keepalived+nginx 实现 sharepoint 负载均衡

keepalived 实现虚拟路由
nginx 做反向代理和负载均衡

要点
1、ssl代理
ssl_certificate /etc/nginx/ssl/nginx.crt;
ssl_certificate_key /etc/nginx/ssl/nginx.key;
2、访问http时重定向的https
server {
listen 80;
server_name proxy-server180;
location / {
rewrite ^(.*)$ https://$host$1 permanent;
#proxy_pass http://192.168.16.193;
}
}
3、nginx 状态
location /basic_status {
stub_status;
}
4、图片和html页面缓存
location ~* \.(gif|jpg|jpeg|png|gif|css|js|html|htm)$ {
proxy_pass http://192.168.16.193;
proxy_cache proxy-cache;
proxy_cache_key $scheme$proxy_host$request_uri;
proxy_cache_valid 200 302 10m;
proxy_cache_valid 404 1m;
proxy_cache_use_stale error;
}
5、调大读写超时时长,
proxy_read_timeout 120s;
proxy_send_timeout 120s;

6、通过追加request header 向后端webserver传递 clientip
proxy_set_header Host $host;
proxy_set_header Real-Client-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
7、通过追加response header,在客户端方便查看当前活动nginx Server
add_header proxy-server $server_name;
8、在 webserver 的httpmodule 上 增加 “RServer”Responseheader,值为被调度到的WebServerName
HttpContext.Current.Response.AddHeader(“RServer”, HostName);

9、WebClinet–ssl–> Nginx –http–> WebServer
服务端代码重定向时 取相对路径
10、upstream NAME 命名为 域名,nginx 需要 使用 upstream NAME 访问 WebServer,sharepoint 对访问的 URL有限制
upstream workflow.clo.cn {
server 192.168.16.10 weight=2 max_fails=2 fail_timeout=10s;
server 192.168.16.11 weight=1 max_fails=2 fail_timeout=10s;
zone upstream_webgroup 1024k;
ip_hash;
}
11、定义向下一个WebServer调度的策略,
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504 http_403 http_404 http_429;
12、上传大小受限于以下参数
client_max_body_size 128m;
13、sharepoint 各个前端 web.config 的 machineKey 值一致,使调度到任意前端用户登录有效
<machineKey validationKey=”F68C11032A0FEA7BC535DCA20CD73059634B82193D5F087E” decryptionKey=”8FD256AFFE8CB4342E37DD7BAD7C4416A3FA586B6CBD717A” validation=”SHA1″ />

 

一  部署nginx

分别在node4(192.168.16.64),node5(192.168.16.65) 按 如下步奏部署nginx
 到www.nginx.org 下载 源码
 1、useradd -r nginx
 2、yum install pcre-devel
 3、yum install openssl-devel
 4、./configure --prefix=/usr/local/nginx --conf-path=/etc/nginx/nginx.conf --user=nginx --group=nginx --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx/nginx.pid --lock-path=/var/lock/nginx.lock --with-http_ssl_module --with-mail --with-debug --with-http_stub_status_module
 5、make && make install
 6、PATH=/usr/local/nginx:$PATH
 7、配置 /etc/nginx/nginx.conf,

—————————————–nginx.conf————————————————

#user nobody;
worker_processes 1;

#error_log logs/error.log;
#error_log logs/error.log notice;
#error_log logs/error.log info;

#pid logs/nginx.pid;

events {
worker_connections 1024;
}

http {
include mime.types;
default_type application/octet-stream;
client_max_body_size 128m;
client_header_buffer_size 16k;
large_client_header_buffers 4 16k;
sendfile on;
#keepalive_timeout 0;
keepalive_timeout 65;
add_header proxy-server $server_name;
proxy_cache_path /var/log/nginx/proxy-cache levels=2:2:2 keys_zone=proxy-cache:10m;
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504 http_403 http_404 http_429;
upstream 192.168.16.193 {
server 192.168.16.10 weight=2 max_fails=2 fail_timeout=10s;
server 192.168.16.11 weight=1 max_fails=2 fail_timeout=10s;
zone upstream_webgroup 1024k;
ip_hash;
}

#gzip on;
server {
server {
listen 80;
server_name proxy-server180;

location / {
rewrite ^(.*)$ https://$host$1 permanent;
#proxy_pass http://192.168.16.193;
}
}

# HTTPS server
server {
listen 443 ssl;
server_name proxy-server1 ;

ssl_certificate /etc/nginx/ssl/nginx.crt;
ssl_certificate_key /etc/nginx/ssl/nginx.key;

location / {
proxy_pass http://192.168.16.193;
proxy_read_timeout 120s;
proxy_send_timeout 120s;
proxy_set_header Host $host;
proxy_set_header Real-Client-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
location ~* \.(gif|jpg|jpeg|png|gif|css|js|html|htm)$ {
proxy_pass http://192.168.16.193;
proxy_cache proxy-cache;
proxy_cache_key $scheme$proxy_host$request_uri;
proxy_cache_valid 200 302 10m;
proxy_cache_valid 404 1m;
proxy_cache_use_stale error;
}
location /basic_status {
stub_status;
}
}
}

——————————————————————————————————

二 部署 keepalived

   node4(192.168.16.64)为masger,node5(192.168.16.65)为backup 
按 如下步奏部署keepalived
1、setenforce Permissive    //关闭SELinux
2、yum install keepalived
3、通过 vrrp_script 动态检测 nginx 进程判断主机健康状态,VIP:192.168.16.69
配置文件keepalived.conf 如下

———————————–keepalived.conf———————————————————-
! Configuration File for keepalived

global_defs {
notification_email {
suzb@clo.com.cn
}
notification_email_from keepalived@clo.com
smtp_server 192.268.101.12
smtp_connect_timeout 30
router_id node06
vrrp_mcast_group4 224.0.16.18
# vrrp_skip_check_adv_addr
# vrrp_strict
# vrrp_garp_interval 0
# vrrp_gna_interval 0
}

vrrp_script chk_httpd {
script “killall -0 nginx”
interval 2
weight -5
}

vrrp_instance VI_1 {
state MASTER|BACKUP
interface ens32
virtual_router_id 60
priority 100
advert_int 1
authentication {
auth_type PASS
auth_pass 123
}
virtual_ipaddress {
192.168.16.69/24 dev ens32
}
track_script
{
chk_httpd
}
notify_master “/etc/keepalived/keepalived-notify.sh master”
notify_backup “/etc/keepalived/keepalived-notify.sh backup”
notify_fault “/etc/keepalived/keepalived-notify.sh fault”
}

—————————————————————————————–

 

本文来自投稿,不代表Linux运维部落立场,如若转载,请注明出处:http://www.178linux.com/90439

(3)
N27_abaoN27_abao
上一篇 2017-12-19
下一篇 2017-12-20

相关推荐

  • 带你走进PI的世界-Raspbian Pi上实现LAMP

     初识   Raspbian PI                   前段时间,出于兴趣,入手一个树莓派(Raspbian PI…

    Linux干货 2016-01-05
  • 一个简单的负载均衡集群:web服务

    一个简单的负载均衡集群:以web服务为例 实验环境:三台主机(CentOS 7.3)             主机1:IP地址 172.18.0.88(Haproxy代理服务器)             主机2:IP地址 172.…

    Linux干货 2017-05-17
  • Linux Shell(脚本)编程入门

    为什么要进行shell编程 在Linux系统中,虽然有各种各样的图形化接口工具,但是sell仍然是一个非常灵活的工具。Shell不仅仅是命令的收集,而且是一门非常棒的编程语言。您可以通过使用shell使大量的任务自动化,shell特别擅长系统管理任务,尤其适合那些易用性、可维护性和便携性比效率更重要的任务。 下面,让我们一起来看看shell是如何工作的: 建…

    Linux干货 2017-08-05
  • 第七周-磁盘管理、RAID及Shell脚本练习

    一、创建一个10G分区,并格式为ext4文件系统; (1)、 要求其block大小为2048, 预留空间百分比为2, 卷标为MYDATA, 默认挂载属性包含acl; (2)、挂载至/data/mydata目录,要求挂载时禁止程序自动运行,且不更新文件的访问时间戳; [root@N1 ~]# mkfs.ext4 -b 2048 -m 2 -L MYDATA /…

    Linux干货 2017-08-13
  • 【听说要写一篇文章,我觉得标题比较长的人一定特别帅。】

    我叫小问。 计划是学好马哥所教授的知识。 目标是找到一份好工作!

    Linux干货 2016-10-23
  • 18文本处理工具sed

    18文本处理工具sed     sed,全称Stream EDitor,是一种流编辑器,它一次处理一行内容,但是它构思巧妙,功能强大,是运维工作中必不可少的文本处理工具,也是因为这样,被称作文本处理三剑客之一。     sed在处理时,把当前处理的行李存储在临时缓冲区中,这个区域被称作“模式空间pa…

    Linux干货 2016-08-12