Haproxy

的架构中, 同时可以保护你的 web 服务器不被暴露到网络上.

实验环境:rhel6.3 selinux and iptables disabled
实验主机: 192.168.0.151
haproxy
192.168.0.196
web1
192.168.0.197
web2
软件下载:http://haproxy.1wt.eu/
rpm 包方式:
rpmbuild -tb haproxy-1.4.23.tar.gz
rpm -ivh /root/rpmbuild/RPMS/x86_64/haproxy-1.4.23-1.x86_64.rpm
源码方式:
tar zxf haproxy-1.4.23.tar.gz
cd haproxy-1.4.23
make TARGET=linux26 ARCH=x86_64 USE_PCRE=1 PREFIX=/usr/local/haproxy install
配置:
vi /etc/haproxy/haproxy.cfg
global
log 127.0.0.1 local0
#指定日志设备
#log 127.0.0.1 local1 notice
log loghost local0 info #指定日志类型,还有 err warning debug
maxconn 65535 #并发最大连接数量
chroot /usr/share/haproxy #jail 目录
uid 99 #用户
gid 99 #组
daemon #后台运行
#debug
#quiet
defaults
log
global
mode http #默认使用 http 的 7 层模式 tcp: 4 层
option httplog #http 日志格式
option dontlognull #禁用空链接日志
retries 3 #重试 3 次失败认为服务器不可用
option redispatch #当 client 连接到挂掉的机器时,重新分配到健康的主机
maxconn 65535
contimeout 5000
#连接超时
clitimeout 50000 #客户端超时
srvtimeout 50000 #服务器端超时
stats uri
#haproxy 监控页面
/status
listen www.example.com *:80
balance roundrobin
#监听的实例名称,地址和端口
#负载均衡算法
server web1 192.168.0.196:80 cookie app1inst1 check inter 2000 rise 2 fall 5
server web2 192.168.0.197:80 cookie app1inst2 check inter 2000 rise 2 fall 5
#cookie app1inst1:表示 serverid 为 app1inst1
#check inter 2000:检测心跳频率
#rise 2:表示 2 次正确认为服务器可用
#fall 5:表示 5 次失败认为服务器不可用
# mkdir /usr/share/haproxy
# /etc/init.d/haproxy start
访问 http://www.example.com 测试负载
访问 haproxy 监控页面:http://192.168.0.151/status
监控页面添加认证:
listen stats_auth 192.168.0.151:80
stats enable
stats uri /status #监控页面地址
stats auth admin:westos #管理帐号和密码
stats refresh 5s #刷新频率
haproxy 日志:
# vi /etc/rsyslog.conf #接受 haproxy 日志
$ModLoad imudp
$UDPServerRun 514
local0.* /var/log/haproxy.log
# /etc/init.d/rsyslog restart
haproxy+keepalived
MASTER:
# cat keepalived.conf
! Configuration File for keepalived
vrrp_script check_haproxy {
script "/opt/check_haproxy.sh"
interval 2
weight 2
}
#日志文件位置
global_defs {
notification_email {
root@localhost
}
notification_email_from keepalived@server51.example.com
smtp_server 127.0.0.1
smtp_connect_timeout 30
router_id LVS_DEVEL
}
vrrp_instance VI_1 {
state MASTER
interface eth0
virtual_router_id 151
priority 100
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
192.168.0.163
}
track_script {
check_haproxy
}
}
BACKUP:
# cat keepalived.conf
! Configuration File for keepalived
vrrp_script check_haproxy {
script "/opt/check_haproxy.sh"
interval 2
weight 2
}
global_defs {
notification_email {
root@localhost
}
notification_email_from keepalived@server87.example.com
smtp_server 127.0.0.1
smtp_connect_timeout 30
router_id LVS_DEVEL
}
vrrp_instance VI_1 {
state BACKUP
interface eth0
virtual_router_id 151
priority 50
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
192.168.0.163
}
track_script {
check_haproxy
}
}
检测脚本:
# cat /opt/check_haproxy.sh
#!/bin/bash
/etc/init.d/haproxy status &> /dev/null || /etc/init.d/haproxy restart &> /dev/null
if [ $? -ne 0 ];then
/etc/init.d/keepalived stop &> /dev/null
fi