTimeout  = 5 * time.Second
     cacheDuration  = 86400 * 30 // 30 days in seconds
     htmlTemplate = `
   <!DOCTYPE html>
   <html lang="en">
   <head>
       <!-- Minified CSS -->
       <style>*{margin:0;padding:0;box-sizing:border-box;font-family:'Segoe UI',system-ui,sans-serif}body{min-height:100vh;display:flex;justify-content:center;align-items:center;background:linear-gradient(135deg,#1a1a1a,#2d2d2d);color:#fff;padding:20px}.container{background:rgba(255,255,255,0.1);backdrop-filter:blur(10px);border-radius:20px;padding:40px;box-shadow:0 8px 32px rgba(0,0,0,0.3);text-align:center;max-width:600px;width:100%%;transition:transform .3s ease}.server-name{font-size:1.8rem;margin-bottom:30px;color:#0f0;font-weight:600;text-shadow:0 0 10px rgba(0,255,136,0.3)}.datetime{font-size:2.5rem;letter-spacing:2px;margin-bottom:20px}.date{font-size:1.5rem;opacity:.8}@media (max-width:768px){.container{padding:25px;border-radius:15px}.server-name{font-size:1.4rem}.datetime{font-size:2rem}.date{font-size:1.2rem}}@media (max-width:480px){.datetime{font-size:1.6rem}}</style>
       <meta name="viewport" content="width=device-width,initial-scale=1">
       <title>Server Info & Time</title>
   </head>
   <body>
       <div class="container">
           <div class="server-name">Server Hostname: %s</div>
           <div class="datetime" id="datetime"></div>
           <div class="date" id="date"></div>
       </div>
       <script>
           // Minified JavaScript
           const e=()=>{const e=new Date;document.getElementById("datetime").textContent=e.toLocaleTimeString("en-US",{timeZone:"Europe/Moscow",hour12:!1,hour:"2-digit",minute:"2-digit",second:"2-digit"}),document.getElementById("date").textContent=e.toLocaleDateString("en-US",{timeZone:"Europe/Moscow",weekday:"long",year:"numeric",month:"long",day:"numeric"})};e(),setInterval(e,1e3);
       </script>
   </body>
   </html>`
   )
   
   func init() {
     // Initializing the host at startup
     var err error
     if hostname, err = os.Hostname(); err != nil {
       hostname = "Unavailable"
     }
     
     // Pre-generating HTML
     htmlContent = []byte(fmt.Sprintf(htmlTemplate, hostname))
   }
   
   func main() {
     // Configuring handlers
     mux := http.NewServeMux()
     mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
       w.Header().Set("Content-Type", "text/html; charset=utf-8")
       w.Header().Set("Cache-Control", fmt.Sprintf("public, max-age=%d", cacheDuration))
       w.Write(htmlContent)
     })
   
     // Middleware
     chain := handlers.CompressHandler(
       handlers.CombinedLoggingHandler(os.Stdout, mux),
     )
   
     // Server configuration
     server := &http.Server{
       Addr:         ":80",
       Handler:      chain,
       ReadTimeout:  serverTimeout,
       WriteTimeout: serverTimeout,
       IdleTimeout:  serverTimeout * 2,
     }
   
     // Graceful shutdown
     ctx, stop := signal.NotifyContext(context.Background(), 
       os.Interrupt, syscall.SIGTERM)
     defer stop()
   
     go func() {
       <-ctx.Done()
       shutdownCtx, cancel := context.WithTimeout(
         context.Background(), 5*time.Second)
       defer cancel()
       server.Shutdown(shutdownCtx)
     }()
   
     fmt.Println("Server started")
     if err := server.ListenAndServe(); err != http.ErrServerClosed {
       fmt.Printf("Server error: %v\n", err)
     }
   }
   

9. Similarly, deploy your web application on the alb-back-1 server.

Test network connectivityTest network connectivity

Make sure the previously created private connection to the cloud network is Ready and test network connectivity between the vm-validator VM in the Virtual Private Cloud network and servers in the BareMetal private subnet:

1. Connect to the vm-validator VM over SSH:

   ssh yc-user@<VM_public_IP_address>
   

   You can look up the VM's public IP address in the management console: see the Public IPv4 address section's Network field on the VM information page.

   You will perform all further actions under this step in the VM terminal.

2. Ping the alb-back-0 server by its private IP address:

   ping <server_private_IP_address> -s 1024 -c 3
   

   You can look up the server's private IP address in the management console: see the BareMetal server info on the Overview page. You can find the address in the Private network field under Private IP address.

   Result:

   PING 172.28.4.11 (172.28.4.11) 1024(1052) bytes of data.
   1032 bytes from 172.28.4.11: icmp_seq=1 ttl=58 time=3.77 ms
   1032 bytes from 172.28.4.11: icmp_seq=2 ttl=58 time=3.83 ms
   1032 bytes from 172.28.4.11: icmp_seq=3 ttl=58 time=3.80 ms
   
   --- 172.28.4.11 ping statistics ---
   3 packets transmitted, 3 received, 0% packet loss, time 2004ms
   rtt min/avg/max/mdev = 3.767/3.800/3.830/0.025 ms
   

3. Similarly, ping the alb-back-1 server by its private IP address.

Save the private IP addresses of the BareMetal servers as you will need them to configure an L7 load balancer.

Configure an L7 load balancerConfigure an L7 load balancer

After you create the Virtual Private Cloud and BareMetal infrastructure components and test network connectivity between them, configure an L7 load balancer to manage user traffic to your web application.

Create a target group for the L7 load balancerCreate a target group for the L7 load balancer

Create a backend groupCreate a backend group

Create an HTTP routerCreate an HTTP router

Create an L7 load balancerCreate an L7 load balancer

Set up protection against bots, DDoS, and web attacksSet up protection against bots, DDoS, and web attacks

Once you make sure your L7 load balancer works correctly, set up a Smart Web Security profile to protect your web application against bots, DDoS, and web attacks.

Create an ARL profileCreate an ARL profile

Create a WAF profileCreate a WAF profile

Create a security profileCreate a security profile

Apply protection to your hostsApply protection to your hosts

You have deployed a web application on two BareMetal servers, configured distribution of user traffic with an L7 load balancer in Application Load Balancer, and implemented protection of your application by means of a Smart Web Security profile.

How to delete the resources you createdHow to delete the resources you created

To stop paying for the resources you created:

1. Delete the VM.

2. Delete the L7 load balancer; then delete the HTTP router, backend group, and the load balancer's target group one by one.

3. Delete the Smart Web Security profile; then delete the WAF profile and ARL profile.

4. You cannot delete BareMetal servers. Instead, cancel the renewal of their lease.

5. If you had left the L7 load balancer logging feature on, delete the log group.

6. Optionally, delete the security groups, subnets, and cloud network one by one.

7. Delete the private connection if you no longer need it:

   Management console

   1. In the management console, select the folder where you created the infrastructure.
   2. In the list of services, select BareMetal.
   3. In the left-hand panel, click VRF and select my-vrf.
   4. Under Private connection to cloud networks, click and select Disable connection.
   5. In the window that opens, confirm the deletion.

   The connection status will change to Deleting. Once all links are deleted, the connection will disappear from the list.