Desde RH7 se dio por descartado piranha en favor de haproxy y keepalived
Un sistema limpio .. estoy armando un kuine con eso
Monte haproxy con apt-get install haproxy .. y por ahi hay un resto de utilidades mas
HIcimos algo parecido a lo que ya se ha hecho con LVS o piranha. Montamos un servidor al frente con dos interfaces una publica y una privada.
Se monta un frontend de 8080 que reparte por capa 4 a los dos clientes.
Molesta algo .. pero toco con firewalld
root@45kuine64-haproxy:~# firewall-cmd –zone=external –list-all
external (active)
target: default
icmp-block-inversion: no
interfaces: enp0s3
sources:
services: ssh haproxy-8443 haproxy-8080 haproxy-http haproxy-https
ports: 2222/tcp 7443/tcp 199/tcp 161/udp
protocols:
masquerade: yes
forward-ports:
source-ports:
icmp-blocks:
rich rules:
Se definieron los servicios en /etc/firewalld/services
-
- https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/load_balancer_administration/index
- https://serversforhackers.com/c/load-balancing-with-haproxy
- https://www.digitalocean.com/community/tutorials/how-to-use-haproxy-to-set-up-http-load-balancing-on-an-ubuntu-vps
- https://www.upcloud.com/support/haproxy-load-balancer-centos/
- Para SSL http://virtuallyhyper.com/2013/05/configure-haproxy-to-load-balance-sites-with-ssl/
-
haproxy.cfg
global
log /dev/log local0
log /dev/log local1 notice
chroot /var/lib/haproxy
stats socket /run/haproxy/admin.sock mode 660 level admin
stats timeout 30s
user haproxy
group haproxy
daemon
# Default SSL material locations
ca-base /etc/ssl/certs
crt-base /etc/ssl/private
# Default ciphers to use on SSL-enabled listening sockets.
# For more information, see ciphers(1SSL). This list is from:
# https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
# An alternative list with additional directives can be obtained from
# https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=haproxy
ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS
ssl-default-bind-options no-sslv3
defaults
log global
mode http
option httplog
option dontlognull
option httpchk
timeout connect 5000
timeout client 50000
timeout server 50000
errorfile 400 /etc/haproxy/errors/400.http
errorfile 403 /etc/haproxy/errors/403.http
errorfile 408 /etc/haproxy/errors/408.http
errorfile 500 /etc/haproxy/errors/500.http
errorfile 502 /etc/haproxy/errors/502.http
errorfile 503 /etc/haproxy/errors/503.http
errorfile 504 /etc/haproxy/errors/504.http
frontend tmct
bind *:8080
stats uri /haproxy?stats
default_backend tomcats
backend tomcats
balance roundrobin
server web02 192.168.26.21:80 check
server web02 192.168.26.22:80 check
haproxy.cfg
global
log /dev/log local0
log /dev/log local1 notice
chroot /var/lib/haproxy
stats socket /run/haproxy/admin.sock mode 660 level admin
stats timeout 30s
user haproxy
group haproxy
daemon
defaults
log global
timeout connect 5000
timeout client 50000
timeout server 50000
frontend tmct
mode tcp
bind *:8443
stats uri /haproxy?stats
default_backend tomcats
backend tomcats
mode tcp
balance leastconn
stick-table type ip size 200k expire 30m
stick on src
server web01 10.160.103.45:8443 check
server web02 10.160.103.46:8443 check
FIN
Advertencia
Este documento es privado y es de u so exclusivo de sus autores y de SKINA TECH. Cualquier uso sin una autorización escrita es contra la ley de derechos de autor y de propiedad intelectual, y será motivo de una acción legal.
05-Junio-2018 J.E.Gomez v1.0 Primera version