keepalived+nginx 实现 sharepoint 负载均衡

keepalived 实现虚拟路由
nginx 做反向代理和负载均衡

要点
1、ssl代理
ssl_certificate /etc/nginx/ssl/nginx.crt;
ssl_certificate_key /etc/nginx/ssl/nginx.key;
2、访问http时重定向的https
server {
listen 80;
server_name proxy-server180;
location / {
rewrite ^(.*)$ https://$host$1 permanent;
#proxy_pass http://192.168.16.193;
}
}
3、nginx 状态
location /basic_status {
stub_status;
}
4、图片和html页面缓存
location ~* \.(gif|jpg|jpeg|png|gif|css|js|html|htm)$ {
proxy_pass http://192.168.16.193;
proxy_cache proxy-cache;
proxy_cache_key $scheme$proxy_host$request_uri;
proxy_cache_valid 200 302 10m;
proxy_cache_valid 404 1m;
proxy_cache_use_stale error;
}
5、调大读写超时时长,
proxy_read_timeout 120s;
proxy_send_timeout 120s;

6、通过追加request header 向后端webserver传递 clientip
proxy_set_header Host $host;
proxy_set_header Real-Client-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
7、通过追加response header,在客户端方便查看当前活动nginx Server
add_header proxy-server $server_name;
8、在 webserver 的httpmodule 上 增加 “RServer”Responseheader,值为被调度到的WebServerName
HttpContext.Current.Response.AddHeader(“RServer”, HostName);

9、WebClinet–ssl–> Nginx –http–> WebServer
服务端代码重定向时 取相对路径
10、upstream NAME 命名为 域名,nginx 需要 使用 upstream NAME 访问 WebServer,sharepoint 对访问的 URL有限制
upstream workflow.clo.cn {
server 192.168.16.10 weight=2 max_fails=2 fail_timeout=10s;
server 192.168.16.11 weight=1 max_fails=2 fail_timeout=10s;
zone upstream_webgroup 1024k;
ip_hash;
}
11、定义向下一个WebServer调度的策略,
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504 http_403 http_404 http_429;
12、上传大小受限于以下参数
client_max_body_size 128m;
13、sharepoint 各个前端 web.config 的 machineKey 值一致,使调度到任意前端用户登录有效
<machineKey validationKey=”F68C11032A0FEA7BC535DCA20CD73059634B82193D5F087E” decryptionKey=”8FD256AFFE8CB4342E37DD7BAD7C4416A3FA586B6CBD717A” validation=”SHA1″ />

 

一  部署nginx

分别在node4(192.168.16.64),node5(192.168.16.65) 按 如下步奏部署nginx
 到www.nginx.org 下载 源码
 1、useradd -r nginx
 2、yum install pcre-devel
 3、yum install openssl-devel
 4、./configure --prefix=/usr/local/nginx --conf-path=/etc/nginx/nginx.conf --user=nginx --group=nginx --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx/nginx.pid --lock-path=/var/lock/nginx.lock --with-http_ssl_module --with-mail --with-debug --with-http_stub_status_module
 5、make && make install
 6、PATH=/usr/local/nginx:$PATH
 7、配置 /etc/nginx/nginx.conf,

—————————————–nginx.conf————————————————

#user nobody;
worker_processes 1;

#error_log logs/error.log;
#error_log logs/error.log notice;
#error_log logs/error.log info;

#pid logs/nginx.pid;

events {
worker_connections 1024;
}

http {
include mime.types;
default_type application/octet-stream;
client_max_body_size 128m;
client_header_buffer_size 16k;
large_client_header_buffers 4 16k;
sendfile on;
#keepalive_timeout 0;
keepalive_timeout 65;
add_header proxy-server $server_name;
proxy_cache_path /var/log/nginx/proxy-cache levels=2:2:2 keys_zone=proxy-cache:10m;
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504 http_403 http_404 http_429;
upstream 192.168.16.193 {
server 192.168.16.10 weight=2 max_fails=2 fail_timeout=10s;
server 192.168.16.11 weight=1 max_fails=2 fail_timeout=10s;
zone upstream_webgroup 1024k;
ip_hash;
}

#gzip on;
server {
server {
listen 80;
server_name proxy-server180;

location / {
rewrite ^(.*)$ https://$host$1 permanent;
#proxy_pass http://192.168.16.193;
}
}

# HTTPS server
server {
listen 443 ssl;
server_name proxy-server1 ;

ssl_certificate /etc/nginx/ssl/nginx.crt;
ssl_certificate_key /etc/nginx/ssl/nginx.key;

location / {
proxy_pass http://192.168.16.193;
proxy_read_timeout 120s;
proxy_send_timeout 120s;
proxy_set_header Host $host;
proxy_set_header Real-Client-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
location ~* \.(gif|jpg|jpeg|png|gif|css|js|html|htm)$ {
proxy_pass http://192.168.16.193;
proxy_cache proxy-cache;
proxy_cache_key $scheme$proxy_host$request_uri;
proxy_cache_valid 200 302 10m;
proxy_cache_valid 404 1m;
proxy_cache_use_stale error;
}
location /basic_status {
stub_status;
}
}
}

——————————————————————————————————

二 部署 keepalived

   node4(192.168.16.64)为masger,node5(192.168.16.65)为backup 
按 如下步奏部署keepalived
1、setenforce Permissive    //关闭SELinux
2、yum install keepalived
3、通过 vrrp_script 动态检测 nginx 进程判断主机健康状态,VIP:192.168.16.69
配置文件keepalived.conf 如下

———————————–keepalived.conf———————————————————-
! Configuration File for keepalived

global_defs {
notification_email {
suzb@clo.com.cn
}
notification_email_from keepalived@clo.com
smtp_server 192.268.101.12
smtp_connect_timeout 30
router_id node06
vrrp_mcast_group4 224.0.16.18
# vrrp_skip_check_adv_addr
# vrrp_strict
# vrrp_garp_interval 0
# vrrp_gna_interval 0
}

vrrp_script chk_httpd {
script “killall -0 nginx”
interval 2
weight -5
}

vrrp_instance VI_1 {
state MASTER|BACKUP
interface ens32
virtual_router_id 60
priority 100
advert_int 1
authentication {
auth_type PASS
auth_pass 123
}
virtual_ipaddress {
192.168.16.69/24 dev ens32
}
track_script
{
chk_httpd
}
notify_master “/etc/keepalived/keepalived-notify.sh master”
notify_backup “/etc/keepalived/keepalived-notify.sh backup”
notify_fault “/etc/keepalived/keepalived-notify.sh fault”
}

—————————————————————————————–

 

本文来自投稿,不代表Linux运维部落立场,如若转载,请注明出处:http://www.178linux.com/90439

(3)
N27_abaoN27_abao
上一篇 2017-12-19
下一篇 2017-12-20

相关推荐

  • 马哥教育网络班第19期+第7周课程练习

    1、创建一个10G分区,并格式为ext4文件系统; (1) 要求其block大小为2048, 预留空间百分比为2, 卷标为MYDATA, 默认挂载属性包含acl; (2) 挂载至/data/mydata目录,要求挂载时禁止程序自动运行,且不更新文件的访问时间戳; 2、创建一个大小为1G的swap分区,并创建好文件系统,并启用之; 3、写一个脚本  …

    Linux干货 2016-08-08
  • linux的发展史

                  linux的发展史     1  Linux的诞生:    1988年:芬兰赫尔辛基大学迎来一位新生-linus benedict torvalds (后面简称linus)   2 &nbsp…

    Linux干货 2016-10-19
  • N21天天第十六周课程练习

    1、源码编译安装LNMP架构环境; 一、安装Nginx 1、解决依赖 [root@localhost ~]# yum groupinstall 开发工具 服务器平台开发 -y 2、安装 [root@localhost ~]# tar xf pcre-8.37.…

    Linux干货 2016-12-14
  • iptables初探

    iptables 简述 基础知识 命令使用 简述 iptables是什么?netfilter又是什么? iptables是位于用户控件的一个防火墙规则控制管理工具。netfilter是位于内核中的真正的防火墙,由五个钩子函数(hooks)而组成。 iptables的作用是什么? 用来添加,删除,管理netfilter规则。 netfilter的作用是什么? …

    2016-05-31
  • 常见RAID总结

    RAID浅析 目录索引 一、定义 二、特点 三、常用RAID级别      四、RAID实现方式 五、实际环境测试 一、定义: 磁盘阵列(Redundant Arrays of Independent Disks,RAID),有“独立磁盘构成的具有冗余能力的阵列”之意。 独立磁盘冗余阵列(RAID,redundant array…

    Linux干货 2016-04-12
  • 文本处理工具之awk

                    文本处理工具之AWK 一、linux文本处理工具三剑客:grep 、sed、 awk。其中grep是一种文本过滤器,sed是文本行编辑器,而awk是一种报表生成器,就是对文件进行…

    2017-05-21