keepalived+nginx 实现 sharepoint 负载均衡

keepalived 实现虚拟路由
nginx 做反向代理和负载均衡

要点
1、ssl代理
ssl_certificate /etc/nginx/ssl/nginx.crt;
ssl_certificate_key /etc/nginx/ssl/nginx.key;
2、访问http时重定向的https
server {
listen 80;
server_name proxy-server180;
location / {
rewrite ^(.*)$ https://$host$1 permanent;
#proxy_pass http://192.168.16.193;
}
}
3、nginx 状态
location /basic_status {
stub_status;
}
4、图片和html页面缓存
location ~* \.(gif|jpg|jpeg|png|gif|css|js|html|htm)$ {
proxy_pass http://192.168.16.193;
proxy_cache proxy-cache;
proxy_cache_key $scheme$proxy_host$request_uri;
proxy_cache_valid 200 302 10m;
proxy_cache_valid 404 1m;
proxy_cache_use_stale error;
}
5、调大读写超时时长,
proxy_read_timeout 120s;
proxy_send_timeout 120s;

6、通过追加request header 向后端webserver传递 clientip
proxy_set_header Host $host;
proxy_set_header Real-Client-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
7、通过追加response header,在客户端方便查看当前活动nginx Server
add_header proxy-server $server_name;
8、在 webserver 的httpmodule 上 增加 “RServer”Responseheader,值为被调度到的WebServerName
HttpContext.Current.Response.AddHeader(“RServer”, HostName);

9、WebClinet–ssl–> Nginx –http–> WebServer
服务端代码重定向时 取相对路径
10、upstream NAME 命名为 域名,nginx 需要 使用 upstream NAME 访问 WebServer,sharepoint 对访问的 URL有限制
upstream workflow.clo.cn {
server 192.168.16.10 weight=2 max_fails=2 fail_timeout=10s;
server 192.168.16.11 weight=1 max_fails=2 fail_timeout=10s;
zone upstream_webgroup 1024k;
ip_hash;
}
11、定义向下一个WebServer调度的策略,
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504 http_403 http_404 http_429;
12、上传大小受限于以下参数
client_max_body_size 128m;
13、sharepoint 各个前端 web.config 的 machineKey 值一致,使调度到任意前端用户登录有效
<machineKey validationKey=”F68C11032A0FEA7BC535DCA20CD73059634B82193D5F087E” decryptionKey=”8FD256AFFE8CB4342E37DD7BAD7C4416A3FA586B6CBD717A” validation=”SHA1″ />

 

一  部署nginx

—————————————–nginx.conf————————————————

#user nobody;
worker_processes 1;

#error_log logs/error.log;
#error_log logs/error.log notice;
#error_log logs/error.log info;

#pid logs/nginx.pid;

events {
worker_connections 1024;
}

http {
include mime.types;
default_type application/octet-stream;
client_max_body_size 128m;
client_header_buffer_size 16k;
large_client_header_buffers 4 16k;
sendfile on;
#keepalive_timeout 0;
keepalive_timeout 65;
add_header proxy-server $server_name;
proxy_cache_path /var/log/nginx/proxy-cache levels=2:2:2 keys_zone=proxy-cache:10m;
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504 http_403 http_404 http_429;
upstream 192.168.16.193 {
server 192.168.16.10 weight=2 max_fails=2 fail_timeout=10s;
server 192.168.16.11 weight=1 max_fails=2 fail_timeout=10s;
zone upstream_webgroup 1024k;
ip_hash;
}

#gzip on;
server {
server {
listen 80;
server_name proxy-server180;

location / {
rewrite ^(.*)$ https://$host$1 permanent;
#proxy_pass http://192.168.16.193;
}
}

# HTTPS server
server {
listen 443 ssl;
server_name proxy-server1 ;

ssl_certificate /etc/nginx/ssl/nginx.crt;
ssl_certificate_key /etc/nginx/ssl/nginx.key;

location / {
proxy_pass http://192.168.16.193;
proxy_read_timeout 120s;
proxy_send_timeout 120s;
proxy_set_header Host $host;
proxy_set_header Real-Client-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
location ~* \.(gif|jpg|jpeg|png|gif|css|js|html|htm)$ {
proxy_pass http://192.168.16.193;
proxy_cache proxy-cache;
proxy_cache_key $scheme$proxy_host$request_uri;
proxy_cache_valid 200 302 10m;
proxy_cache_valid 404 1m;
proxy_cache_use_stale error;
}
location /basic_status {
stub_status;
}
}
}

——————————————————————————————————

二 部署 keepalived

———————————–keepalived.conf———————————————————-
! Configuration File for keepalived

global_defs {
notification_email {
suzb@clo.com.cn
}
notification_email_from keepalived@clo.com
smtp_server 192.268.101.12
smtp_connect_timeout 30
router_id node06
vrrp_mcast_group4 224.0.16.18
# vrrp_skip_check_adv_addr
# vrrp_strict
# vrrp_garp_interval 0
# vrrp_gna_interval 0
}

vrrp_script chk_httpd {
script “killall -0 nginx”
interval 2
weight -5
}

vrrp_instance VI_1 {
state MASTER|BACKUP
interface ens32
virtual_router_id 60
priority 100
advert_int 1
authentication {
auth_type PASS
auth_pass 123
}
virtual_ipaddress {
192.168.16.69/24 dev ens32
}
track_script
{
chk_httpd
}
notify_master “/etc/keepalived/keepalived-notify.sh master”
notify_backup “/etc/keepalived/keepalived-notify.sh backup”
notify_fault “/etc/keepalived/keepalived-notify.sh fault”
}

—————————————————————————————–

 

本文来自投稿,不代表Linux运维部落立场,如若转载,请注明出处:http://www.178linux.com/90439

联系我们

400-080-6560

在线咨询

工作时间:周一至周五,9:30-18:30,节假日同时也值班

QR code