具体配置如下

<Proxy balancer://cluster1>
    BalancerMember http://host1.com:3000 route=1 loadfactor=10 connectiontimeout=120 timeout=120
    BalancerMember http://host2.com:3000 route=2 loadfactor=8 connectiontimeout=120 timeout=120
    BalancerMember http://host3.com:3000 route=3 loadfactor=10 connectiontimeout=120 timeout=120
    ProxySet lbmethod=byrequests
    ProxySet stickysession=ROUTEID
</Proxy>

<VirtualHost *:80>
  Redirect permanent / https://host1.com/
  ServerName host1.com
  RewriteEngine on
  RewriteCond %{SERVER_NAME} =host1.com
  RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

<VirtualHost *:80>
  Redirect permanent / https://host1.com/
  ServerName www.host1.com
  RewriteEngine on
  RewriteCond %{SERVER_NAME} =www.host1.com
  RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

<VirtualHost *:443>

  ServerName host1.com
  # RewriteEngine On
  # RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

  SSLEngine on
  SSLProxyEngine on

  <IfModule headers_module>
      Header always edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
      Header always set Strict-Transport-Security "max-age=15768000; includeSubDomains"
      Header add Set-Cookie "ROUTEID=.%{BALANCER_WORKER_ROUTE}e; path=/" env=BALANCER_ROUTE_CHANGED
  </IfModule>

  ServerAlias       host1.com
  Include    /etc/letsencrypt/options-ssl-apache.conf
  SSLCertificateFile  /etc/letsencrypt/live/host1.com/fullchain.pem
  SSLCertificateKeyFile /etc/letsencrypt/live/host1.com/privkey.pem

  ProxyRequests Off
  #ProxyPreserveHost On
  ProxyPass /server-status !
  ProxyPass / balancer://cluster1/
  ProxyPassReverse / balancer://cluster1/
</VirtualHost>

每个 host 上面通过 puma 启动 rails 服务

运行一段时间后，apache 那边就会报 403 的错。 请问这是什么问题？怎么解决？

查看了 apache log，有两个错误信息：

AH00898: Error reading from remote server returned by /xxx AH01102: error reading status line from remote server host1

Update:

AH01102 是 timeout，应该是 proxy 到 backend 超时了，因为有一个 host 的配置比较低，如果 requests 多了，cpu/memory 会用满，然后就会导致连接超时。 解决办法：增加 timeout 的时间，默认是 5 秒，改到了 60 秒。

AH00898是SSL Handshake相关的错误，proxy 是 enable SSL，而 backend 没有，不知道会不会是这个原因。 https://serverfault.com/questions/538086/proxyerror-ah00898-error-during-ssl-handshake-with-remote-server 我先按照上面这个试试，再看看是否能解决问题。