
1 基础知识
1.1 软件的介绍
– HAProxy是一款开源免费、快速、可靠的解决方案
– HAProxy是基于TCP和HTTP协议提供高可用、负载均衡和代理服务
1.2 软件的功能
– 负载均衡
– 高可用
– 代理服务
2 最佳实践
2.1 环境信息
OS = CentOS 7.3 x86_64
IP Address = 10.168.0.70
host name = haproxy.cmdschool.org
2.2 安装前的准备
2.2.1 下载软件包
cd ~ https://www.haproxy.org/download/2.1/src/haproxy-2.1.4.tar.gz
2.2.2 解压软件包
cd ~ tar -xf haproxy-2.1.4.tar.gz
2.2.3 准备编译环境
yum -y install gcc make
2.2.4 关闭SELinux
sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config setenforce 0
2.2.5 开放所需的端口
firewall-cmd --permanent --add-port 8080/tcp firewall-cmd --reload firewall-cmd --list-all
2.3 编译安装
2.3.1 定义编译安装选项
cd ~/haproxy-2.1.4 vim Makefile
根据实际情况定义如下编译选项,
#### Installation options. PREFIX = /usr SBINDIR = $(PREFIX)/sbin MANDIR = $(PREFIX)/share/man DOCDIR = $(PREFIX)/doc/haproxy USE_SYSTEMD = 1 TARGET = linux3100 CPU = generic ARCH = x86_64
其中“USE_SYSTEMD = 1”参数用于启用systemd的启动方式,另外“TARGET”与“ARCH”的定义可参考如下命令的输出,
uname -a
可见如下提示,
Linux localhost.localdomain 3.10.0-514.el7.x86_64 #1 SMP Tue Nov 22 16:42:41 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
2.3.2 编译软件包
cd ~/haproxy-2.1.4 make
如果遇到以下提示,
src/haproxy.c:77:31: fatal error: systemd/sd-daemon.h: No such file or directory #include ^ compilation terminated. make: *** [src/haproxy.o] Error 1
请使用如下指令解决依赖关系后再从新编译,
yum install -y systemd-devel
2.3.3 安装软件包
cd ~/haproxy-2.1.4 make install
可见如下输出,
‘haproxy’ -> ‘/usr/sbin/haproxy’ ‘doc/haproxy.1’ -> ‘/usr/share/man/man1/haproxy.1’ install: creating directory ‘/usr/doc’ install: creating directory ‘/usr/doc/haproxy’ ‘doc/configuration.txt’ -> ‘/usr/doc/haproxy/configuration.txt’ ‘doc/management.txt’ -> ‘/usr/doc/haproxy/management.txt’ ‘doc/seamless_reload.txt’ -> ‘/usr/doc/haproxy/seamless_reload.txt’ ‘doc/architecture.txt’ -> ‘/usr/doc/haproxy/architecture.txt’ ‘doc/peers-v2.0.txt’ -> ‘/usr/doc/haproxy/peers-v2.0.txt’ ‘doc/regression-testing.txt’ -> ‘/usr/doc/haproxy/regression-testing.txt’ ‘doc/cookie-options.txt’ -> ‘/usr/doc/haproxy/cookie-options.txt’ ‘doc/lua.txt’ -> ‘/usr/doc/haproxy/lua.txt’ ‘doc/WURFL-device-detection.txt’ -> ‘/usr/doc/haproxy/WURFL-device-detection.txt’ ‘doc/proxy-protocol.txt’ -> ‘/usr/doc/haproxy/proxy-protocol.txt’ ‘doc/linux-syn-cookies.txt’ -> ‘/usr/doc/haproxy/linux-syn-cookies.txt’ ‘doc/SOCKS4.protocol.txt’ -> ‘/usr/doc/haproxy/SOCKS4.protocol.txt’ ‘doc/network-namespaces.txt’ -> ‘/usr/doc/haproxy/network-namespaces.txt’ ‘doc/DeviceAtlas-device-detection.txt’ -> ‘/usr/doc/haproxy/DeviceAtlas-device-detection.txt’ ‘doc/51Degrees-device-detection.txt’ -> ‘/usr/doc/haproxy/51Degrees-device-detection.txt’ ‘doc/netscaler-client-ip-insertion-protocol.txt’ -> ‘/usr/doc/haproxy/netscaler-client-ip-insertion-protocol.txt’ ‘doc/peers.txt’ -> ‘/usr/doc/haproxy/peers.txt’ ‘doc/close-options.txt’ -> ‘/usr/doc/haproxy/close-options.txt’ ‘doc/SPOE.txt’ -> ‘/usr/doc/haproxy/SPOE.txt’ ‘doc/intro.txt’ -> ‘/usr/doc/haproxy/intro.txt’
2.3.4 确认安装
haproxy -v
可见如下显示,
HA-Proxy version 2.1.4 2020/04/02 - https://haproxy.org/ Status: stable branch - will stop receiving fixes around Q1 2021. Known bugs: http://www.haproxy.org/bugs/bugs-2.1.4.html
2.3.5 获取使用帮助
haproxy -h
可见如下显示,
HA-Proxy version 2.1.4 2020/04/02 - https://haproxy.org/ Status: stable branch - will stop receiving fixes around Q1 2021. Known bugs: http://www.haproxy.org/bugs/bugs-2.1.4.html Usage : haproxy [-f ]* [ -vdVD ] [ -n ] [ -N ] [ -p ] [ -m ] [ -C ] [-- *] -v displays version ; -vv shows known build options. -d enters debug mode ; -db only disables background mode. -dM[] poisons memory with (defaults to 0x50) -V enters verbose mode (disables quiet mode) -D goes daemon ; -C changes to before loading files. -W master-worker mode. -q quiet mode : don't display messages -c check mode : only check config files and exit -n sets the maximum total # of connections (uses ulimit -n) -m limits the usable amount of memory (in MB) -N sets the default, per-proxy maximum # of connections (0) -L set local peer name (default to hostname) -p writes pids of all children to this file -dp disables poll() usage even when available -dR disables SO_REUSEPORT usage -dr ignores server address resolution failures -dV disables SSL verify on servers side -sf/-st [pid ]* finishes/terminates old pids. -x get listening sockets from a unix socket -S [,...] new master CLI
2.4 部署编译程序
2.4.1 部署服务控制脚本
cp ~/haproxy-2.1.4/contrib/systemd/haproxy.service.in /usr/lib/systemd/system/haproxy.service vim /usr/lib/systemd/system/haproxy.service
配置修改如下,
[Unit] Description=HAProxy Load Balancer After=network.target [Service] EnvironmentFile=-/etc/default/haproxy #EnvironmentFile=-/etc/sysconfig/haproxy Environment="CONFIG=/etc/haproxy/haproxy.cfg" "PIDFILE=/run/haproxy.pid" ExecStartPre=/usr/sbin/haproxy -f $CONFIG -c -q $EXTRAOPTS ExecStart=/usr/sbin/haproxy -W -f $CONFIG -p $PIDFILE $EXTRAOPTS ExecReload=/usr/sbin/haproxy -f $CONFIG -c -q $EXTRAOPTS #ExecReload=/bin/kill -USR2 $MAINPID KillMode=mixed Restart=always SuccessExitStatus=143 Type=forking # The following lines leverage SystemD's sandboxing options to provide # defense in depth protection at the expense of restricting some flexibility # in your setup (e.g. placement of your configuration files) or possibly # reduced performance. See systemd.service(5) and systemd.exec(5) for further # information. # NoNewPrivileges=true # ProtectHome=true # If you want to use 'ProtectSystem=strict' you should whitelist the PIDFILE, # any state files and any other files written using 'ReadWritePaths' or # 'RuntimeDirectory'. # ProtectSystem=true # ProtectKernelTunables=true # ProtectKernelModules=true # ProtectControlGroups=true # If your SystemD version supports them, you can add: @reboot, @swap, @sync # SystemCallFilter=~@cpu-emulation @keyring @module @obsolete @raw-io [Install] WantedBy=multi-user.target
重点是修改变量“ExecStart”、“@SBINDIR@”和“Type”,修改完成后我们需要运行以下命令使配置生效,
systemctl daemon-reload
根据“EnvironmentFile”定义的参数,我们需要增加额外选项配置文件
vim /etc/default/haproxy
加入如下内容,
# Add extra options to the haproxy daemon here. This can be useful for # specifying multiple configuration files with multiple -f options. # See haproxy(1) for a complete list of options. EXTRAOPTS="-S /run/haproxy-master.sock"
根据变量“CONFIG”的定义,我们需要部署启动脚本所需的配置文件
mkdir -p /etc/haproxy cp ~/haproxy-2.1.4/examples/option-http_proxy.cfg /etc/haproxy/haproxy.cfg cat /etc/haproxy/haproxy.cfg
配置显示如下,
# # demo config for Proxy mode # global maxconn 20000 ulimit-n 16384 log 127.0.0.1 local0 uid 200 gid 200 chroot /var/empty nbproc 4 daemon frontend test-proxy bind 192.168.200.10:8080 mode http log global option httplog option dontlognull option nolinger option http_proxy maxconn 8000 timeout client 30s # layer3: Valid users acl allow_host src 192.168.200.150/32 http-request deny if !allow_host # layer7: prevent private network relaying acl forbidden_dst url_ip 192.168.0.0/24 acl forbidden_dst url_ip 172.16.0.0/12 acl forbidden_dst url_ip 10.0.0.0/8 http-request deny if forbidden_dst default_backend test-proxy-srv backend test-proxy-srv mode http timeout connect 5s timeout server 5s retries 2 option nolinger option http_proxy # layer7: Only GET method is valid acl valid_method method GET http-request deny if !valid_method # layer7: protect bad reply http-response deny if { res.hdr(content-type) audio/mp3 }
根据配置文件“GID”和“UID”的定义,我们需要使用如下命令创建运行用户
groupadd -g 200 haproxy useradd -u 200 -g 200 -d /var/spool/haproxy -s /sbin/nologin haproxy
2.4.2 尝试启动服务
systemctl start haproxy.service
如果遇到如下提示,
Job for haproxy.service failed because the control process exited with error code. See "systemctl status haproxy.service" and "journalctl -xe" for details.
我们建议通过以下命令查看日志查找问题的根源,
tail -n 50 /var/log/messages
可见如下提示,
Apr 15 22:33:14 localhost haproxy: [ALERT] 105/223314 (14715) : Starting frontend test-proxy: cannot bind socket [192.168.200.10:8080] Apr 15 22:33:14 localhost systemd: haproxy.service: control process exited, code=exited status=1 Apr 15 22:33:14 localhost systemd: Failed to start HAProxy Load Balancer. Apr 15 22:33:14 localhost systemd: Unit haproxy.service entered failed state. Apr 15 22:33:14 localhost systemd: haproxy.service failed.
根据提示使用如下命令修改配置,
vim /etc/haproxy/haproxy.cfg
我们修改如下配置,
[...] frontend test-proxy bind 0.0.0.0:8080 [...]
然后我们再次使用以下命令尝试启动,
systemctl start haproxy.service
服务启动成功,我们抱着严谨的精神再次查看日志文件,可见如下提示,
Apr 15 22:39:12 localhost haproxy: [ALERT] 105/223912 (14754) : [/usr/sbin/haproxy.main()] FD limit (16384) too low for maxconn=20000/maxsock=40028. Please raise 'ulimit-n' to 40028 or more to avoid any trouble.This will fail in >= v2.3
我们再次根据提示修改配置文件,
[...] global [...] ulimit-n 40039 [...]
修改完成后,我们需要重启服务使配置生效,
systemctl restart haproxy.service
最后我们使用如下命令查看配置,
cat /etc/haproxy/haproxy.cfg
整体配置如下,
# # demo config for Proxy mode # global maxconn 20000 ulimit-n 40039 log 127.0.0.1 local0 uid 200 gid 200 chroot /var/empty nbproc 4 daemon frontend test-proxy bind 0.0.0.0:8080 mode http log global option httplog option dontlognull option nolinger option http_proxy maxconn 8000 timeout client 30s # layer3: Valid users acl allow_host src 192.168.200.150/32 http-request deny if !allow_host # layer7: prevent private network relaying acl forbidden_dst url_ip 192.168.0.0/24 acl forbidden_dst url_ip 172.16.0.0/12 acl forbidden_dst url_ip 10.0.0.0/8 http-request deny if forbidden_dst default_backend test-proxy-srv backend test-proxy-srv mode http timeout connect 5s timeout server 5s retries 2 option nolinger option http_proxy # layer7: Only GET method is valid acl valid_method method GET http-request deny if !valid_method # layer7: protect bad reply http-response deny if { res.hdr(content-type) audio/mp3 }
2.4.3 设置服务开机自动启动
systemctl enable haproxy.service
另外,常用服务控制命令如下,
systemctl start haproxy.service systemctl stop haproxy.service systemctl reload haproxy.service systemctl restart haproxy.service systemctl status haproxy.service
参阅文档
=======================
官方文档
—————-
https://www.haproxy.org/download/2.1/doc/management.txt
https://www.haproxy.org/#docs
软件下载
——————
https://www.haproxy.org/download/
https://www.haproxy.org/#down
官方首页
—————–
https://www.haproxy.org/
官方github
—————-
http://git.haproxy.org/
安装参阅文档
—————
https://linuxscriptshub.com/install-haproxy-centos-7/
如何编译出systemd控制脚本
———————–
https://discourse.haproxy.org/t/failing-to-start-with-systemd-and-unexplained-issues/849/6
limit的配置方法
——————–
https://docs.oracle.com/cd/E19476-01/821-0505/file-descriptor-requirements.html
没有评论