HAProxy+Varnish动静分离WordPress配置详解 version2.0
本次的实验拓扑图如下
此次的实验目标
(1) 动静分离部署wordpress，动静都要能实现负载均衡，要注意会话的问题
(2) 在haproxy和后端主机之间添加varnish进行缓存
只缓存静态，对于动态直接调度至后端主机
(3) haproxy的设定要求：
(a) stats page，要求仅能通过本地访问使用管理接口；
(b) 动静分离
(c) 分别考虑不同的服务器组的调度算法
(4) haproxy高可用(Keepalived)
实验之前所需做的准备
IP地址划分
'调度器：'
Master：172.16.1.10/16 内网：192.168.1.10/24
Backup：172.16.1.20/16 内网：192.168.1.20/24
VIP：172.16.1.200/16 www.maxie.com
'varnish：'
Master：192.168.1.30/24
Backup：192.168.1.40/24
'静态WEB：'
A：192.168.1.50/24
B：192.168.1.60/24
'动态AP站点：'
A：192.168.1.70/24
B：192.168.1.80/24
'MySQL：'
192.168.1.90/24
'NFS：'
192.168.1.100/24
初始化脚本编写
#!/bin/bash
#
#hostname
hname=$1
hostnamectl set-hostname ${hname}
#yum software
ver=$2
if [ "$ver" == haproxy ];then
iptables -F
setenforce 0
yum install -y -q ntp
ntpdate 172.16.0.1
yum install -y -q nginx keepalived haproxy
[ $? -eq 0 ] && echo "yum success" || echo "failed"
elif [ "$ver" == http ];then
yum install -y httpd
yum install -y -q nfs-utils
iptables -F
setenforce 0
scp root@192.168.1.10:/etc/hosts /etc/
echo "$hname Static Server" > /var/www/html/index.html
mkdir -pv /var/www/html/{wordpress,discuzx}
mount -t nfs 192.168.1.100:/data/my_wordpress /var/www/html/wordpress
mount -t nfs 192.168.1.100:/data/my_discuzx /var/www/html/discuzx
systemctl start httpd
elif [ "$ver" == ap ];then
yum install -y -q nfs-utils
yum install -y -q httpd php php-mysql php-mbstring php-mcrypt
iptables -F
setenforce 0
scp root@192.168.1.10:/etc/hosts /etc/
mkdir -pv /var/www/html/{wordpress,discuzx}
mount -t nfs 192.168.1.100:/data/my_wordpress /var/www/html/wordpress
mount -t nfs 192.168.1.100:/data/my_discuzx /var/www/html/discuzx
cat > /var/www/html/index.php<<EOF
${hname}
<?php
phpinfo();
?>
EOF
systemctl start httpd
elif [ "$ver" == nfs ];then
iptables -F
setenforce 0
yum install -y -q nfs-utils rpcbind
scp root@192.168.1.10:/etc/hosts /etc/
cat > /etc/exports<<EOF
/data/my_wordpress 192.168.1.50(rw,no_root_squash) 192.168.1.60(rw,no_root_squash) 192.168.1.70(rw,no_root_squash) 192.168.1.80(rw,no_root_squash)
/data/my_discuzx 192.168.1.50(rw,no_root_squash) 192.168.1.60(rw,no_root_squash) 192.168.1.70(rw,no_root_squash) 192.168.1.80(rw,no_root_squash)
EOF
mkdir -pv /data/my_wordpress
mkdir -pv /data/my_discuzx
scp maxie@192.168.1.1:/Users/machiyuan/Downloads/LinuxPackages/wordpress-4.7.4-zh_CN.tar.gz /data/
scp maxie@192.168.1.1:/Users/machiyuan/Downloads/LinuxPackages/Discuz_X3.3_SC_UTF8.zip /data/
tar -xf /data/wordpress-3.7.4-zh_CN.tar.gz -C /data
mv /data/wordpress/* /data/my_wordpress
unzip /data/Discuz_X3.3_SC_UTF8.zip -d /data/
mv /data/upload/* /data/my_discuzx
useradd -u 48 apache
chown -R apache.apache /data
systemctl restart nfs
[ $? -eq 0 ] && echo "nfs deploy success" || echo "failed"
elif [ "$ver" == mysql ];then
iptables -F
setenforce 0
scp root@192.168.1.10:/etc/hosts /etc/
scp root@192.168.1.10:/root/server.conf /etc/my.cnf.d/
scp root@192.168.1.10:/root/init.sql /root/
systemctl start mariadb.service
mysql < /root/init.sql
else
echo "Usage: arg1 is hostname u want set var"
echo "Usage: arg2 is (nginx|varnish|http|ap|nfs|mysql)"
fi
检测网络是否通畅
$ ping 172.16.0.1
$ ping 192.168.1.1
配置后端的动静节点以及 NFS、MySQL节点
配置NFS以及MySQL
配置MySQL
$ yum install -y mariadb-server
$ vim /etc/my.cnf.d/server.conf
[server]
skip_name_resolve=ON
innodb_file_per_table=ON
log-bin=mysql_bin
$ systemctl start mariadb.service
$ mysql
> CREATE DATABASE wordpress_db;
> GRANT ALL PRIVILEGES ON wordpress_db.* TO 'wordpress'@'192.168.1.50' IDENTIFIED BY 'root@123';
> GRANT ALL PRIVILEGES ON wordpress_db.* TO 'wordpress'@'192.168.1.60' IDENTIFIED BY 'root@123';
> GRANT ALL PRIVILEGES ON wordpress_db.* TO 'wordpress'@'192.168.1.70' IDENTIFIED BY 'root@123';
> GRANT ALL PRIVILEGES ON wordpress_db.* TO 'wordpress'@'192.168.1.80' IDENTIFIED BY 'root@123';
> GRANT ALL PRIVILEGES ON wordpress_db.* TO 'wordpress'@'192.168.1.100' IDENTIFIED BY 'root@123';
> FLUSH PRIVILEGES;
> exit;
- 配置NFS
# 执行初始化脚本
$ bash -x init.sh nfs-server nfs
# 查看NFS是否运行并监听在2049端口上
$ ss -tnl | grep 2049
配置动静节点
# 只需检测httpd服务是否正常运行、可访问即可
$ ss -tnl
$ curl http://192.168.1.50/index.html
$ curl http://192.168.1.60/index.html
$ curl http://192.168.1.70/index.php
$ curl http://192.168.1.80/index.php
配置调度器 HAProxy + KeepAlived
配置HAProxy
# 执行初始化脚本
$ bash -x init.sh master haproxy
$ cd /etc/haproxy
$ vim haproxy.cfg
#---------------------------------------------------------------------
# main frontend which proxys to the backends
#---------------------------------------------------------------------
frontend main
# 监听在80端口
bind *:80
# 增加自定义头部
rspadd X-Via:\ HAProxy-1
# 删除头部
rspidel Server.*
# ACL规则
acl static path_end -i .html .css .js
acl static path_end -i .jpg .jpeg .gif .png
acl static path_beg -i /images /static
# 如果满足定义的static ACL规则，则调度至此后端
use_backend websrvs if static
# 默认后端
default_backend appsrvs
#---------------------------------------------------------------------
# Admin Stats
#---------------------------------------------------------------------
# 管理页面配置
listen status
# 管理页面监听端口
bind *:9909
# ACL规则
acl auth_admin src 172.16.250.15 172.16.1.11
# 开启状态页
stats enable
# 状态页URI
stats uri /myha?stats
# 状态页提示信息
stats realm HAProxy\ Admin\ Area
# 认证用户：密码
stats auth root:root@123
# 如果满足 auth_admin条件则允许访问状态页
stats admin if auth_admin
#---------------------------------------------------------------------
# WEB static backend
#---------------------------------------------------------------------
# 后端静态(varnish) Websrvs
backend websrvs
# 添加头部，日志中可以使用
option forwardfor header X-Client
# 负载均衡调度算法为 URI
balance uri
# 后端服务器，健康检查、权重、自定义cookie
server web1 192.168.1.30:80 check weight 1 cookie web1
server web2 192.168.1.40:80 check weight 1 cookie web2
# 一致性HASH
hash-type consistent
#---------------------------------------------------------------------
# ap backend
#---------------------------------------------------------------------
# 后端动态节点 appsrvs
backend appsrvs
option forwardfor header X-Client
balance uri
#balance roundrobin
server app1 192.168.1.70:80 cookie app1 check weight 1
server app2 192.168.1.80:80 cookie app2 check weight 1
hash-type consistent
$ systemctl start haproxy
$ ss -tnl | grep 80
配置keepalived
$ cd /etc/keepalived
$ vim keepalived.conf
# MASTER节点
! Configuration File for keepalived
global_defs {
notification_email {
root@localhost
}
notification_email_from KA@localhost
smtp_server 127.0.0.1
smtp_connect_timeout 30
router_id vs1
vrrp_mcast_group4 224.16.3.100
}
vrrp_instance VI_1 {
state MASTER
interface eno16777736
virtual_router_id 51
priority 100
advert_int 2
authentication {
auth_type PASS
auth_pass maxie95
}
virtual_ipaddress {
172.16.1.200/16 dev eno16777736 label eno16777736:0
}
notify_master "/etc/keepalived/notify.sh master"
notify_backup "/etc/keepalived/notify.sh backup"
notify_fault "/etc/keepalived/notify.sh fault"
}
# BACKUP节点
! Configuration File for keepalived
global_defs {
notification_email {
root@localhost
}
notification_email_from KA@localhost
smtp_server 127.0.0.1
smtp_connect_timeout 30
router_id vs2
vrrp_mcast_group4 224.16.3.100
}
vrrp_instance VI_1 {
state BACKUP
interface eno16777736
virtual_router_id 51
priority 95
advert_int 2
authentication {
auth_type PASS
auth_pass maxie95
}
virtual_ipaddress {
172.16.1.200/16 dev eno16777736 label eno16777736:0
}
notify_master "/etc/keepalived/notify.sh master"
notify_backup "/etc/keepalived/notify.sh backup"
notify_fault "/etc/keepalived/notify.sh fault"
}
# notify.sh脚本
$ vim notify.sh
#!/bin/bash
#
contact="root@localhost"
notify() {
local mailsubject="$(hostname) to be $1, VIP is folating"
local mailbody="$(date + '$F $T'): vrrp transition, $(hostname) changed to be $1"
echo "$mailbody" | mail -s "$mailsubject" $contact
}
case $1 in
master)
systemctl start nginx
notify master
;;
backup)
systemctl start nginx
notify backup
;;
fault)
notify fault
;;
*)
echo "Usage: $(basename $0) {master|backup|fault}"
exit 1
;;
esac
$ systemctl start keepalived
# 查看vip是否在MASTER节点上
$ ifconfig
配置varnish
安装
$ yum install varnish
配置varnish.params
$ cd /etc/varnish
$ vim varnish.params
# 修改监听端口为 80
VARNISH_LISTEN_PORT=80
# 管理IP地址以及端口
VARNISH_ADMIN_LISTEN_ADDRESS=127.0.0.1
VARNISH_ADMIN_LISTEN_PORT=6082
# 共享密钥文件
VARNISH_SECRET_FILE=/etc/varnish/secret
# 缓存类型，可以是磁盘，也可以是内存。这里为内存
VARNISH_STORAGE="malloc,512M"
# 运行varnish的用户以及组
VARNISH_USER=varnish
VARNISH_GROUP=varnish
# 其他自定义设置
DAEMON_OPTS="-p thread_pool_min=50 -p thread_pool_max=2000 -p thread_pool_timeout=300"
配置default.vcl
$ vim default.vcl
# new 4.0 format.
vcl 4.0;
# 导入负载均衡模块
import directors;
# Default backend definition. Set this to point to your content server.
backend default {
.host = "127.0.0.1";
.port = "8080";
}
# 配置后端主机
backend web1 {
.host = "192.168.1.50";
.port = "80";
# 配置健康状态检查
.probe = {
# 检查状态检查的URL
.url = "/index.html";
# 一共检查的次数
.window= 8;
# 如果大于4次则为健康
.threshold = 4;
# 每3秒检查一次
.interval = 3s;
# 超时时间
.timeout = 10s;
}
}
# 配置后端主机
backend web2 {
.host = "192.168.1.60";
.port = "80";
.probe = {
.url = "/index.html";
.window= 8;
.threshold = 4;
.interval = 3s;
.timeout = 10s;
}
}
# 初始化负载均衡
sub vcl_init {
# 定义负载均衡组的名字以及调度算法
new websrv = directors.round_robin();
websrv.add_backend(web1);
websrv.add_backend(web2);
}
# 定义裁剪缓存的提示信息
sub vcl_purge {
return (synth(200,"Pruge Fishished"));
}
# 定义裁剪的ACL
acl purges {
"172.16.1.11";
"172.16.250.15";
"127.0.0.0"/8;
}
# 定义接收段
sub vcl_recv {
# 如果请求方法是PURGE，也就是裁剪缓存
if (req.method == "PURGE") {
# 如果客户端IP不在我们之前定义的ACL for purges中，提示如下信息
if (client.ip !~ purges) {
return(synth(403,"Purging not allowed for" + client.ip));
}
# 反之，执行裁剪缓存
return(purge);
}
# 如果请求的URL中包括以下信息，则调度至我们的后端主机
if (req.url ~ "(?i)\.(html|css|js|jpg|jpeg|png|gif)$") {
set req.backend_hint = websrv.backend();
}
# 自定义头部
if (req.restarts == 0) {
if (req.http.X-Forwarded-For) {
set req.http.X-Forwarded-For = req.http.X-Forwarded-For + "," + client.ip;
} else {
set req.http.X-Forwarded-For = client.ip;
}
}
}
sub vcl_backend_response {
# 清除响应头部
unset beresp.http.X-Powered-By;
# 如果向后端请求URL中包含以下字段，则清除cookie
if (bereq.url ~ "\.(css|js|png|gif|jp(e?)g|swf|ico|txt|eot|svg|woff)") {
unset beresp.http.cookie;
set beresp.http.cache-control = "public, max-age=3600";
}
# 如果相应的状态码不是200或者404，则不缓存
if ( beresp.status != 200 && beresp.status != 404 ) {
set beresp.uncacheable = true;
set beresp.ttl = 120s;
return (deliver);
}
# 设置默认ttl缓存为 1小时
set beresp.ttl = 1h;
# 意思在30s 内复制旧的请求结果给客户端
set beresp.grace = 30s;
return (deliver);
}
sub vcl_deliver {
# 如果命中了则返回自定义头部，未命中则返回另一个自定义头部
if (obj.hits>0) {
set resp.http.X-Cache = "Hit Via " + server.ip;
} else {
set resp.http.X-Cache = "Miss from " + server.ip;
}
}
传送配置文件至另一台varnish
$ scp -r /etc/varnish root@192.168.1.40:/etc
$ systemctl start varnish
$ ss -tnl | grep 80
配置varnish
客户端配置hosts文件
$ sudo vim /etc/hosts
172.16.1.200 www.maxie.com
打开浏览器验证
- 验证主页
- 验证WordPress
- 验证是否可以会话保持
- 验证是否可以上传图片
Paste_Image.png
- 验证静态资源是否命中缓存
配置完毕
至此已经全部配置完毕了，如果想使用nginx作为调度器，只需将haproxy服务停掉即可
- nginx配置文件
upstream varnishsrv {
server 192.168.1.30:80;
server 192.168.1.40:80;
}
upstream appsrv {
ip_hash;
server 192.168.1.70:8080;
server 192.168.1.80:8080;
}
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _;
root /usr/share/nginx/html;
index index.php;
# Load configuration files for the default server block.
include /etc/nginx/default.d/*.conf;
location / {
proxy_pass http://varnishsrv/;
}
location /wordpress {
proxy_pass http://varnishsrv;
}
location ~* /.*\.php$ {
index index.php;
proxy_pass http://appsrv;
}
error_page 404 /404.html;
location = /40x.html {
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
}
}
不过，我这里只实现了调度，并没有实现缓存静态资源。
- 也可以将AP替换成AT，也就是Apache+Tomcat，而且可以通过memcached实现session server。不过这个实现，我们下次在实现吧
本文来源：Maxie’s Notes
