 HAProxy是一种免费，非常快速且可靠的解决方案，可为基于TCP和HTTP的应用程序提供 高可用性， 负载平衡和代理。它特别适合于流量非常高的网站，并为世界上许多访问量最大的网站提供支持。多年来，它已成为事实上的标准开源负载平衡器，现在随大多数主流Linux发行版一起提供，并且通常默认情况下部署在云平台中。由于它不会自行宣传，因此我们仅在管理员报告它时才知道它是否使用:-)
它的操作模式使其非常容易且无风险地集成到现有体系结构中，同时仍提供了不将脆弱的Web服务器暴露在网上的可能性，如下所示：
 实验前准备工作（系统centos7.5）
1.开启转发功能
echo "net.ipv4.ip_forward = 1" >>/etc/sysctl.conf
sysctl -p
注：开启监听本地不存在的IP
echo "net.ipv4.ip_nonlocal_bind = 1" >>/etc/sysctl.conf
2.关闭防火墙
systemctl stop iptables
3.关闭selinux
setenforce 0
sed -i 's/^SELINUX=/SELINUX=disabled/g' /etc/sysconfig/selinux
4.1 yum安装
# yum install -y haproxy
# haproxy -v
HA-Proxy version 1.5.18 2016/05/10
Copyright 2000-2016 Willy Tarreau <willy@>
yum安装的版本较旧，如果要使用新版本建议编译安装
4.2 编译安装
yum -y install gcc gcc-c++ autoconf automake zlib zlib-devel openssl openssl-devel pcre-devel systemd-devel
tar -xvf haproxy-1.8.23.tar.gz
cd haproxy-1.8.23/
make ARCH=x86_64 TARGET=linux2628 USE_PCRE=1 USE_OPENSSL=1 USE_ZLIB=1 USE_SYSTEMD=1 USE_CPU_AFFINITY=1 PREFIX=/usr/local/haproxy
make install PREFIX=/usr/local/haproxy
cp haproxy /usr/sbin/
注：make时报错，可以使用make clean清除上次make的残留文件
创建启动脚本：
# cat /usr/lib/systemd/system/haproxy.service
[Unit]
Description=HAProxyLoad Balancer
After=syslog.targetnetwork.target
[Service]
ExecStartPre=/usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg -c -q
ExecStart=/usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid
ExecReload=/bin/kill -USR2 $MAINPID
[Install]
WantedBy=multi-user.target
创建目录和用户：
mkdir /etc/haproxy
useradd haproxy -s /sbin/nologin
mkdir /var/lib/haproxy
chown haproxy.haproxy /var/lib/haproxy/ -R
systemctl restart haproxy
cat /etc/haproxy/haproxy.cfg
……
haproxy.cfg文件中定义了chroot、pidfile、user、group等参数，如果系统没有相应的资源会导致haproxy无法启动，具体参考日志文件/var/log/messages
启动HAProxy：
初始配置文件
# find ./* -name '*.cfg'
./examples/acl-content-sw.cfg
./examples/auth.cfg
./examples/content-sw-sample.cfg
./examples/option-http_proxy.cfg
./examples/ssl.cfg
./examples/transparent_proxy.cfg
./examples/wurfl-example.cfg
# cp ./examples/option-http_proxy.cfg /etc/haproxy/haproxy.cfg
systemctl enable haproxy
systemctl restart haproxy
初始配置文件如下：
# cat /etc/haproxy/haproxy.cfg
#
# demo config for Proxy mode
#
global
maxconn 20000
ulimit-n 16384
log 127.0.0.1 local0
uid 200
gid 200
chroot /var/empty
nbproc 4
daemon
frontend test-proxy
bind 0.0.0.0:8080
mode http
log global
option httplog
option dontlognull
option nolinger
option http_proxy
maxconn 8000
timeout client 30s
# layer3: Valid users
acl allow_host src 192.168.200.150/32
http-request deny if !allow_host
# layer7: prevent private network relaying
acl forbidden_dst url_ip 192.168.0.0/24
acl forbidden_dst url_ip 172.16.0.0/12
acl forbidden_dst url_ip 10.0.0.0/8
http-request deny if forbidden_dst
default_backend test-proxy-srv
backend test-proxy-srv
mode http
timeout connect 5s
timeout server 5s
retries 2
option nolinger
option http_proxy
# layer7: Only GET method is valid
acl valid_method method GET
http-request deny if !valid_method
# layer7: protect bad reply
http-response deny if { res.hdr(content-type) audio/mp3 }
查看haproxy正常运行后的状态
# systemctl status haproxy
● haproxy.service - HAProxyLoad Balancer
Loaded: loaded (/usr/lib/systemd/system/haproxy.service; enabled; vendor preset: disabled)
Active: active (running) since Wed 2020-01-08 15:20:10 CST; 6s ago
Process: 5563 ExecStartPre=/usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg -c -q (code=exited, status=0/SUCCESS)
Main PID: 5564 (haproxy)
CGroup: /system.slice/haproxy.service
├─5564 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid
├─5566 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid
├─5567 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid
├─5568 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid
└─5569 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid
Jan 08 15:20:10 nova-create-vm1.novalocal systemd[1]: haproxy.service: main process exited, code=exited, status=143/n/a
Jan 08 15:20:10 nova-create-vm1.novalocal systemd[1]: Stopped HAProxyLoad Balancer.
Jan 08 15:20:10 nova-create-vm1.novalocal systemd[1]: Unit haproxy.service entered failed state.
Jan 08 15:20:10 nova-create-vm1.novalocal systemd[1]: haproxy.service failed.
Jan 08 15:20:10 nova-create-vm1.novalocal systemd[1]: Starting HAProxyLoad Balancer...
Jan 08 15:20:10 nova-create-vm1.novalocal systemd[1]: Started HAProxyLoad Balancer.
# netstat -tnlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 1038/master
tcp 0 0 0.0.0.0:8080 0.0.0.0:* LISTEN 5566/haproxy
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1070/sshd
tcp6 0 0 ::1:25 :::* LISTEN 1038/master
tcp6 0 0 :::22 :::* LISTEN 1070/sshd
查看haproxy的编译参数
# haproxy -vv
HA-Proxy version 1.8.23 2019/11/25
Copyright 2000-2019 Willy Tarreau <willy@>
Build options :
TARGET = linux2628
CPU = generic
CC = gcc
CFLAGS = -m64 -march=x86-64 -O2 -g -fno-strict-aliasing -Wdeclaration-after-statement -fwrapv -Wno-unused-label
OPTIONS = USE_ZLIB=1 USE_CPU_AFFINITY=1 USE_OPENSSL=1 USE_SYSTEMD=1 USE_PCRE=1
Default settings :
maxconn = 2000, bufsize = 16384, maxrewrite = 1024, maxpollevents = 200
Built with OpenSSL version : OpenSSL 1.0.2k-fips 26 Jan 2017
Running on OpenSSL version : OpenSSL 1.0.2k-fips 26 Jan 2017
OpenSSL library supports TLS extensions : yes
OpenSSL library supports SNI : yes
OpenSSL library supports : SSLv3 TLSv1.0 TLSv1.1 TLSv1.2
Built with transparent proxy support using: IP_TRANSPARENT IPV6_TRANSPARENT IP_FREEBIND
Encrypted password support via crypt(3): yes
Built with multi-threading support.
Built with PCRE version : 8.32 2012-11-30
Running on PCRE version : 8.32 2012-11-30
PCRE library supports JIT : no (USE_PCRE_JIT not set)
Built with zlib version : 1.2.7
Running on zlib version : 1.2.7
Compression algorithms supported : identity("identity"), deflate("deflate"), raw-deflate("deflate"), gzip("gzip")
Built with network namespace support.
Available polling systems :
epoll : pref=300, test result OK
poll : pref=200, test result OK
select : pref=150, test result OK
Total: 3 (3 usable), will use epoll.
Available filters :
[SPOE] spoe
[COMP] compression
[TRACE] trace
haproxy.cfg参数详解
HAProxy组成
程序环境：
主程序：/usr/sbin/haproxy
配置文件：/etc/haproxy/haproxy.cfg
Unit file：/usr/lib/systemd/system/haproxy.service
配置段：
global：全局配置段
进程及安全配置相关的参数
性能调整相关参数
Debug参数
proxies：代理配置段
defaults：为frontend, backend, listen提供默认配置
frontend：前端，相当于nginx中的server {}
backend：后端，相当于nginx中的upstream {}
listen：同时拥有前端和后端配置
Haproxy配置-global
global配置参数：
https://cbonte./haproxy-dconv/1.8/configuration.html#3
chroot#锁定运行目录
deamon#以守护进程运行
#stats socket /var/lib/haproxy/haproxy.sockmode 600 level admin #socket文件
user, group, uid, gid#运行haproxy的用户身份
nbproc#开启的haproxy进程数，与CPU保持一致
nbthread#指定每个haproxy进程开启的线程数，默认为每个进程一个线程
cpu-map 1 0 #绑定haproxy进程至指定CPU
maxconn#每个haproxy进程的最大并发连接数
maxsslconn#SSL每个haproxy进程ssl最大连接数
maxconnrate#每个进程每秒最大连接数
spread-checks #后端server状态check随机提前或延迟百分比时间，建议2-5(20%-50%)之间
pidfile#指定pid文件路径
log 127.0.0.1 local3 info #定义全局的syslog服务器；最多可以定义两个
HAProxy Proxies配置
defaults [<name>] #默认配置项，针对以下的frontend、backend和lsiten生效，可以多个name
frontend <name> #前端servername，类似于Nginx的一个虚拟主机server。
backend <name> #后端服务器组，等于nginx的upstream
listen <name> #将frontend和backend合并在一起配置
注：name字段只能使用”-”、”_”、”.”、和”:”，并且严格区分大小写，例如：Web和web是完全不同的两组服务器。
Proxies配置-defaults
defaults 配置参数：
option redispatch #当server Id对应的服务器挂掉后，强制定向到其他健康的服务器
option abortonclose #当服务器负载很高的时候，自动结束掉当前队列处理比较久的链接
option http-keep-alive 60#开启会话保持
option forwardfor #开启IP透传
mode http #默认工作类型
timeout connect 120s #转发客户端请求到后端server的最长连接时间(TCP之前)
timeout server 600s #转发客户端请求到后端服务端的超时超时时长（TCP之后）
timeout client 600s #与客户端的最长空闲时间
timeout http-keep-alive 120s #session 会话保持超时时间，范围内会转发到相同的后端服务器
#timeout check 5s #对后端服务器的检测超时时间
Proxies配置-frontend配置参数
bind：指定HAProxy的监听地址，可以是IPV4或IPV6，可以同时监听多个IP或端口，可同时用于listen字段中
bind [<address>]:<port_range> [, ...] [param*]
mode http/tcp #指定负载协议类型
use_backend backend_name #调用的后端服务器组名称
示例：
frontend WEB_PORT
bind :80,:8080
bind 192.168.7.102:10080,192.168.7.102:10043
use_backend backend_name
Proxies配置-backend配置参数
mode http/tcp #指定负载协议类型
option #配置选项
server #定义后端realserver
注意：option后面加httpchk，smtpchk, mysql-check, pgsql-check，ssl-hello-chk方法，可用于实现更多应用层检测功能。
后端服务器状态监测及相关配置
check #对指定real进行健康状态检查，默认不开启
addr IP#可指定的健康状态监测IP
port num#指定的健康状态监测端口
inter num#健康状态检查间隔时间，默认2000 ms
fall num#后端服务器失效检查次数，默认为3
rise num#后端服务器从下线恢复检查次数，默认为2
weight #默认为1，最大值为256，0表示不参与负载均衡
backup #将后端服务器标记为备份状态
disabled #将后端服务器标记为不可用状态
redirect prefix http://www./#将请求临时重定向至其它URL，只适用于http模式
maxconn <maxconn>：当前后端server的最大并发连接数
backlog <backlog>：当server的连接数达到上限后的后援队列长度
案例环境
centos7-vm1 172.16.99.117 192.168.9.109 web1
centos7-vm2 172.16.99.114 192.168.9.102 web2
nova-create-vm1 172.16.99.131 192.168.9.211 nginx proxy #
frontend/ backend 配置案例
[root@nova-create-vm1 ~]# cat /etc/haproxy/haproxy.cfg
global
maxconn 65535
ulimit-n 131111
log 127.0.0.1 local3 info
user haproxy
group haproxy
chroot /var/lib/haproxy
nbproc 6
nbthread 3
daemon
defaults
option http-keep-alive
maxconn 65536
mode http
timeout connect 5000ms
timeout client 50000ms
timeout server 50000ms
listen admin_stats
bind 0.0.0.0:1080
mode http
maxconn 10
stats enable
stats refresh 30s
stats uri /haproxy_status
stats auth admin:admin
stats hide-version
frontend WEB_PORT_80
bind 0.0.0.0:80
mode http
use_backend web_port_http_nodes
backend web_port_http_nodes
mode http
option forwardfor
server centos7-vm1 192.168.9.109:80 check inter 3000 fall 3 rise 5
server centos7-vm2 192.168.9.102:80 check inter 3000 fall 3 rise 5
frontend MYSQL_PORT_3306
bind 0.0.0.0:80
mode tcp
use_backend mysql_port_nodes
backend mysql_port_nodes
mode tcp
server centos7-vm1_mysql-node1 172.16.99.117:3306 check inter 3000 fall 3 rise 5
server centos7-vm2_mysql-node2 172.16.99.114:3306 check inter 3000 fall 3 rise 5
返回结果
# for i in `seq 10` ;do curl -L http://172.16.99.131/ ;done
centos7-vm2 172.16.99.114 192.168.9.102 web2
centos7-vm1 172.16.99.117 192.168.9.109 web1
centos7-vm2 172.16.99.114 192.168.9.102 web2
centos7-vm1 172.16.99.117 192.168.9.109 web1
centos7-vm2 172.16.99.114 192.168.9.102 web2
centos7-vm1 172.16.99.117 192.168.9.109 web1
centos7-vm2 172.16.99.114 192.168.9.102 web2
centos7-vm1 172.16.99.117 192.168.9.109 web1
centos7-vm2 172.16.99.114 192.168.9.102 web2
centos7-vm1 172.16.99.117 192.168.9.109 web1
Proxies配置-listen
使用listen替换frontend和backend的配置方式：
使用http模式
listen WEB_PORT_80
bind 0.0.0.0:80
mode http
option forwardfor
server centos7-vm1 192.168.9.109:80 check inter 3000 fall 3 rise 5
server centos7-vm2 192.168.9.102:80 check inter 3000 fall 3 rise 5
或者使用TCP模式
listen WEB_PORT_80
bind 0.0.0.0:80
mode tcp
server centos7-vm1 192.168.9.109:80 check inter 3000 fall 3 rise 5
server centos7-vm2 192.168.9.102:80 check inter 3000 fall 3 rise 5
listen MYSQL_PORT_3306
bind 0.0.0.0:3306
mode tcp
server centos7-vm1_mysql-node1 172.16.99.117:3306 check inter 3000 fall 3 rise 5
server centos7-vm2_mysql-node2 172.16.99.114:3306 check inter 3000 fall 3 rise 5
返回结果
web页面测试结果
# for i in `seq 10` ;do curl -L http://172.16.99.131/ ;done
centos7-vm2 172.16.99.114 192.168.9.102 web2
centos7-vm1 172.16.99.117 192.168.9.109 web1
centos7-vm2 172.16.99.114 192.168.9.102 web2
centos7-vm1 172.16.99.117 192.168.9.109 web1
centos7-vm2 172.16.99.114 192.168.9.102 web2
centos7-vm1 172.16.99.117 192.168.9.109 web1
centos7-vm2 172.16.99.114 192.168.9.102 web2
centos7-vm1 172.16.99.117 192.168.9.109 web1
centos7-vm2 172.16.99.114 192.168.9.102 web2
centos7-vm1 172.16.99.117 192.168.9.109 web1
使用TCP模式反向代理mysql集群的测试结果
# for i in `seq 10`;do mysql -h172.16.99.131 -uroot -p'123456' -e "show status like 'wsrep_gcomm_%';" | grep wsrep ;done
wsrep_gcomm_uuid 8be166cf-31d6-11ea-a4cf-7f05a956f41d
wsrep_gcomm_uuid 1a346279-31d6-11ea-b372-3a1907be8814
wsrep_gcomm_uuid 8be166cf-31d6-11ea-a4cf-7f05a956f41d
wsrep_gcomm_uuid 1a346279-31d6-11ea-b372-3a1907be8814
wsrep_gcomm_uuid 8be166cf-31d6-11ea-a4cf-7f05a956f41d
wsrep_gcomm_uuid 1a346279-31d6-11ea-b372-3a1907be8814
wsrep_gcomm_uuid 8be166cf-31d6-11ea-a4cf-7f05a956f41d
wsrep_gcomm_uuid 1a346279-31d6-11ea-b372-3a1907be8814
wsrep_gcomm_uuid 8be166cf-31d6-11ea-a4cf-7f05a956f41d
wsrep_gcomm_uuid 1a346279-31d6-11ea-b372-3a1907be8814
注：上面TCP案例的完整配置
global
maxconn 65535
ulimit-n 131111
log 127.0.0.1 local3 info
user haproxy
group haproxy
chroot /var/lib/haproxy
nbproc 6
nbthread 3
daemon
defaults
option http-keep-alive
maxconn 65536
mode http
timeout connect 5000ms
timeout client 50000ms
timeout server 50000ms
listen admin_stats
bind 0.0.0.0:1080
mode http
maxconn 10
stats enable
stats refresh 30s
stats uri /haproxy_status
stats auth admin:admin
stats hide-version
listen WEB_PORT_80
bind 172.16.99.131:80
mode tcp
server centos7-vm1 192.168.9.109:80 check inter 3000 fall 3 rise 5
server centos7-vm2 192.168.9.102:80 check inter 3000 fall 3 rise 5
listen MYSQL_PORT_3306
bind 172.16.99.131:3306
mode tcp
server centos7-vm1_mysql-node1 172.16.99.117:3306 check inter 3000 fall 3 rise 5
server centos7-vm2_mysql-node2 172.16.99.114:3306 check inter 3000 fall 3 rise 5
配置支持多进程多线程
haproxy.cfg的global配置下添加或修改
nbproc 6
nbthread 3
#systemctl reload haproxy
# ps -ef | grep haproxy
root 1999 1 0 14:30 ? 00:00:00 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -sf 2024 2025 2026 2027
haproxy 2046 1999 0 14:32 ? 00:00:00 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -sf 2024 2025 2026 2027
haproxy 2047 1999 0 14:32 ? 00:00:00 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -sf 2024 2025 2026 2027
haproxy 2048 1999 0 14:32 ? 00:00:00 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -sf 2024 2025 2026 2027
haproxy 2049 1999 0 14:32 ? 00:00:00 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -sf 2024 2025 2026 2027
haproxy 2050 1999 0 14:32 ? 00:00:00 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -sf 2024 2025 2026 2027
haproxy 2051 1999 0 14:32 ? 00:00:00 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -sf 2024 2025 2026 2027
# # pstree -p 1999
haproxy(1999)─┬─haproxy(2046)─┬─{haproxy}(2058)
│ └─{haproxy}(2059)
├─haproxy(2047)─┬─{haproxy}(2060)
│ └─{haproxy}(2061)
├─haproxy(2048)─┬─{haproxy}(2056)
│ └─{haproxy}(2057)
├─haproxy(2049)─┬─{haproxy}(2064)
│ └─{haproxy}(2065)
├─haproxy(2050)─┬─{haproxy}(2062)
│ └─{haproxy}(2063)
└─haproxy(2051)─┬─{haproxy}(2054)
└─{haproxy}(2055)
● haproxy.service - HAProxyLoad Balancer
Loaded: loaded (/usr/lib/systemd/system/haproxy.service; enabled; vendor preset: disabled)
Active: active (running) since Fri 2020-01-10 14:30:40 CST; 4min 40s ago
Process: 2045 ExecReload=/bin/kill -USR2 $MAINPID (code=exited, status=0/SUCCESS)
Process: 1998 ExecStartPre=/usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg -c -q (code=exited, status=0/SUCCESS)
Main PID: 1999 (haproxy)
CGroup: /system.slice/haproxy.service
├─1999 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -sf 2024 2025 2026 2027
├─2046 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -sf 2024 2025 2026 2027
├─2047 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -sf 2024 2025 2026 2027
├─2048 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -sf 2024 2025 2026 2027
├─2049 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -sf 2024 2025 2026 2027
├─2050 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -sf 2024 2025 2026 2027
└─2051 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -sf 2024 2025 2026 2027
Jan 10 14:31:33 nova-create-vm1.novalocal haproxy[1999]: [WARNING] 009/143133 (1999) : Former worker 2006 exited with code 0
Jan 10 14:31:33 nova-create-vm1.novalocal haproxy[1999]: [WARNING] 009/143133 (1999) : Former worker 2003 exited with code 0
Jan 10 14:32:57 nova-create-vm1.novalocal systemd[1]: Reloading HAProxyLoad Balancer.
Jan 10 14:32:57 nova-create-vm1.novalocal systemd[1]: Reloaded HAProxyLoad Balancer.
Jan 10 14:32:57 nova-create-vm1.novalocal haproxy[1999]: [WARNING] 009/143133 (1999) : Reexecuting Master process
检查haproxy配置语法是否正确
# haproxy -f /etc/haproxy/haproxy.cfg -c
Configuration file is valid
启动haproxy服务
systemctl start haproxy
systemctl enable haproxy
#下面的配置为haproxy web监控，可以不需要
listen admin_stats
bind 0.0.0.0:1080
mode http
maxconn 10
stats enable
stats refresh 30s
stats uri /haproxy_status
stats auth admin:admin
stats hide-version
 |
|
|
来自： 三十的狼 > 《rabbitmq》
