keepalived+nginx 實現 sharepoint 負載均衡

要點
1、ssl代理
ssl_certificate /etc/nginx/ssl/nginx.crt;
ssl_certificate_key /etc/nginx/ssl/nginx.key;
2、訪問http時重定向的https
server {
listen 80;
server_name proxy-server180;
location / {
rewrite ^(.*)$ https://$host$1 permanent;
#proxy_pass http://192.168.16.193;
}
}
3、nginx 狀態
location /basic_status {
stub_status;
}
4、圖片和html頁面緩存
location ~* \.(gif|jpg|jpeg|png|gif|css|js|html|htm)$ {
proxy_pass http://192.168.16.193;
proxy_cache proxy-cache;
proxy_cache_key $scheme$proxy_host$request_uri;
proxy_cache_valid 200 302 10m;
proxy_cache_valid 404 1m;
proxy_cache_use_stale error;
}
5、調大讀寫超時時長，
proxy_read_timeout 120s;
proxy_send_timeout 120s;

6、通過追加request header 向后端webserver傳遞 clientip
proxy_set_header Host $host;
proxy_set_header Real-Client-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
7、通過追加response header,在客戶端方便查看當前活動nginx Server
add_header proxy-server $server_name;
8、在 webserver 的httpmodule 上 增加 “RServer”Responseheader，值為被調度到的WebServerName
HttpContext.Current.Response.AddHeader(“RServer”, HostName);

9、WebClinet–ssl–> Nginx –http–> WebServer
服務端代碼重定向時 取相對路徑
10、upstream NAME 命名為 域名，nginx 需要 使用 upstream NAME 訪問 WebServer，sharepoint 對訪問的 URL有限制
upstream workflow.clo.cn {
server 192.168.16.10 weight=2 max_fails=2 fail_timeout=10s;
server 192.168.16.11 weight=1 max_fails=2 fail_timeout=10s;
zone upstream_webgroup 1024k;
ip_hash;
}
11、定義向下一個WebServer調度的策略，
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504 http_403 http_404 http_429;
12、上傳大小受限于以下參數
client_max_body_size 128m;
13、sharepoint 各個前端 web.config 的 machineKey 值一致，使調度到任意前端用戶登錄有效
<machineKey validationKey=”F68C11032A0FEA7BC535DCA20CD73059634B82193D5F087E” decryptionKey=”8FD256AFFE8CB4342E37DD7BAD7C4416A3FA586B6CBD717A” validation=”SHA1″ />

一? 部署nginx

分別在node4(192.168.16.64),node5(192.168.16.65) 按 如下步奏部署nginx
?到www.nginx.org 下載 源碼
 1、useradd -r nginx
 2、yum install pcre-devel
 3、yum install openssl-devel
 4、./configure --prefix=/usr/local/nginx --conf-path=/etc/nginx/nginx.conf --user=nginx --group=nginx --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx/nginx.pid --lock-path=/var/lock/nginx.lock --with-http_ssl_module --with-mail --with-debug --with-http_stub_status_module
 5、make &&　make install
 6、PATH=/usr/local/nginx:$PATH
 7、配置 /etc/nginx/nginx.conf，

—————————————–nginx.conf————————————————

#user nobody;
worker_processes 1;

#error_log logs/error.log;
#error_log logs/error.log notice;
#error_log logs/error.log info;

#pid logs/nginx.pid;

events {
worker_connections 1024;
}

http {
include mime.types;
default_type application/octet-stream;
client_max_body_size 128m;
client_header_buffer_size 16k;
large_client_header_buffers 4 16k;
sendfile on;
#keepalive_timeout 0;
keepalive_timeout 65;
add_header proxy-server $server_name;
proxy_cache_path /var/log/nginx/proxy-cache levels=2:2:2 keys_zone=proxy-cache:10m;
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504 http_403 http_404 http_429;
upstream 192.168.16.193 {
server 192.168.16.10 weight=2 max_fails=2 fail_timeout=10s;
server 192.168.16.11 weight=1 max_fails=2 fail_timeout=10s;
zone upstream_webgroup 1024k;
ip_hash;
}

#gzip on;
server {
server {
listen 80;
server_name proxy-server180;

location / {
rewrite ^(.*)$ https://$host$1 permanent;
#proxy_pass http://192.168.16.193;
}
}

# HTTPS server
server {
listen 443 ssl;
server_name proxy-server1 ;

ssl_certificate /etc/nginx/ssl/nginx.crt;
ssl_certificate_key /etc/nginx/ssl/nginx.key;

location / {
proxy_pass http://192.168.16.193;
proxy_read_timeout 120s;
proxy_send_timeout 120s;
proxy_set_header Host $host;
proxy_set_header Real-Client-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
location ~* \.(gif|jpg|jpeg|png|gif|css|js|html|htm)$ {
proxy_pass http://192.168.16.193;
proxy_cache proxy-cache;
proxy_cache_key $scheme$proxy_host$request_uri;
proxy_cache_valid 200 302 10m;
proxy_cache_valid 404 1m;
proxy_cache_use_stale error;
}
location /basic_status {
stub_status;
}
}
}

——————————————————————————————————

二 部署 keepalived

? ?node4(192.168.16.64)為masger,node5(192.168.16.65)為backup 
按 如下步奏部署keepalived
1、setenforce Permissive? ? //關閉SELinux
2、yum install keepalived
3、通過 vrrp_script 動態檢測 nginx 進程判斷主機健康狀態，VIP：192.168.16.69
配置文件keepalived.conf 如下

———————————–keepalived.conf———————————————————-
! Configuration File for keepalived

global_defs {
notification_email {
suzb@clo.com.cn
}
notification_email_from keepalived@clo.com
smtp_server 192.268.101.12
smtp_connect_timeout 30
router_id node06
vrrp_mcast_group4 224.0.16.18
# vrrp_skip_check_adv_addr
# vrrp_strict
# vrrp_garp_interval 0
# vrrp_gna_interval 0
}

vrrp_script chk_httpd {
script “killall -0 nginx”
interval 2
weight -5
}

vrrp_instance VI_1 {
state MASTER|BACKUP
interface ens32
virtual_router_id 60
priority 100
advert_int 1
authentication {
auth_type PASS
auth_pass 123
}
virtual_ipaddress {
192.168.16.69/24 dev ens32
}
track_script
{
chk_httpd
}
notify_master “/etc/keepalived/keepalived-notify.sh master”
notify_backup “/etc/keepalived/keepalived-notify.sh backup”
notify_fault “/etc/keepalived/keepalived-notify.sh fault”
}

—————————————————————————————–