LoginSignup
1
2

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?

More than 5 years have passed since last update.

@y-araki-qiita(yu araki)

Haproxyをクラスタ構成で構築 (CentOS7)

Last updated at Posted at 2019-06-16

構成
LB: Haproxy 1・2号機
バック: cmsサーバ 1・2号機、webサーバ1・2号機、apiサーバ 1・2号機

Haproxyをクラスタで構築して、80番で配下のサーバにそれぞれ負荷分散させます。
Haproxyは証明書を置いて443番で接続です。

CentOS7での検証手順です。細かい設定はあくまで例で、設定ファイルは下のほうに載せています。ログの設定なんかもやってます。やっぱりログローテート大事だし。

Haproxyインストール・設定

# パッケージインストール
sudo yum install haproxy
sudo yum install socat

# サービス起動、自動起動設定
sudo systemctl enable haproxy
systemctl list-unit-files | grep haproxy

# ststsのsocketを/run/haproxy配下に作成する場合且つ、centos7の場合に必要。/run(/var/run)はtmpfsになりました。
echo "d /run/haproxy 0755 haproxy haproxy" > /etc/tmpfiles.d/haproxy.conf

# ssl証明書用フォルダ作成
sudo mkdir /etc/haproxy/ssl
 
# ssl証明書
sudo vi /etc/haproxy/ssl/ssl.pem
 
# パーミッション確認
ls -l /etc/haproxy/ssl/ssl.pem
 
# errorページ作成
sudo mkdir /etc/haproxy/errors
sudo vi /etc/haproxy/errors/400.http
sudo vi /etc/haproxy/errors/403.http
sudo vi /etc/haproxy/errors/408.http
sudo vi /etc/haproxy/errors/500.http
sudo vi /etc/haproxy/errors/502.http
sudo vi /etc/haproxy/errors/503.http
sudo vi /etc/haproxy/errors/504.http

# haproxy用のログディレクトリ作成
sudo mkdir /var/log/haproxy
 
# rsyslog用のhaproxyのsocketフォルダ作成
mkdir /var/lib/haproxy/dev/
 
# haproxyのログをrsyslog経由で/var/log/haproxyフォルダへ流すために設定
sudo vi /etc/rsyslog.d/49-haproxy.conf
 
# haproxyのconf作成
sudo vi /etc/haproxy/haproxy.cfg
 
# haproxyのsockファイル用ディレクトリ作成、権限変更
mkdir /run/haproxy
sudo chown haproxy:haproxy /run/haproxy
ls -ld /run/haproxy
 
# rsyslog 再起動
sudo systemctl restart rsyslog
 
# haproxy 再起動
sudo systemctl restart haproxy
 
# ログローテート設定
sudo vi /etc/logrotate.d/haproxy
  
# socat確認
sudo -i
echo "show info" |socat /run/haproxy/admin.sock stdio
 
# maxconn確認
echo "show info" |socat /run/haproxy/admin.sock stdio |grep Maxconn
 
# ステータス確認
sudo systemctl status haproxy
sudo systemctl status rsyslog
 
## cluster
# 記載無い場合、1,2号機に実施
# /etc/hosts 追記
1号機のIP 1号機のサーバ名
2号機のIP 2号機のサーバ名
 
※1,2号間のsgが、anyで空いてる事(tcp/udp)

クラスタ設定

# インストール
yum install pcs
passwd hacluster
service pcsd start
systemctl enable pcsd
 
★1号機のみ実施
pcs cluster auth 1号機のサーバ名 2号機のサーバ名
★1号機のみ実施
pcs cluster setup --start --enable --name クラスタ用サーバ名 1号機のサーバ名 2号機のサーバ名 --token 27000 --consensus 33000 --transport=udpu
★1号機のみ実施
pcs cluster status
★1号機のみ実施
pcs property set stonith-enabled="false" no-quorum-policy="ignore" default-action-timeout="240s" symmetric-cluster=true
★1号機のみ実施
pcs resource defaults resource-stickiness=INFINITY migration-threshold="1"
★1号機のみ実施
pcs cluster cib /root/output.cib
★1号機のみ実施
pcs -f /root/output.cib resource create res_haproxy systemd:haproxy
★1号機のみ実施
pcs -f /root/output.cib resource create res_vip ocf:heartbeat:IPaddr2 ip="vipのIPアドレス" cidr_netmask="32" nic="ens192" op start timeout="20s" on-fail="restart" op stop timeout="20s" on-fail="block" op monitor interval="60s" on-fail="restart"
★1号機のみ実施
pcs -f /root/output.cib constraint order start res_vip then res_haproxy kind=Optional
★1号機のみ実施
pcs -f /root/output.cib constraint colocation add res_haproxy with res_vip
★1号機のみ実施
pcs status resources
★1号機のみ実施
pcs cluster cib-push /root/output.cib
★1号機のみ実施
pcs status

/etc/haproxy/haproxy.cfg

global
log /dev/log local0
log /dev/log local1 notice
chroot /var/lib/haproxy
pidfile /var/run/haproxy.pid
stats socket /run/haproxy/admin.sock mode 660 level admin
stats timeout 30s
# SSL鍵長
tune.ssl.default-dh-param 2048
user haproxy
group haproxy
daemon
 
Default SSL material locations
ca-base /etc/ssl/certs
crt-base /etc/ssl/private
Default ciphers to use on SSL-enabled listening sockets.
For more information, see ciphers(1SSL). This list is from:
https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
ssl-default-bind-options no-sslv3
maxconn 49152
defaults
log global
mode http
option httplog
option dontlognull
option forwardfor except 127.0.0.1
timeout connect 5000
timeout client 1000000
timeout server 1000000
errorfile 400 /etc/haproxy/errors/400.http
errorfile 403 /etc/haproxy/errors/403.http
errorfile 408 /etc/haproxy/errors/408.http
errorfile 500 /etc/haproxy/errors/500.http
errorfile 502 /etc/haproxy/errors/502.http
errorfile 503 /etc/haproxy/errors/503.http
errorfile 504 /etc/haproxy/errors/504.http
stats page
listen stats
bind *:50000 ssl crt /etc/haproxy/ssl/ssl.pem
mode http
stats enable
stats hide-version
stats uri /stats
stats realm Haproxy\ Statistics
stats auth aeonlink:j6VZLsWy
frontend web_lb_http
bind *:80
mode http
maxconn 16384
redirect scheme https code 301 if !{ ssl_fc }
redirect scheme https if !{ ssl_fc }
frontend web_lb
bind *:80
bind *:443 ssl crt /etc/haproxy/ssl/ssl.pem
mode http
option http-server-close
maxconn 16384
### saml ###
acl saml_dir path_beg /simplesaml
acl saml_php path_beg /saml.php
acl login_php path_beg /login.php
use_backend web_connect_https if saml_dir or saml_php or login_php
### CMS000 ###
acl cms000_dst hdr(host) -i storeadmin.e-aeon.com
use_backend backend-cms000 if cms000_dst
### web100 ###
acl web100_dst hdr(host) -i storepost.e-aeon.com
use_backend backend-web100 if web100_dst
### api000 ###
acl api000_dst hdr(host) -i storeapi.e-aeon.com
use_backend backend-api000 if api000_dst
# default_backend web_connect_http
backend backend-cms000
mode http
fullconn 16384
balance roundrobin
cookie cms insert
option httpchk GET /check.html
http-check expect string ok
timeout check 10000
server cms001 cms1号機のIP:80 maxconn 8192 inter 10000 rise 3 fall 4 check cookie cms001
server cms002 cms2号機のIP:80 maxconn 8192 inter 10000 rise 3 fall 4 check cookie cms002
backend backend-web100
mode http
fullconn 16384
balance roundrobin
cookie web insert
option httpchk GET /check.php
http-check expect string ok
timeout check 10000
server web101 web1号機のIP:80 maxconn 8192 inter 10000 rise 3 fall 4 check cookie web101
server web102 web2号機のIP:80 maxconn 8192 inter 10000 rise 3 fall 4 check cookie web102
backend backend-api000
mode http
fullconn 16384
balance roundrobin
option httpchk GET /check.php
http-check expect string ok
timeout check 10000
server api001 api1号機のIP:80 maxconn 8192 inter 10000 rise 3 fall 4 check
server api002 api2号機のIP:80 maxconn 8192 inter 10000 rise 3 fall 4 check

/etc/rsyslog.d/49-haproxy.conf

Create an additional socket in haproxy's chroot in order to allow logging via
/dev/log to chroot'ed HAProxy processes
$AddUnixListenSocket /var/lib/haproxy/dev/log
Send HAProxy messages to a dedicated logfile
if $programname startswith 'haproxy' then /var/log/haproxy/haproxy.log
& stop

/etc/tmpfiles.d/haproxy.conf
d /run/haproxy 0755 haproxy haproxy

logrotate実行

/etc/logrotate.d/haproxy
test実行
logrotate -dv /etc/logrotate.d/haproxy
実行
logrotate -f /etc/logrotate.conf
logroateの実行status確認
cat /var/lib/logrotate/logrotate.status
ls でlog確認
/etc/logrotate.d/corosync
/var/log/cluster/corosync.log {
missingok
compress
copytruncate
daily
rotate 30
minsize 2048
notifempty
}


/etc/logrotate.d/pacemaker
/var/log/pacemaker.log {
compress
dateext
weekly
rotate 30
maxage 365
notifempty
missingok
copytruncate
}


/etc/logrotate.d/haproxy
/var/log/haproxy/haproxy.log {
daily
rotate 30
missingok
notifempty
compress
delaycompress
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
/bin/kill -HUP `cat /var/run/rsyslogd.pid 2> /dev/null` 2> /dev/null || true
endscript
}

statsで状態確認
https://haproxyのvip:50000/stats

1
2
0

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
Sign upLogin
1
2

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?