HAProxy搭建HTTP和HTTPS负载均衡

HAProxy搭建HTTP负载均衡

环境说明：

主机名称	IP地址	需要安装的应用	系统版本
client	192.168.110.60	无	redhat 8.2
LB	192.168.110.11	haproxy	redhat 8.2
RS1	192.168.110.12	httpd	redhat 8.2
RS2	192.168.110.13	httpd	redhat 8.2

准备工作：

//关闭防火墙，selinux
#LB
[root@LB ~]# systemctl disable --now firewalld
Removed /etc/systemd/system/multi-user.target.wants/firewalld.service.
Removed /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
[root@LB ~]# sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config
[root@LB ~]# setenforce 0

#RS1
[root@RS1 ~]# systemctl disable --now firewalld
Removed /etc/systemd/system/multi-user.target.wants/firewalld.service.
Removed /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
[root@RS1 ~]# sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config
[root@RS1 ~]# setenforce 0

#RS2
[root@RS2 ~]# systemctl disable --now firewalld
Removed /etc/systemd/system/multi-user.target.wants/firewalld.service.
Removed /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
[root@RS2 ~]# sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config
[root@RS2 ~]# setenforce 0

开始部署：

安装haproxy

详细安装步骤请见：HAProxy安装与配置

配置各个负载的内核参数

//LB
#添加最后两行
[root@LB ~]# cat /etc/sysctl.conf 
# sysctl settings are defined through files in
# /usr/lib/sysctl.d/, /run/sysctl.d/, and /etc/sysctl.d/.
#
# Vendors settings live in /usr/lib/sysctl.d/.
# To override a whole file, create a new file with the same in
# /etc/sysctl.d/ and put new settings there. To override
# only specific settings, add a file with a lexically later
# name in /etc/sysctl.d/ and put new settings there.
#
# For more information, see sysctl.conf(5) and sysctl.d(5).
net.ipv4.ip_nonlocal_bind = 1
net.ipv4.ip_forward = 1

[root@LB ~]# sysctl -p
net.ipv4.ip_nonlocal_bind = 1
net.ipv4.ip_forward = 1

安装HTTPD服务

//RS1
#安装httpd
[root@RS1 ~]# yum -y install httpd

#设置开机自启
[root@RS1 ~]# systemctl enable --now httpd

#添加测试网页
[root@RS1 ~]# echo RS1 > /var/www/html/index.html

//RS2
#安装httpd
[root@RS2 ~]# yum -y install httpd

#设置开机自启
[root@RS2 ~]# systemctl enable --now httpd

#添加测试网页
[root@RS2 ~]# echo RS1 > /var/www/html/index.html

提供配置文件

//LB
#创建目录
[root@LB ~]# mkdir /etc/haproxy

#配置文件
[root@LB ~]# vim /etc/haproxy/haproxy.cfg

global
    daemon
    maxconn 256

defaults
    mode http
    timeout connect 5000ms
    timeout client 50000ms
    timeout server 50000ms

frontend http-in
    bind *:80
    default_backend servers

backend servers
    server web01 192.168.110.12:80
    server web02 192.168.110.13:80
    
#测试文件
[root@LB ~]# haproxy -f /etc/haproxy/haproxy.cfg -c
Configuration file is valid

启动服务

//LB
方式一：
#通过文件的方式直接启动
[root@LB ~]# haproxy -f /etc/haproxy/haproxy.cfg 
[root@LB ~]# ss -antl
State     Recv-Q     Send-Q         Local Address:Port         Peer Address:Port    
LISTEN    0          128                  0.0.0.0:22                0.0.0.0:*       
LISTEN    0          128                  0.0.0.0:80                0.0.0.0:*       
LISTEN    0          128                     [::]:22                   [::]:* 

方式二：
#编辑service文件，以守护进程的方式启动
[root@LB ~]# vim /usr/lib/systemd/system/haproxy.service
[Unit]
Description=HAProxy Load Balancer
After=syslog.target network.target

[Service]
ExecStartPre=/usr/local/haproxy/sbin/haproxy -f /etc/haproxy/haproxy.cfg   -c -q
ExecStart=/usr/local/haproxy/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg  -p /var/run/haproxy.pid
ExecReload=/bin/kill -USR2 $MAINPID

[Install]
WantedBy=multi-user.target

[root@LB ~]# systemctl daemon-reload
[root@LB ~]# systemctl enable --now haproxy
[root@LB ~]# ss -antl
State     Recv-Q     Send-Q         Local Address:Port         Peer Address:Port    
LISTEN    0          128                  0.0.0.0:22                0.0.0.0:*             
LISTEN    0          128                  0.0.0.0:80                0.0.0.0:*       
LISTEN    0          128                     [::]:22                   [::]:* 

client端访问测试

//client
#成功访问
[root@localhost ~]# curl 192.168.110.11
RS1
[root@localhost ~]# curl 192.168.110.11
RS2
[root@localhost ~]# curl 192.168.110.11
RS1
[root@localhost ~]# curl 192.168.110.11
RS2

网页访问测试

配置haproxy网页界面

//LB
#修改配置文件
[root@LB ~]# vim /etc/haproxy/haproxy.cfg 
#--------------全局配置----------------
global
    log 127.0.0.1 local0  info
    #log loghost local0 info
    maxconn 20480
#chroot /usr/local/haproxy
    pidfile /var/run/haproxy.pid
    #maxconn 4000
    user haproxy
    group haproxy
    daemon
#---------------------------------------------------------------------
#common defaults that all the 'listen' and 'backend' sections will
#use if not designated in their block
#---------------------------------------------------------------------
defaults
    mode http
    log global
    option dontlognull
    option httpclose
    option httplog
    #option forwardfor
    option redispatch
    balance roundrobin
    timeout connect 10s
    timeout client 10s
    timeout server 10s
    timeout check 10s
    maxconn 60000
    retries 3
#--------------统计页面配置------------------
listen admin_stats
    bind 0.0.0.0:8189
    stats enable
    mode http
    log global
    stats uri /haproxy_stats            //访问网页后缀URL
    stats realm Haproxy Statistics
    stats auth admin:admin              //用户名和密码
    #stats hide-version
    stats admin if TRUE
    stats refresh 30s
#---------------web设置-----------------------
listen webcluster
    bind 0.0.0.0:80
    mode http
    #option httpchk GET /index.html
    log global
    maxconn 3000
    balance roundrobin
    cookie SESSION_COOKIE insert indirect nocache
    server web01 192.168.110.12:80 check inter 2000 fall 5
    server web02 192.168.110.13:80 check inter 2000 fall 5
    #server web01 192.168.80.102:80 cookie web01 check inter 2000 fall 5

//重启haproxy服务
[root@LB]# systemctl restart haproxy
[root@LB]# ss -antl
State     Recv-Q     Send-Q         Local Address:Port         Peer Address:Port    
LISTEN    0          128                  0.0.0.0:22                0.0.0.0:*       
LISTEN    0          128                  0.0.0.0:8189              0.0.0.0:*       
LISTEN    0          128                  0.0.0.0:80                0.0.0.0:*       
LISTEN    0          128                     [::]:22                   [::]:* 

登录网页（访问LB的IP地址加配置文件网页的URL：192.168.110.11:8189）

输入用户名密码（admin：admin）

HAProxy搭建HTTPS负载均衡

准备工作和环境如上

开始部署：

开启HTTPS

在以上配置基础下进行

//RS1
#安装mod_ssl
[root@RS1 ~]# yum -y install mod_ssl

#重启httpd
[root@RS1 ~]# systemctl restart httpd

#查看443端口
[root@RS1 ~]# ss -antl
State     Recv-Q     Send-Q         Local Address:Port         Peer Address:Port    
LISTEN    0          128                  0.0.0.0:22                0.0.0.0:*       
LISTEN    0          128                  0.0.0.0:443               0.0.0.0:*       
LISTEN    0          128                  0.0.0.0:80                0.0.0.0:*       
LISTEN    0          128                     [::]:22                   [::]:*   

//RS1
#安装mod_ssl
[root@RS2 ~]# yum -y install mod_ssl

#重启httpd
[root@RS2 ~]# systemctl restart httpd

#查看443端口
[root@RS2 ~]# ss -antl
State     Recv-Q     Send-Q         Local Address:Port         Peer Address:Port    
LISTEN    0          128                  0.0.0.0:443               0.0.0.0:*       
LISTEN    0          128                  0.0.0.0:80                0.0.0.0:*       
LISTEN    0          128                  0.0.0.0:22                0.0.0.0:*       
LISTEN    0          128                     [::]:22                   [::]:*  

提供配置文件

//LB
#创建目录
[root@LB ~]# mkdir /var/lib/haproxy

#配置文件
[root@LB ~]# vim /etc/haproxy/haproxy.cfg 
global
    log 127.0.0.1 local2  info
    maxconn 20480
    chroot /usr/local/haproxy
    pidfile /var/run/haproxy.pid
    stats socket  /var/lib/haproxy/haproxy.sock mode 600 level admin
    user haproxy
    group haproxy
    daemon
    nbproc 1
    nbthread 4
    spread-checks 5

defaults
    mode http
    log global
    option dontlognull
    option httpclose
    option  http-keep-alive
    option redispatch
    balance roundrobin
    timeout connect 60s
    timeout client 30s
    timeout server 30s
    timeout check 10s
    maxconn 60000
    retries 3

listen https
    bind 0.0.0.0:443
    log global
    mode tcp
    balance  roundrobin 
    server web01 192.168.110.12:443 check inter 2s fall 3 rise 5
    server web02 192.168.110.13:443 check inter 2s fall 3 rise 5

重启服务

//LB
#测试文件
[root@LB ~]# haproxy -f /etc/haproxy/haproxy.cfg -c
Configuration file is valid

#重启haproxy
[root@LB ~]# systemctl restart haproxy

#查看443端口
[root@LB ~]# ss -antl
State     Recv-Q     Send-Q         Local Address:Port         Peer Address:Port    
LISTEN    0          128                  0.0.0.0:22                0.0.0.0:*       
LISTEN    0          128                  0.0.0.0:443               0.0.0.0:*       
LISTEN    0          128                     [::]:22                   [::]:*  

client访问测试

//client
#成功访问
[root@client ~]# curl -k https://192.168.110.11
RS1
[root@client ~]# curl -k https://192.168.110.11
RS2
[root@client ~]# curl -k https://192.168.110.11
RS1
[root@client ~]# curl -k https://192.168.110.11
RS2