nginx+Keepalived雙機主備方案實作（經線上測試）

nginx的編譯安裝

1）編譯工具（基本可以不用）

yum -y install gcc gcc-c++ autoconf automake zlib zlib-devel openssl openssl-devel pcre-devel gd-*

2）建立nginx 組

groupadd -r nginx

useradd -s /sbin/nologin -g nginx -r nginx

id nginx

3）wget http://nginx.org/download/nginx-1.6.2.tar.gz

tar xf /usr/local/src/nginx-1.6.2.tar.gz

cd /usr/local/src/nginx-1.6.2.tar.gz

./configure --prefix=/usr/local/nginx --lock-path=/usr/local/nginx/nginx.lock --user=nginx --group=nginx --with-http_ssl_module --with-http_flv_module --with-http_stub_status_module --with-http_gzip_static_module --http-client-body-temp-path=/usr/local/nginx/client/ --http-proxy-temp-path=/usr/local/nginx/proxy/ --http-fastcgi-temp-path=/usr/local/nginx/fcgi/ --http-uwsgi-temp-path=/usr/local/nginx/uwsgi --http-scgi-temp-

path=/usr/local/nginx/scgi --with-pcre --with-file-aio --with-http_image_filter_module

make && make install

4)配置nginx啟動腳本

===============================================

vim /etc/init.d/nginx chmod +x /etc/init.d/nginx

#!/bin/bash

# Startup script for Nginx - this script starts and stops the nginx daemon

# chkconfig: - 85 15

# description: Nginx is an HTTP(S) server, HTTP(S) reverse proxy and IMAP/POP3 proxy server

# processname: nginx

# config: /usr/local/nginx/conf/nginx.conf

# pidfile: /usr/local/nginx/logs/nginx.pid

# Source function library.

. /etc/rc.d/init.d/functions

# Source networking configuration.

. /etc/sysconfig/network

# Check that networking is up.

[ "$NETWORKING" = "no" ] && exit 0

nginx="/usr/local/nginx/sbin/nginx"

prog=$(basename $nginx)

NGINX_CONF_FILE="/usr/local/nginx/conf/nginx.conf"

[ -f /etc/sysconfig/nginx ] && . /etc/sysconfig/nginx

lockfile=/var/lock/subsys/nginx

start() {

[ -x $nginx ] || exit 5

[ -f $NGINX_CONF_FILE ] || exit 6

echo -n $"Starting $prog: "

daemon $nginx -c $NGINX_CONF_FILE

retval=$?

echo

[ $retval -eq 0 ] && touch $lockfile

return $retval

}

stop() {

echo -n $"Stopping $prog: "

killproc $prog -QUIT

[ $retval -eq 0 ] && rm -f $lockfile

restart() {

configtest || return $?

stop

sleep 1

start

reload() {

echo -n $"Reloading $prog: "

killproc $nginx -HUP

RETVAL=$?

force_reload() {

restart

configtest() {

$nginx -t -c $NGINX_CONF_FILE

rh_status() {

status $prog

rh_status_q() {

rh_status >/dev/null 2>&1

case "$1" in

start)

rh_status_q && exit 0

;;

stop)

rh_status_q || exit 0

restart|configtest)

reload)

rh_status_q || exit 7

force-reload)

force_reload

status)

rh_status

condrestart|try-restart)

;;

echo $"Usage: $0 {start|stop|status|restart|condrestart|

try-restart|reload|force-reload|configtest}"

exit 2

esac

==============================================================

5)nginx配置

vim /usr/local/nginx/conf/nginx.conf

====================================================

upstream MCM {

server 10.124.156.236; #使用nginx的預設分發模式rr

server 10.124.156.231; #兩個分發伺服器ip

}

server {

listen 80;

server_name localhost;

location /mcm/ {

limit_req zone=allips burst=10 ;

proxy_pass http://MCM/mcm/;

proxy_redirect off;

proxy_set_header Host $http_host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For

$proxy_add_x_forwarded_for;

proxy_set_header Cookie $http_cookie;

chunked_transfer_encoding off;

}

error_page 500 502 503 504 /50x.html;

location = /50x.html {

root html;

}

=========================================================

2.Keepalived的安裝配置

1)Keepalived的編譯安裝

cd /usr/local/src/

wget http://www.keepalived.org/software/keepalived-1.1.20.tar.gz

tar xf keepalived-1.2.15.tar.gz

cd keepalived-1.1.20

./configure --prefix=/usr/local/keepalived --with-kernel-dir=/usr/src/kernels/2.6.32-279.el6.x86_64/

make && make install

将Keepalived做成服務：

cd /usr/local/keepalived/ && cp etc/rc.d/init.d/keepalived /etc/rc.d/init.d/ && cp etc/sysconfig/keepalived /etc/sysconfig/ && mkdir /etc/keepalived && cp etc/keepalived/keepalived.conf /etc/keepalived/ && cp sbin/keepalived /usr/sbin/

2)配置Keepalived.conf檔案

====================================================

TestNginx1：10.124.194.244

vim /etc/keepalived/keepalived.conf

==========================================

! Configuration File for keepalived

global_defs {

notification_email {

[email protected]

}

notification_email_from [email protected]

smtp_server 127.0.0.1

smtp_connect_timeout 30

router_id Nginx_MB

vrrp_script chk_http_port {

script "/etc/keepalived/chk_nginx.sh"

interval 2

weight 2

vrrp_instance VI_3 {

state MASTER

interface eth0

virtual_router_id 57 #VI_2 為 58

priority 200 #備用是150

mcast_src_ip 10.124.194.244 #本機ip

advert_int 1

authentication {

auth_type PASS

auth_pass yzkj

}

track_script {

chk_http_port

virtual_ipaddress {

10.124.194.4 #VIP 1

vrrp_instance VI_4 {

state BACKUP

virtual_router_id 58 # VI_1 是57

priority 150 #主是200

authentication {

10.124.194.5 #VIP 2

========================================

TestNginx2

virtual_router_id 57 #VI_4 為 58

priority 150 #主是200

virtual_router_id 58 #VI_3 是57

priority 200 #備用是50

=====================================

3)添加nginx狀态自動檢測腳本

vim /etc/keepalived/chk_nginx.sh

=============

# description:

# 定時檢視nginx是否存在，如果不存在則啟動nginx

# 如果啟動失敗，則停止keepalived

status=$(ps -C nginx --no-heading|wc -l)

if [ "${status}" = "0" ]; then

/usr/local/nginx/sbin/nginx

status2=$(ps -C nginx --no-heading|wc -l)

if [ "${status2}" = "0" ]; then

/etc/init.d/keepalived stop

====================

4)keepalived nginx啟動

service keepalived start

service nginx start 或者（/usr/local/nginx/sbin/nginx）

5）防火牆設定：

在Lvs+Keepalived的設定中一般都将iptables關掉，這是一個很危險的操作。在測試nginx+Keepalived的時候發現iptables不關閉的話，會出現VIP同時綁定在主備nginx上。是以經過研究測試，要想開着iptables來使用Keepalived，就應該先明白Keepalived的工作原理。Keepalived工作主

要是通過vrrp協定進行封包互通，于是就必須在iptables裡設定

-A INPUT -p vrrp -j ACCEPT #基于DR模式，當使用者送出請求後，隻有DR響應ARP廣播包，允許vrrp虛拟路由器備援協定。然後重新開機iptables服務，至此困擾已久的VIP同時綁定在多個伺服器上的問題解決。

3.測試：

在測試過程中出現一個有趣的話題：就是當我進行停止nginx運作的時候，發現程序自動會起來，然後我就問、查，總是不以是以然，總以為是kill pkill指令不好使。後來經過查證，竟然是我們寫的一個檢測腳本在作怪。腳本記錄如下：（修改完善版）

===================================

status3=$(ps -C keepalived --no-heading|wc -l)

elif [ "${status3}" = "0" ]; then

/etc/init.d/keepalived start

它的作用主要就是檢測nginx的狀态，如果nginx死掉，就嘗試重新開機，如果重新開機不成功就把Keepalived服務停止，使兩個vip同時漂到同一台nginx伺服器上面去，如果nginx恢複就應該重新開機Keepalived服務。

4.使用rsync使後端幾台伺服器檔案同步

1）服務安裝：yum install rsync -y

服務端：10.124.151.246

=============================

vim /etc/rsyncd.conf

uid = root

gid = root

use chroot = no

max connections = 5

pid file = /var/run/rsyncd.pid

lock file = /var/run/rsync.lock

log file = /var/log/rsyncd.log

[web01]

path=/usr/local/nginx/html/

comment = update

ignore errors

read only = no

list = no

hosts allow = 192.168.122.0/24

auth users = root

secrets file = /etc/rsyncd.secrets

=================================

vim /etc/rsyncd.secrets

root:123456

chmod 0600 /etc/rsyncd.secrets

啟動服務：rsync --daemon

echo "rsync --daemon" >> /etc/rc.local #自啟動

用戶端配置（也就是代碼推送端）10.124.151.245

vim /etc/rsyncd.secrets

123456

chmod 0600 /etc/rsyncd.secrets

2)使用指令行進行代碼推送（根據代碼的修改和增删情況進行代碼同步操作）

rsync -vzrtopg --delete --progress --password-file=/etc/rsyncd.secrets * [email protected]::web01

本文轉自南非波波 51CTO部落格，原文連結：http://blog.51cto.com/nanfeibobo/1623886，如需轉載請自行聯系原作者

nginx+Keepalived雙機主備方案實作（經線上測試）

繼續閱讀

lvm建立、擴容

Puppet自動化Nginx+Mongrel負載均衡配置

HBuilder開發App Step1——環境搭建，HelloMUI 以及真機調試

Ubuntu修改nginx将多個域名分别配置到伺服器不同端口

拒絕使用者登入:/bin/false和/usr/sbin/nologin

Shell程式設計——sort排序、uniq忽略重複、tr替換壓縮删除、cut指定删除字段、正規表達式元字元sort 指令uniq 指令tr 指令cut 指令正規表達式

修改or隐藏nginx版本号

Nginx安全改動：隐藏Nginx版本号背景解決serve_tokens指令參考

版本号隐藏

Nginx服務優化（版本隐藏、版本号僞裝、逾時管理、程序管理、日志分割）Nginx服務優化未完待續

Linxu常用指令技巧彙總

《Linux指令行與Shell腳本程式設計大全第2版.布盧姆》pdf

nginx location中斜線的位置的重要性

ACS基本配置-權限等級管理

27 Best Free Eclipse Plug-ins for Java Developer to be ProductiveCode Quality PluginsText Editor PluginsDependency ManagementVersion Control Integration PluginsFramework Development Continuous Integration Related PluginsOther Utility Plugins