配置高可用HAProxy
安装：haproxy
- 安装准备
修改内核参数，启用：路由转发
sed -r -i -e 's/(^[ \t]*net.ipv4.ip_forward[ \t]*=[ \t]*).*/\1 1/' /etc/sysctl.conf
sysctl -p
net.ipv4.ip_forward = 1
……
```
修改内核参数，添加：<net.ipv4.ip_nonlocal_bind = 1>参数，好让HAProxy可以绑定KeepAlived的虚拟IP地址。
```
grep -E "^[ \t]*net.ipv4.ip_nonlocal_bind[ \t]*=" /etc/sysctl.conf && y="yes" || y="no"
if [[ $y == "yes" ]]; then
sed -r -i -e 's/(^[ \t]*net.ipv4.ip_nonlocal_bind[ \t]*=[ \t]*).*/\1 1/' /etc/sysctl.conf
else
echo "net.ipv4.ip_nonlocal_bind = 1" >> /etc/sysctl.conf
fi
sysctl -p
……
net.ipv4.ip_nonlocal_bind = 1
```
2. 安装haproxy
```
yum install haproxy -y
```
3. 启动haproxy服务
```
chkconfig haproxy on
service haproxy start
```
4. 查看haproxy服务进程及端口号
```
netstat -tunlp |grep haproxy
tcp 0 0 0.0.0.0:5000 0.0.0.0:* LISTEN 19349/haproxy
udp 0 0 0.0.0.0:37648 0.0.0.0:* 19349/haproxy
```
#### 配置HAProxy
1. 创建：<SSL证书及私钥>
```
openssl genrsa -out server.key 2048
Generating RSA private key, 2048 bit long modulus
...............+++
.....+++
e is 65537 (0x10001)
openssl req -new -key server.key -out server.csr
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HB
Locality Name (eg, city) [Default City]:WUHAN
Organization Name (eg, company) [Default Company Ltd]:WYHF
Organizational Unit Name (eg, section) []:TEACH
Common Name (eg, your name or your server's hostname) []:one.com
Email Address []:li@qq.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: <---- 直接回车
An optional company name []: <---- 直接回车
openssl x509 -req -days 3650 -in server.csr -signkey server.key -out server.crt
Signature ok
subject=/C=CN/ST=HB/L=wh/O=wyhf/OU=one.com/CN=one.com/emailAddress=li@qq.com
Getting Private key
ll ./server*
-rw-r--r--. 1 root root 1237 1月 12 17:51 ./server.crt
-rw-r--r--. 1 root root 1021 1月 12 17:50 ./server.csr
-rw-r--r--. 1 root root 1675 1月 12 17:50 ./server.key
```
在创建了证书之后，我们需要创建 pem 文件（pem 文件本质上只是将证书、密钥及证书认证中心证书（可有可无）拼接成一个文件）。
```
cat ./server.crt ./server.key | tee ./server.pem
\cp ./server.pem /etc/haproxy/
cat /etc/haproxy/server.pem
```
2. 备份配置文件
```
test -f /etc/haproxy/haproxy.cfg.bak ||cp /etc/haproxy/haproxy.cfg /etc/haproxy/haproxy.cfg.bak
sed -r -i -n -e '/(^[ \t]*#|^[ \t]*$)/d;p' /etc/haproxy/haproxy.cfg
```
3. haproxy.cfg配置文件
```
cat >/etc/haproxy/haproxy.cfg<<EOF
global
log 127.0.0.1 local2
chroot /var/lib/haproxy
pidfile /var/run/haproxy.pid
maxconn 4000
user haproxy
group haproxy
daemon
stats socket /var/lib/haproxy/stats
## 不验证后端SSL证书，完全信任
ssl-server-verify none
defaults
mode http
log global
option httplog
option dontlognull
option http-server-close
## 在后面的tcp模式中，不支持option forwardfor参数
## option forwardfor except 127.0.0.0/8
option redispatch
retries 3
timeout http-request 10s
timeout queue 1m
timeout connect 10s
timeout client 1m
timeout server 1m
timeout http-keep-alive 10s
timeout check 10s
maxconn 3000
## 正常网站的负载均衡 ##
frontend proxy01 *:80
bind 192.168.10.100:80
## 通过<option forwardfor参数>来插入<客户端信息>，如：客户端IP地址，从而让<后端Web服务器>的日志，可以记录<真实客户端>的<请求来源>
option forwardfor except 127.0.0.0/8
acl hostname01 hdr_beg(host) -i web01.one.com
acl hostname02 hdr_beg(host) -i web02.one.com
use_backend webservers-01 if hostname01
use_backend webservers-02 if hostname02
backend webservers-01
balance roundrobin
server web01 192.168.10.10:80 check
backend webservers-02
balance roundrobin
server web01 192.168.10.11:80 check
## 针对<后端安全SSL网站>，直接将<客户端>的<HTTPS请求>穿透式转发给<后端安全SSL网站> ##
frontend proxy02 *:443
mode tcp
## tcp模式中，不支持httplog日志
option tcplog
bind 192.168.10.100:443
use_backend webservers-SSL
backend webservers-SSL
mode tcp
balance roundrobin
## option ssl-hello-chk用来检查连接及其处理SSL（特别是SSLv3）连接的能力
option ssl-hello-chk
server web01 192.168.10.11:443 check
server web02 192.168.10.10:443 check
EOF
cat /etc/haproxy/haproxy.cfg
```
