IT数码 购物 网址 头条 软件 日历 阅读 图书馆
TxT小说阅读器
↓语音阅读,小说下载,古典文学↓
图片批量下载器
↓批量下载图片,美女图库↓
图片自动播放器
↓图片自动播放器↓
一键清除垃圾
↓轻轻一点,清除系统垃圾↓
开发: C++知识库 Java知识库 JavaScript Python PHP知识库 人工智能 区块链 大数据 移动开发 嵌入式 开发工具 数据结构与算法 开发测试 游戏开发 网络协议 系统运维
教程: HTML教程 CSS教程 JavaScript教程 Go语言教程 JQuery教程 VUE教程 VUE3教程 Bootstrap教程 SQL数据库教程 C语言教程 C++教程 Java教程 Python教程 Python3教程 C#教程
数码: 电脑 笔记本 显卡 显示器 固态硬盘 硬盘 耳机 手机 iphone vivo oppo 小米 华为 单反 装机 图拉丁
 
   -> 系统运维 -> 高可用nginx反向代理 -> 正文阅读

[系统运维]高可用nginx反向代理

高可用nginx反向代理

nginx反向代理简介

代理服务器是位于客户端和原始服务器的一台中间服务器,为了从原始服务器获取到内容,客户端向代理服务器发送一个请求并带上目标服务器(原始服务器),代理服务器在接收到请求后就会将请求转发给原始服务器,并将从原始服务器上获取到的数据返回给客户端,代理服务器是代理的客户端,所以一般客户端是知道代理服务器的存在的,比如翻墙就用了代理服务器。

反向代理服务器是位于原始服务器端的服务器,反向代理服务器接受来自互联网的请求,然后将这些请求发送给内网的服务器,并将从内网的服务器获取结果返回给互联网上的客户端,反向代理服务器是代理的服务端,所以客户端是不知道反向代理服务器的存在的,服务端是知道反向代理服务器的。

代理服务器的作用

  1. 访问原来无法访问的资源
  2. 用作缓存,加速访问速度
  3. 对客户端访问授权,上网进行认证
  4. 代理可以记录用户访问记录(上网行为管理),对外隐藏用户信息

反向代理服务器的作用

  1. 保护内网安全
  2. 负载均衡
  3. 缓存,减少服务器的压力

nginx的作用

1.反向代理,将多台服务器代理成一台服务器

2.负载均衡,将多个请求均匀的分配到多台服务器上,减轻每台服务器的压力,提高服务的吞吐量

3.动静分离,nginx可以用作静态文件的缓存服务器,提高访问速度

nginx反向代理的配置

配置环境

系统ip服务主机名
centos8192.168.171.133nginx(负载均衡调度器)localhost
centos8192.168.171.142nginx(网站服务)RS1
centos8192.168.171.141apache(网站服务)RS2

RS1配置

//关闭防火墙和selinux
[root@RS1 ~]# systemctl disable --now firewalld.service 
Removed /etc/systemd/system/multi-user.target.wants/firewalld.service.
Removed /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
[root@RS1 ~]# setenforce 0
[root@RS1 ~]# sed -ri 's/^(SELINUX=).*/\1disabled/g' /etc/selinux/config

//下载网页服务nginx
[root@RS1 ~]# dnf -y install nginx

//配置测试网站
[root@RS1 ~]# cd /usr/share/nginx/html/
[root@RS1 html]# ls
404.html  50x.html  index.html  nginx-logo.png  poweredby.png
[root@RS1 html]# echo "nginx" >index.html
[root@RS1 html]# systemctl restart nginx.service 
[root@RS1 html]# systemctl enable nginx.service 
[root@RS1 html]# ss -antl | grep 80
LISTEN 0      128          0.0.0.0:80        0.0.0.0:*          
LISTEN 0      128             [::]:80           [::]:*          

RS2配置

//关闭防火墙selinux
[root@RS2 ~]# systemctl disable --now firewalld.service 
Removed /etc/systemd/system/multi-user.target.wants/firewalld.service.
Removed /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
[root@RS2 ~]# setenforce 0
[root@RS2 ~]# sed -ri 's/^(SELINUX=).*/\1disabled/g' /etc/selinux/config

//下载网页服务apache
[root@RS2 ~]# dnf -y install httpd

//配置测试网页
[root@RS2 ~]# echo "apache" >/var/www/html/index.html
[root@RS2 ~]# systemctl restart httpd
[root@RS2 ~]# systemctl enable httpd
Created symlink /etc/systemd/system/multi-user.target.wants/httpd.service → /usr/lib/systemd/system/httpd.service.
[root@RS2 ~]# ss -antl | grep 80
LISTEN 0      128                *:80              *:*          

负载均衡调度器配置

//关闭防火墙和selinux
[root@localhost ~]# systemctl disable --now firewalld.service 
Removed /etc/systemd/system/multi-user.target.wants/firewalld.service.
Removed /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
[root@localhost ~]# setenforce 0
[root@localhost ~]#  sed -ri 's/^(SELINUX=).*/\1disabled/g' /etc/selinux/config

//下载nginx服务,做反向代理。
[root@localhost ~]# dnf -y install nginx
[root@localhost ~]# cd /etc/nginx/
[root@localhost nginx]# vi nginx.conf

//配置反向代理
    upstream webserver {
        server 192.168.171.141;  #这里写RS1的ip也就是提供服务那台主机的ip
        server 192.168.171.142;  #与上面同理,相当于RS2的ip 
    }

    server {
        listen       80;
        server_name  _;
        root         /usr/share/nginx/html;

        location / {
            proxy_pass http://webserver;  #代理转发到这里。这里的webserver就相当于(192.168.171.141,或者192.168.171.142).
        }
[root@localhost ~]# systemctl enable --now nginx.service 

访问测试

[root@localhost ~]# curl 192.168.171.133
apache
[root@localhost ~]# curl 192.168.171.133
nginx
[root@localhost ~]# curl 192.168.171.133
apache
[root@localhost ~]# curl 192.168.171.133
nginx
[root@localhost ~]# curl 192.168.171.133
apache

高可用nginx反向代理

配置环境:

系统ip服务主机名
centos8192.168.171.133nginx(负载均衡调度器 keepalived)KD1
centos8192.168.171.142nginx(网站服务)RS1
centos8192.168.171.141apache(网站服务)RS2
centos8192.168.171.150nginx(负载均衡调度器 keepalived)KD2

RS1、RS2和上面配置一样保持不变

虚拟vip:192.168.171.250

配置KD1

//下载高可用的服务。
[root@KD1 ~]# dnf -y install keepalived

//配置keepalived的配置文件
[root@KD1 ~]# cd  /etc/keepalived/
[root@KD1 keepalived]# ls
keepalived.conf
[root@KD1 keepalived]# mv keepalived.conf keepalived.conf-bek
[root@KD1 keepalived]# ls
keepalived.conf-bek
[root@KD1 keepalived]# vi keepalived.conf
! Configuration File for keepalived

global_defs {
   router_id lb01
}

vrrp_instance VI_1 {
    state MASTER
    interface ens33          #这里的网课名称一定要和主机的网卡名称一致
    virtual_router_id 51
    priority 100
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass nuanchun   #两台主机的keepalived服务的密码要一致
    }
    virtual_ipaddress {
        192.168.171.250      #虚拟IP也要一致
    }
}

virtual_server 192.168.171.250 80 {
    delay_loop 6
    lb_algo rr
    lb_kind DR
    persistence_timeout 50
    protocol TCP

    real_server 192.168.171.133 80 {   #这里需要写你负载均衡调度器的ip
        weight 1
        TCP_CHECK {
            connect_port 80
            connect_timeout 3
            nb_get_retry 3
            delay_before_retry 3
        }
    }

    real_server 192.168.171.150 80 {   #这里要写你高可用的另外一台主机的ip
        weight 1
        TCP_CHECK {
            connect_port 80
            connect_timeout 3
            nb_get_retry 3
            delay_before_retry 3
        }
    }
}

//重启服务,查看ip
[root@KD1 keepalived]# systemctl restart keepalived.service 
[root@KD1 keepalived]# systemctl enable keepalived.service 
[root@KD1 keepalived]# ip a | grep ens33
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    inet 192.168.171.133/24 brd 192.168.171.255 scope global noprefixroute ens33
    inet 192.168.171.250/32 scope global ens33

配置KD2

//关闭防火墙和selinux
[root@KD2 ~]# systemctl disable --now firewalld
Removed /etc/systemd/system/multi-user.target.wants/firewalld.service.
Removed /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
[root@KD2 ~]# setenforce 0
[root@KD2 ~]# sed -ri 's/^(SELINUX=).*/\1disabled/g' /etc/selinux/config


//KD2必须要和KD1的内容保持一致才能做高可用
[root@KD2 ~]# dnf -y install nginx

//在KD1上面把nginx.conf的配置文件cp到KD2上
[root@KD1 nginx]# scp nginx.conf 192.168.171.150:/etc/nginx/
The authenticity of host '192.168.171.150 (192.168.171.150)' can't be established.
ECDSA key fingerprint is SHA256:b2+ErORHLlANCY23XTlkC8uzQ6KKscSXnc5aIAK80dI.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.171.150' (ECDSA) to the list of known hosts.
root@192.168.171.150's password: 
nginx.conf                                                                                                                             100% 2529     1.5MB/s   00:00    
[root@KD1 nginx]# 

//看配置文件
[root@KD2 ~]# cat /etc/nginx/nginx.conf
    upstream webserver {
        server 192.168.171.141;
        server 192.168.171.142;
    }

    server {
        listen       80;
        server_name  _;
        root         /usr/share/nginx/html;

        location / {
            proxy_pass http://webserver;
        }

//下载keepalived高可用服务
[root@KD2 ~]# dnf -y install keepalived

//再把keepalived的配置文件备份一下
[root@KD2 ~]# cd /etc/keepalived/
[root@KD2 keepalived]# ls
keepalived.conf
[root@KD2 keepalived]# mv keepalived.conf keepalived.conf-bek
[root@KD2 keepalived]# ls
keepalived.conf-bek

//然后在把KD1上面的keepalived的配置文件scp过来
[root@KD1 keepalived]# scp keepalived.conf 192.168.171.150:/etc/keepalived/
root@192.168.171.150's password: 
keepalived.conf                                                   100%  870   556.4KB/s   00:00   
[root@KD2 keepalived]# cat keepalived.conf
! Configuration File for keepalived

global_defs {
   router_id lb02				#全局唯一的路由id
}

vrrp_instance VI_1 {
    state BACKUP
    interface ens33				#自己做高可用那台主机的ip
    virtual_router_id 51
    priority 90					#权重值90,需要比前面拿一台主机低.
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass nuanchun		#密码需要一致
    }
    virtual_ipaddress {
        192.168.171.250			#虚拟ip
    }
}

virtual_server 192.168.171.250 80 {
    delay_loop 6
    lb_algo rr
    lb_kind DR
    persistence_timeout 50
    protocol TCP

    real_server 192.168.171.133 80 {	#kD1服务器ip
        weight 1
        TCP_CHECK {
            connect_port 80
            connect_timeout 3
            nb_get_retry 3
            delay_before_retry 3
        }
    }

    real_server 192.168.171.150 80 {	#kD2服务器ip
        weight 1
        TCP_CHECK {
            connect_port 80
            connect_timeout 3
            nb_get_retry 3
            delay_before_retry 3
        }
    }
}
[root@KD2 keepalived]# systemctl restart keepalived
[root@KD2 keepalived]# systemctl status keepalived
● keepalived.service - LVS and VRRP High Availability Monitor
   Loaded: loaded (/usr/lib/systemd/system/keepalived.service; disabled; vendor preset: disabled)
   Active: active (running) since Mon 2022-10-17 04:54:18 EDT; 1min 26s ago
  Process: 79776 ExecStart=/usr/sbin/keepalived $KEEPALIVED_OPTIONS (code=exited, status=0/SUCCESS)
 Main PID: 79777 (keepalived)
    Tasks: 3 (limit: 23460)
   Memory: 2.0M
   CGroup: /system.slice/keepalived.service

访问测试

//用虚拟ip访问
[root@KD1 nginx]# cd /etc/keepalived/
[root@KD1 keepalived]# ls
[root@KD1 keepalived]# curl 192.168.171.250
nginx
[root@KD1 keepalived]# curl 192.168.171.250
apache
[root@KD1 keepalived]# curl 192.168.171.250
nginx
[root@KD1 keepalived]# curl 192.168.171.250
apache

//模拟KD1主机寄掉了,看会不会把从负载均衡调度器变成主
[root@KD1 keepalived]# systemctl stop nginx
[root@KD1 keepalived]# systemctl stop keepalived.service 
[root@KD1 keepalived]# ss -antl
State               Recv-Q              Send-Q                           Local Address:Port                           Peer Address:Port             Process              
LISTEN              0                   128                                    0.0.0.0:22                                  0.0.0.0:*                                     
LISTEN              0                   128                                       [::]:22                                     [::]:*                                     
[root@KD1 keepalived]# 

//在从主机上查看vip是否过去,可以看到vip已经起来了。
[root@KD2 keepalived]# ip a | grep ens33
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    inet 192.168.171.150/24 brd 192.168.171.255 scope global noprefixroute ens33
    inet 192.168.171.250/32 scope global ens33

[root@KD2 keepalived]# ss -antl
State               Recv-Q              Send-Q                           Local Address:Port                           Peer Address:Port             Process              
LISTEN              0                   128                                    0.0.0.0:22                                  0.0.0.0:*                                     
LISTEN              0                   128                                    0.0.0.0:80                                  0.0.0.0:*                                     
LISTEN              0                   128                                       [::]:22                                     [::]:*                                   


//在KD2上访问一下看看
[root@KD2 keepalived]# curl 192.168.171.250
apache
[root@KD2 keepalived]# curl 192.168.171.250
nginx
[root@KD2 keepalived]# curl 192.168.171.250
apache
[root@KD2 keepalived]# curl 192.168.171.250
nginx

高可用自动化转换主备节点

keepalived通过脚本来监控nginx负载均衡机的状态

在KD1上编写脚本

//创建一个放置脚本的目录用来写监控脚本的状态
[root@KD1 ~]# mkdir scripts 
[root@KD1 ~]# ls
anaconda-ks.cfg  scripts
[root@KD1 ~]# cd scripts/
[root@KD1 scripts]# ls
[root@KD1 scripts]# vi check_n.sh
#!/bin/bash

nginx_status=$(ps -ef|grep -Ev "grep|$0"|grep '\bnginx\b'|wc -l)
if [ $nginx_status -lt 1 ];then
    systemctl stop keepalived
fi

[root@KD1 scripts]# chmod +x check_n.sh 
[root@KD1 scripts]# ls

[root@KD1 scripts]# vi notify.sh
#!/bin/bash
VIP=$2
case "$1" in
  master)
        nginx_status=$(ps -ef|grep -Ev "grep|$0"|grep '\bnginx\b'|wc -l)
        if [ $nginx_status -lt 1 ];then
            systemctl start nginx
        fi
        sendmail
  ;;
  backup)
        nginx_status=$(ps -ef|grep -Ev "grep|$0"|grep '\bnginx\b'|wc -l)
        if [ $nginx_status -gt 0 ];then
            systemctl stop nginx
        fi
  ;;
  *)
        echo "Usage:$0 master|backup VIP"
  ;;
esac

[root@KD1 scripts]# chmod +x notify.sh 

//在配置文件里面引用脚本
! Configuration File for keepalived

global_defs {
   router_id lb01
}

vrrp_script nginx_check {
    script "/scripts/check_n.sh"	#这里是引用脚本的函数
    interval 1
    weight -20
}

vrrp_instance VI_1 {
    state MASTER
    interface ens33
    virtual_router_id 51
    priority 100
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass nuanchun
    }
    virtual_ipaddress {
        192.168.171.250
    }
    track_script {
        nginx_check			#引用检查nginx状态的脚本
    }
    notify_master "/scripts/notify.sh master 192.168.171.250"
    notify_backup "/scripts/notify.sh backup 192.168.171.250"
}
}							#引用切换主备节点的脚本

virtual_server 192.168.171.250 80 {
    delay_loop 6
    lb_algo rr
    lb_kind DR
    persistence_timeout 50
    protocol TCP

    real_server 192.168.171.133 80 {
        weight 1
        TCP_CHECK {
            connect_port 80
            connect_timeout 3
            nb_get_retry 3
            delay_before_retry 3
        }
    }

    real_server 192.168.171.150 80 {
        weight 1
        TCP_CHECK {
            connect_port 80
            connect_timeout 3
            nb_get_retry 3
            delay_before_retry 3
        }
    }
}

[root@KD1 scripts]# systemctl restart keepalived.service

[root@KD1 scripts]# ip a| grep ens33
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    inet 192.168.171.133/24 brd 192.168.171.255 scope global noprefixroute ens33
    inet 192.168.171.250/32 scope global ens33

配置KD2

//先创建一个防止脚本的目录
[root@KD2 ~]# mkdir srcipts
[root@KD2 ~]# cd srcipts/

//把脚本从KD1上面scp过来
[root@KD1 scripts]# scp notify.sh 192.168.171.150:srcipts
root@192.168.171.150's password: 
notify.sh                                                                                                                              100%  451   247.4KB/s   00:00    
[root@KD2 srcipts]# ls
notify.sh
[root@KD2 srcipts]# 

//在备KD2上配置引用脚本的配置文件。
[root@KD2 srcipts]# cat /etc/keepalived/keepalived.conf
! Configuration File for keepalived

global_defs {
   router_id lb02
}

vrrp_instance VI_1 {
    state BACKUP
    interface ens33
    virtual_router_id 51
    priority 90
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass nuanchun
    }
    virtual_ipaddress {
        192.168.171.250
    }
    notify_master "/scripts/notify.sh master 192.168.171.250"
    notify_backup "/scripts/notify.sh backup 192.168.171.250"
}						#这里就是引用刚刚传过来的脚本

virtual_server 192.168.171.250 80 {
    delay_loop 6
    lb_algo rr
    lb_kind DR
    persistence_timeout 50
    protocol TCP

    real_server 192.168.171.133 80 {
        weight 1
        TCP_CHECK {
            connect_port 80
            connect_timeout 3
            nb_get_retry 3
            delay_before_retry 3
        }
    }

    real_server 192.168.171.150 80 {
        weight 1
        TCP_CHECK {
            connect_port 80
            connect_timeout 3
            nb_get_retry 3
            delay_before_retry 3
        }
    }
}
[root@KD2 srcipts]# systemctl restart keepalived

测试访问

//此时可以看到KD1的vip和80端口都是起来的,把KD1的nginx停掉模拟出故障
[root@KD1 ~]# ip a | grep ens33
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    inet 192.168.171.133/24 brd 192.168.171.255 scope global noprefixroute ens33
    inet 192.168.171.250/32 scope global ens33
[root@KD1 ~]# 
[root@KD1 ~]# ss -antl | grep 80
LISTEN 0      128          0.0.0.0:80        0.0.0.0:*          
[root@KD1 ~]# 
[root@KD1 ~]# systemctl stop nginx
[root@KD1 ~]# systemctl status keepalived.service
● keepalived.service - LVS and VRRP High Availability Monitor
   Loaded: loaded (/usr/lib/systemd/system/keepalived.service; enabled; vendor preset: disabled)
   Active: inactive (dead) since Tue 2022-10-18 05:11:21 EDT; 943ms ago
  Process: 112308 ExecReload=/bin/kill -HUP $MAINPID (code=exited, status=0/SUCCESS)
  Process: 238678 ExecStart=/usr/sbin/keepalived $KEEPALIVED_OPTIONS (code=exited, status=0/SUCCESS)
 Main PID: 238682 (code=exited, status=0/SUCCESS)


//去KD2上看vip和80端口起来没
[root@KD2 srcipts]# ip a | grep ens33
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    inet 192.168.171.150/24 brd 192.168.171.255 scope global noprefixroute ens33
    inet 192.168.171.250/32 scope global ens33
[root@KD2 srcipts]# ss -antl | grep 80
LISTEN 0      128          0.0.0.0:80        0.0.0.0:*          
[root@KD2 srcipts]# 

[root@KD2 srcipts]# curl 192.168.171.250
apache
[root@KD2 srcipts]# curl 192.168.171.250
nginx
[root@KD2 srcipts]# curl 192.168.171.250
apache
[root@KD2 srcipts]# curl 192.168.171.250
nginx
[root@KD2 srcipts]# 







  系统运维 最新文章
配置小型公司网络WLAN基本业务(AC通过三层
如何在交付运维过程中建立风险底线意识,提
快速传输大文件,怎么通过网络传大文件给对
从游戏服务端角度分析移动同步(状态同步)
MySQL使用MyCat实现分库分表
如何用DWDM射频光纤技术实现200公里外的站点
国内顺畅下载k8s.gcr.io的镜像
自动化测试appium
ctfshow ssrf
Linux操作系统学习之实用指令(Centos7/8均
上一篇文章      下一篇文章      查看所有文章
加:2022-10-22 21:56:36  更:2022-10-22 21:56:55 
 
开发: C++知识库 Java知识库 JavaScript Python PHP知识库 人工智能 区块链 大数据 移动开发 嵌入式 开发工具 数据结构与算法 开发测试 游戏开发 网络协议 系统运维
教程: HTML教程 CSS教程 JavaScript教程 Go语言教程 JQuery教程 VUE教程 VUE3教程 Bootstrap教程 SQL数据库教程 C语言教程 C++教程 Java教程 Python教程 Python3教程 C#教程
数码: 电脑 笔记本 显卡 显示器 固态硬盘 硬盘 耳机 手机 iphone vivo oppo 小米 华为 单反 装机 图拉丁

360图书馆 购物 三丰科技 阅读网 日历 万年历 2024年11日历 -2024/11/25 18:32:47-

图片自动播放器
↓图片自动播放器↓
TxT小说阅读器
↓语音阅读,小说下载,古典文学↓
一键清除垃圾
↓轻轻一点,清除系统垃圾↓
图片批量下载器
↓批量下载图片,美女图库↓
  网站联系: qq:121756557 email:121756557@qq.com  IT数码