此系统架构仅映射内网VIP的80及443端口于外网的Juniper SSG550防火墙下,其他端口均关闭,内网所有机器均关闭iptables防火墙;外网DNS指向即通过Juniper SSG550映射出来的外网地址。
- user www www;
- worker_processes 8;
- pid /usr/local/nginx/logs/nginx.pid;
- worker_rlimit_nofile 51200;
- events
- {
- use epoll;
- worker_connections 51200;
- }
- http{
- include mime.types;
- default_type application/octet-stream;
- server_names_hash_bucket_size 128;
- client_header_buffer_size 32k;
- large_client_header_buffers 4 32k;
- client_max_body_size 8m;
- sendfile on;
- tcp_nopush on;
- keepalive_timeout 60;
- tcp_nodelay on;
- fastcgi_connect_timeout 300;
- fastcgi_send_timeout 300;
- fastcgi_read_timeout 300;
- fastcgi_buffer_size 64k;
- fastcgi_buffers 4 64k;
- fastcgi_busy_buffers_size 128k;
- fastcgi_temp_file_write_size 128k;
- gzip on;
- gzip_min_length 1k;
- gzip_buffers 4 16k;
- gzip_http_version 1.0;
- gzip_comp_level 2;
- gzip_types text/plain application/x-javascript text/css application/xml;
- gzip_vary on;
- upstream backend
- {
- ip_hash;
- server 192.168.1.17:80;
- server 192.168.1.18:80;
- }
- server {
- listen 80;
- server_name www.1paituan.com;
- location / {
- root /var/www/html ;
- index index.php index.htm index.html;
- proxy_redirect off;
- proxy_set_header Host $host;
- proxy_set_header X-Real-IP $remote_addr;
- proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
- proxy_pass http://backend;
- }
- location /nginx {
- access_log off;
- auth_basic "NginxStatus";
- #auth_basic_user_file /usr/local/nginx/htpasswd;
- }
- log_format access '$remote_addr - $remote_user [$time_local] "$request" '
- '$status $body_bytes_sent "$http_referer" '
- '"$http_user_agent" $http_x_forwarded_for';
- access_log /data/logs/access.log access;
- }
主Nginx机器之一的Keepalived.conf配置文件如下:
- ! Configuration File for keepalived
- global_defs {
- notification_email {
- yuhongchun027@163.com
- }
- notification_email_from keepalived@chtopnet.com
- smtp_server 127.0.0.1
- smtp_connect_timeout 30
- router_id LVS_DEVEL
- }
- vrrp_instance VI_1 {
- state MASTER
- interface eth0
- virtual_router_id 51
- priority 100
- advert_int 1
- authentication {
- auth_type PASS
- auth_pass 1paituan.com
- }
- virtual_ipaddress {
- 192.168.1.8
- }
- }
- vrrp_instance VI_2 {
- state BACKUP
- interface eth0
- virtual_router_id 52
- priority 99
- advert_int 1
- authentication {
- auth_type PASS
- auth_pass 1paituan.com
- }
- virtual_ipaddress {
- 192.168.1.9
- }
- }
主Nginx之二的keepalivd.conf配置文件如下:
- ! Configuration File for keepalived
- global_defs {
- notification_email {
- yuhongchun027@163.com
- }
- notification_email_from keepalived@chtopnet.com
- smtp_server 127.0.0.1
- smtp_connect_timeout 30
- router_id LVS_DEVEL
- }
- vrrp_instance VI_1 {
- state BACKUP
- interface eth0
- virtual_router_id 51
- priority 99
- advert_int 1
- authentication {
- auth_type PASS
- auth_pass 1paituan
- }
- virtual_ipaddress {
- 192.168.1.8
- }
- }
- vrrp_instance VI_2 {
- state MASTER
- interface eth0
- virtual_router_id 52
- priority 100
- advert_int 1
- authentication {
- auth_type PASS
- auth_pass 1paituan
- }
- virtual_ipaddress {
- 192.168.1.9
- }
- }
- nohup sh /root/nginxpid.sh &
这台是IP为192.168.1.5的机器的ip addr命令显示结果:
- 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue
- link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
- inet 127.0.0.1/8 scope host lo
- 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 1000
- link/ether 00:0c:29:99:fb:32 brd ff:ff:ff:ff:ff:ff
- inet 192.168.1.5/24 brd 192.168.1.255 scope global eth0
- inet 192.168.1.8/32 scope global eth0
- 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue
- link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
- inet 127.0.0.1/8 scope host lo
- inet6 ::1/128 scope host
- valid_lft forever preferred_lft forever
- 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 1000
- link/ether 00:0c:29:7d:58:5e brd ff:ff:ff:ff:ff:ff
- inet 192.168.1.6/24 brd 192.168.1.255 scope global eth0
- inet 192.168.1.9/32 scope global eth0
- inet6 fe80::20c:29ff:fe7d:585e/64 scope link
- valid_lft forever preferred_lft forever
- 3: sit0: <NOARP> mtu 1480 qdisc noop
- link/sit 0.0.0.0 brd 0.0.0.0
一、我们要分别在二台主Nginx上用killall杀掉Nginx进程,然后在客户端分别访问192.168.1.8和192.168.1.9这二个IP(模拟DNS轮询)看能否正常访问Web服务器。
二、尝试重启192.168.1.5的主Nginx负载均衡器,测试过程如上;
三、尝试重启192.168.1.6的主Nginx负载均衡器,测试过程如下;
四、尝试分别关闭192.168.1.5和192.168.1.6的机器,测试过程如上,看影响网站的正常访问不?
一、Cacti和Nagios等监控服务要重新部署,因为现在客户机是分别访问二台负载均衡器;
二、日志收集要重新部署,现在访问日志是分布在二台负载均衡器上;
三、要考虑google收录的问题;
四、证书的问题,二台机器都需要;
五、其它问题暂时没有想到,待补充。