nginx+keepalived实现高可用

在之前的文章已经提到怎么实现keepalived的双机热备，现在我们就结合nginx来实现高可用

1、nginx的部署

1.1 依赖安装

在线安装依赖

yum -y install gcc gcc-c++ pcre pcre-devel zlib zlib-devel openssl openssl-devel

1.2nginx的安装

https://nginx.org/en/download.html

下载好之后放到/usr/下进行解压

tar -zxvf  nginx-1.23.1.tar.gz
cd  nginx-1.23.1/ 

1.3nginx配置

echo  "export PATH=$PATH:/usr/local/nginx/sbin"  >> /etc/profile
source   /etc/profile
echo "/usr/local/nginx/sbin/nginx"  >>  /etc/rc.local
chmod 777  /etc/rc.local    /etc/rc.d/rc.local

1.4命令汇总

/usr/local/nginx/sbin/nginx  #启动
/usr/local/nginx/sbin/nginx -s stop  #停止
/usr/local/nginx/sbin/nginx -s reload   #重启
/usr/local/nginx/sbin/nginx -t   #验证
ps -ef | grep nginx  #查看进程
/usr/local/nginx/sbin/nginx -V  #查看安装模块

1.5生成自签证书

mkdir  /usr/local/nginx/ssl_cert

cd  /usr/local/nginx/ssl_cert

openssl genrsa -out server.key 2048 
#创建证书密钥文件

openssl req -new -key server.key -out server.csr
#利用密钥生成证书请求文件，按提示输入证书信息（密码为空）  全部默认回车
Country Name #名称
State or Province Name #省份
Locality Name  #城市名称
Organization Name  #单位名称
Organizational Unit  #部门
Common Name  #名称
Email Address  #邮箱
A challenge password  #私钥保护密码
An optional company name  #可选的公司名称

openssl x509 -req -days 3650 -in server.csr -signkey server.key -out server.crt    
#利用证书请求文件生成自签证书

2nginx的代理实现

前面已经把包放到/usr目录下解压，修改一下名字，改为nginx。然后再把/usr/nginx/conf/nginx.conf，全部替换

# For more information on configuration, see:
#   * Official English Documentation: http://nginx.org/en/docs/
#   * Official Russian Documentation: http://nginx.org/ru/docs/

#user nginx;
worker_processes auto;
#error_log /data/log/nginx/error.log;
#pid /run/nginx.pid;

events {
    worker_connections 10240;
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;
    server_tokens       off;

    include             /usr/nginx/conf/mime.types;
    default_type        application/octet-stream;
    
    include             /usr/nginx/conf/conf.d/test1.conf;
    include             /usr/nginx/conf/conf.d/test2.conf;
}

 替换完之后在/usr/nginx/conf/目录下创建一个conf.d文件夹

在conf.d文件夹下创建test1.conf和test2.conf文件来简述两种代理

vi  test1.conf

#复制下列

server {
    listen 8888;

    location / {
        proxy_set_header Host $host:$server_port; 
        proxy_set_header X-Real-IP $remote_addr; 
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 
        proxy_set_header X-Forwarded-Proto $scheme; 
        client_max_body_size    10m;
        client_body_buffer_size 128k;
        proxy_buffer_size       4k;
        proxy_buffers           4 32k;
        proxy_busy_buffers_size 64k;
        proxy_temp_file_write_size 64k;
        proxy_connect_timeout   30;
        proxy_send_timeout      60;
        proxy_read_timeout      300;
        proxy_pass https://center.mkeysec.net/; #该地方的域名地址为被代理地址
    }
}

vi  test2.conf


#复制下列

#nginx做负载均衡，按照不同权重分配业务
#upstream device {
#   server 192.168.1.236:8080 weight=2;
#   server 192.168.1.237:8080 weight=1;
#}

upstream device {
   server 192.168.1.236:8080;
}


server {
    listen *:8443 ssl;
    ssl_certificate /usr/local/nginx/ssl_cert/server.crt; 
    ssl_certificate_key /usr/local/nginx/ssl_cert/server.key; 
    ssl_session_timeout  5m; 
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; 
    ssl_ciphers  HIGH:!aNULL:!MD5:!3DES; 
    ssl_prefer_server_ciphers  on; 

    location / {
        proxy_set_header Host $host:$server_port; 
        proxy_set_header X-Real-IP $remote_addr; 
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 
        proxy_set_header X-Forwarded-Proto $scheme; 
		add_header Content-Security-Policy upgrade-insecure-requests; #这里是处理https反向代理http静态资源的关键
        client_max_body_size    10m;
        client_body_buffer_size 128k;
        proxy_buffer_size       4k;
        proxy_buffers           4 32k;
        proxy_busy_buffers_size 64k;
        proxy_temp_file_write_size 64k;
        proxy_connect_timeout   30;
        proxy_send_timeout      60;
        proxy_read_timeout      300;
        proxy_pass http://device/; 
		proxy_redirect  http://   https://;             #修改response中的location中的协议http为https外网访问的协议
    }



	
	####如果是代理云服务模式，可参考以下回调配置方法，不需要则删除
	
	#代理内网回调地址
	#若本监听端口的外网地址为：https://192.168.1.123:333/
	location ^~ /back/ {
        if ($request_uri ~ /back/(.*)){
            set $backurl $1;
        }
        proxy_pass $backurl;
    }

}

在test2.conf中，把下面两个ip换成我们弄的双机热备虚拟ip就能实现四台设备处理业务了。