Haproxyインストール・設定

# パッケージインストール
sudo yum install haproxy
sudo yum install socat

# サービス起動、自動起動設定
sudo systemctl enable haproxy
systemctl list-unit-files | grep haproxy

# ststsのsocketを/run/haproxy配下に作成する場合且つ、centos7の場合に必要。/run(/var/run)はtmpfsになりました。
echo "d /run/haproxy 0755 haproxy haproxy" > /etc/tmpfiles.d/haproxy.conf

# ssl証明書用フォルダ作成
sudo mkdir /etc/haproxy/ssl
 
# ssl証明書
sudo vi /etc/haproxy/ssl/ssl.pem
 
# パーミッション確認
ls -l /etc/haproxy/ssl/ssl.pem
 
# errorページ作成
sudo mkdir /etc/haproxy/errors
sudo vi /etc/haproxy/errors/400.http
sudo vi /etc/haproxy/errors/403.http
sudo vi /etc/haproxy/errors/408.http
sudo vi /etc/haproxy/errors/500.http
sudo vi /etc/haproxy/errors/502.http
sudo vi /etc/haproxy/errors/503.http
sudo vi /etc/haproxy/errors/504.http

# haproxy用のログディレクトリ作成
sudo mkdir /var/log/haproxy
 
# rsyslog用のhaproxyのsocketフォルダ作成
mkdir /var/lib/haproxy/dev/
 
# haproxyのログをrsyslog経由で/var/log/haproxyフォルダへ流すために設定
sudo vi /etc/rsyslog.d/49-haproxy.conf
 
# haproxyのconf作成
sudo vi /etc/haproxy/haproxy.cfg
 
# haproxyのsockファイル用ディレクトリ作成、権限変更
mkdir /run/haproxy
sudo chown haproxy:haproxy /run/haproxy
ls -ld /run/haproxy
 
# rsyslog 再起動
sudo systemctl restart rsyslog
 
# haproxy 再起動
sudo systemctl restart haproxy
 
# ログローテート設定
sudo vi /etc/logrotate.d/haproxy
  
# socat確認
sudo -i
echo "show info" |socat /run/haproxy/admin.sock stdio
 
# maxconn確認
echo "show info" |socat /run/haproxy/admin.sock stdio |grep Maxconn
 
# ステータス確認
sudo systemctl status haproxy
sudo systemctl status rsyslog
 
## cluster
# 記載無い場合、1,2号機に実施
# /etc/hosts 追記
1号機のIP 1号機のサーバ名
2号機のIP 2号機のサーバ名
 
※1,2号間のsgが、anyで空いてる事(tcp/udp)

クラスタ設定

# インストール
yum install pcs
passwd hacluster
service pcsd start
systemctl enable pcsd
 
★1号機のみ実施
pcs cluster auth 1号機のサーバ名 2号機のサーバ名
★1号機のみ実施
pcs cluster setup --start --enable --name クラスタ用サーバ名 1号機のサーバ名 2号機のサーバ名 --token 27000 --consensus 33000 --transport=udpu
★1号機のみ実施
pcs cluster status
★1号機のみ実施
pcs property set stonith-enabled="false" no-quorum-policy="ignore" default-action-timeout="240s" symmetric-cluster=true
★1号機のみ実施
pcs resource defaults resource-stickiness=INFINITY migration-threshold="1"
★1号機のみ実施
pcs cluster cib /root/output.cib
★1号機のみ実施
pcs -f /root/output.cib resource create res_haproxy systemd:haproxy
★1号機のみ実施
pcs -f /root/output.cib resource create res_vip ocf:heartbeat:IPaddr2 ip="vipのIPアドレス" cidr_netmask="32" nic="ens192" op start timeout="20s" on-fail="restart" op stop timeout="20s" on-fail="block" op monitor interval="60s" on-fail="restart"
★1号機のみ実施
pcs -f /root/output.cib constraint order start res_vip then res_haproxy kind=Optional
★1号機のみ実施
pcs -f /root/output.cib constraint colocation add res_haproxy with res_vip
★1号機のみ実施
pcs status resources
★1号機のみ実施
pcs cluster cib-push /root/output.cib
★1号機のみ実施
pcs status

/etc/haproxy/haproxy.cfg

global
log /dev/log local0
log /dev/log local1 notice
chroot /var/lib/haproxy
pidfile /var/run/haproxy.pid
stats socket /run/haproxy/admin.sock mode 660 level admin
stats timeout 30s
# SSL鍵長
tune.ssl.default-dh-param 2048
user haproxy
group haproxy
daemon
 
Default SSL material locations
ca-base /etc/ssl/certs
crt-base /etc/ssl/private
Default ciphers to use on SSL-enabled listening sockets.
For more information, see ciphers(1SSL). This list is from:
https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
ssl-default-bind-options no-sslv3
maxconn 49152
defaults
log global
mode http
option httplog
option dontlognull
option forwardfor except 127.0.0.1
timeout connect 5000
timeout client 1000000
timeout server 1000000
errorfile 400 /etc/haproxy/errors/400.http
errorfile 403 /etc/haproxy/errors/403.http
errorfile 408 /etc/haproxy/errors/408.http
errorfile 500 /etc/haproxy/errors/500.http
errorfile 502 /etc/haproxy/errors/502.http
errorfile 503 /etc/haproxy/errors/503.http
errorfile 504 /etc/haproxy/errors/504.http
stats page
listen stats
bind *:50000 ssl crt /etc/haproxy/ssl/ssl.pem
mode http
stats enable
stats hide-version
stats uri /stats
stats realm Haproxy\ Statistics
stats auth aeonlink:j6VZLsWy
frontend web_lb_http
bind *:80
mode http
maxconn 16384
redirect scheme https code 301 if !{ ssl_fc }
redirect scheme https if !{ ssl_fc }
frontend web_lb
bind *:80
bind *:443 ssl crt /etc/haproxy/ssl/ssl.pem
mode http
option http-server-close
maxconn 16384
### saml ###
acl saml_dir path_beg /simplesaml
acl saml_php path_beg /saml.php
acl login_php path_beg /login.php
use_backend web_connect_https if saml_dir or saml_php or login_php
### CMS000 ###
acl cms000_dst hdr(host) -i storeadmin.e-aeon.com
use_backend backend-cms000 if cms000_dst
### web100 ###
acl web100_dst hdr(host) -i storepost.e-aeon.com
use_backend backend-web100 if web100_dst
### api000 ###
acl api000_dst hdr(host) -i storeapi.e-aeon.com
use_backend backend-api000 if api000_dst
# default_backend web_connect_http
backend backend-cms000
mode http
fullconn 16384
balance roundrobin
cookie cms insert
option httpchk GET /check.html
http-check expect string ok
timeout check 10000
server cms001 cms1号機のIP:80 maxconn 8192 inter 10000 rise 3 fall 4 check cookie cms001
server cms002 cms2号機のIP:80 maxconn 8192 inter 10000 rise 3 fall 4 check cookie cms002
backend backend-web100
mode http
fullconn 16384
balance roundrobin
cookie web insert
option httpchk GET /check.php
http-check expect string ok
timeout check 10000
server web101 web1号機のIP:80 maxconn 8192 inter 10000 rise 3 fall 4 check cookie web101
server web102 web2号機のIP:80 maxconn 8192 inter 10000 rise 3 fall 4 check cookie web102
backend backend-api000
mode http
fullconn 16384
balance roundrobin
option httpchk GET /check.php
http-check expect string ok
timeout check 10000
server api001 api1号機のIP:80 maxconn 8192 inter 10000 rise 3 fall 4 check
server api002 api2号機のIP:80 maxconn 8192 inter 10000 rise 3 fall 4 check

/etc/rsyslog.d/49-haproxy.conf

Create an additional socket in haproxy's chroot in order to allow logging via
/dev/log to chroot'ed HAProxy processes
$AddUnixListenSocket /var/lib/haproxy/dev/log
Send HAProxy messages to a dedicated logfile
if $programname startswith 'haproxy' then /var/log/haproxy/haproxy.log
& stop

/etc/tmpfiles.d/haproxy.conf
d /run/haproxy 0755 haproxy haproxy

logrotate実行

/etc/logrotate.d/haproxy
test実行
logrotate -dv /etc/logrotate.d/haproxy
実行
logrotate -f /etc/logrotate.conf
logroateの実行status確認
cat /var/lib/logrotate/logrotate.status
ls でlog確認
/etc/logrotate.d/corosync
/var/log/cluster/corosync.log {
missingok
compress
copytruncate
daily
rotate 30
minsize 2048
notifempty
}


/etc/logrotate.d/pacemaker
/var/log/pacemaker.log {
compress
dateext
weekly
rotate 30
maxage 365
notifempty
missingok
copytruncate
}


/etc/logrotate.d/haproxy
/var/log/haproxy/haproxy.log {
daily
rotate 30
missingok
notifempty
compress
delaycompress
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
/bin/kill -HUP `cat /var/run/rsyslogd.pid 2> /dev/null` 2> /dev/null || true
endscript
}

statsで状態確認
https://haproxyのvip:50000/stats