1 前言

一个问题，一篇文章，一出故事。
今天遇到Keycloak的需要保持会话问题，于是整理当前章节。

2 最佳实践

2.1 部署环境

2.1.1 修改前的集群配置

如何部署RHBK集群Nginx反向代理？

2.1.2 准备nginx-plus集群

如何配置nginx-plus的HA？

2.2 配置会话保持

2.2.1 创建负载均衡器

vim /etc/nginx/public/upstream_devsso.cmdschool.org_443.conf

创建如下配置，

upstream devsso.cmdschool.org_443 {
  zone devsso.cmdschool.org_443 64m;
  sticky cookie devsso.cmdschool.org_443_cookie expires=8h path=/;
  server dgrhbkdev01.cmdschool.org:8443 max_fails=3 fail_timeout=30s;
  server dgrhbkdev02.cmdschool.org:8443 max_fails=3 fail_timeout=30s;
  server hkrhbkdev01.cmdschool.org:8443 backup;
}

2.2.2 引用负载均衡器

include /etc/nginx/public/upstream_devsso.cmdschool.org_443.conf;

server {
    listen 443 ssl;
    server_name devsso.cmdschool.org;
    include /etc/nginx/public/ssl_default.conf;

    location ~ ^/(js|realms|resources|robots.txt)/ {
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_pass       https://devsso.cmdschool.org_443;
        proxy_set_header Host $host:$server_port;
    }

    location / {
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_pass       https://devsso.cmdschool.org_443;
        proxy_set_header Host $host:$server_port;
    }

}

server {
    listen 80;
    server_name devsso.cmdschool.org;

    return 301 https://devsso.cmdschool.org$request_uri;
}

2.2.3 应用配置

nginx -t
systemctl reload nginx
systemctl status nginx