Ich versuche, den HAproxy-Load Balancer auf CentOS 7 einzurichten, bekomme ihn jedoch nicht zum Laufen. Die Dienste sagen, dass er läuft, aber die Statistikseite öffnet sich nicht und führt auch nirgendwohin. Ich versuche, ihn als Load Balancer zu verwenden, um den Datenverkehr auf den ersten oder zweiten Server zu verschieben, der durch https gesichert ist. Der HAproxy selbst muss nicht durch https gesichert werden und ist es derzeit auch nicht. Im Moment habe ich die folgende Konfiguration:
#---------------------------------------------------------------------
# Example configuration for a possible web application. See the
# full configuration options online.
#
# http://haproxy.1wt.eu/download/1.4/doc/configuration.txt
#
#---------------------------------------------------------------------
#---------------------------------------------------------------------
# Global settings
#--------------------------------------------------------------------- global
# to have these messages end up in /var/log/haproxy.log you will
# need to:
#
# 1) configure syslog to accept network log events. This is done
# by adding the '-r' option to the SYSLOGD_OPTIONS in
# /etc/sysconfig/syslog
#
# 2) configure local2 events to go to the /var/log/haproxy.log
# file. A line like the following can be added to
# /etc/sysconfig/syslog
#
# local2.* /var/log/haproxy.log
#
log 127.0.0.1 local2
chroot /var/lib/haproxy
pidfile /var/run/haproxy.pid
maxconn 4000
user haproxy
group haproxy
daemon
# turn on stats unix socket
stats socket /var/lib/haproxy/stats
#---------------------------------------------------------------------
# common defaults that all the 'listen' and 'backend' sections will
# use if not designated in their block
#--------------------------------------------------------------------- defaults
mode http
log global
option httplog
option dontlognull
option http-server-close
option forwardfor except 127.0.0.0/8
option redispatch
retries 3
timeout http-request 10s
timeout queue 1m
timeout connect 10s
timeout client 1m
timeout server 1m
timeout http-keep-alive 10s
timeout check 10s
maxconn 3000
stats enable
stats auth haproxy:haproxy
stats uri /haproxy
#---------------------------------------------------------------------
# main frontend which proxys to the backends
#--------------------------------------------------------------------- frontend front
redirect scheme https code 301 if !{ ssl_fc }
bind *:80
mode http
default_backend app
#---------------------------------------------------------------------
# static backend for serving up images, stylesheets and such
#--------------------------------------------------------------------- backend app
mode http
balance roundrobin
option forwardfor
http-request set-header X-Forwarded-Port %[dst_port]
http-request add-header X-Forwarded-Proto https if { ssl_fc }
option httpchk HEAD / HTTP/1.1rnHost:localhost
server s1 192.168.14.65:443 check
server s2 192.168.14.200:443 check
#---------------------------------------------------------------------
# round robin balancing between the various backends
#--------------------------------------------------------------------- listen stats *:8080
mode http
log global
maxconn 10
clitimeout 100s
srvtimeout 100s
contimeout 100s
timeout queue 100s
stats refresh 30s stats show-node
die Logs zeigen nur folgendes:
Aug 21 16:06:00 localhost haproxy[11177]: Proxy front started.
Aug 21 16:06:00 localhost haproxy[11177]: Proxy app started.
Aug 21 16:10:08 localhost haproxy[11275]: Proxy front started.
Aug 21 16:10:08 localhost haproxy[11275]: Proxy app started.
Aug 21 16:10:08 localhost haproxy[11275]: Proxy stats started.
... aber nichts Nützlicheres. Wenn ich bei laufendem Dienst zu einer der in der Konfigurationsdatei beschriebenen IP-Adressen gehe, erhalte ich absolut nichts (Zeitüberschreitung).
Ich habe auch versucht, Timeouts zu entfernen, aber das hat nicht geholfen. Ich habe diese Nachrichten ohne Timeout erhalten:
Aug 21 16:52:27 localhost haproxy[11413]: Server app/s1 is DOWN, reason: Layer7 invalid response, info: "<15><03><03>", check duration: 399ms. 1 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue.
Aug 21 16:52:28 localhost haproxy[11413]: Server app/s2 is DOWN, reason: Layer7 invalid response, info: "<15><03><03>", check duration: 227ms. 0 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue.
Irgendwelche Ideen?
Antwort1
Ich habe es jetzt zum Laufen gebracht. Der Hauptschuldige war die Firewall, die Centos7 ausführte und die alle benötigten Ports blockierte. Außerdem musste ich meine Konfiguration ein wenig ändern, damit sie an das SSH-Backend weitergeleitet wird. Die endgültige Konfiguration sah so aus:
[root@rimilb ~]# cat /etc/haproxy/haproxy.cfg
#---------------------------------------------------------------------
# Example configuration for a possible web application. See the
# full configuration options online.
#
# http://haproxy.1wt.eu/download/1.4/doc/configuration.txt
#
#---------------------------------------------------------------------
#---------------------------------------------------------------------
# Global settings
#---------------------------------------------------------------------
global
# to have these messages end up in /var/log/haproxy.log you will
# need to:
#
# 1) configure syslog to accept network log events. This is done
# by adding the '-r' option to the SYSLOGD_OPTIONS in
# /etc/sysconfig/syslog
#
# 2) configure local2 events to go to the /var/log/haproxy.log
# file. A line like the following can be added to
# /etc/sysconfig/syslog
#
# local2.* /var/log/haproxy.log
#
log 127.0.0.1 local2
chroot /var/lib/haproxy
pidfile /var/run/haproxy.pid
maxconn 4000
user haproxy
group haproxy
daemon
# turn on stats unix socket
stats socket /var/lib/haproxy/stats
#---------------------------------------------------------------------
# common defaults that all the 'listen' and 'backend' sections will
# use if not designated in their block
#---------------------------------------------------------------------
defaults
mode http
log global
option httplog
option dontlognull
option http-server-close
option forwardfor except 127.0.0.0/8
option redispatch
retries 3
maxconn 3000
stats enable
stats auth haproxy:haproxy
stats uri /haproxy
#---------------------------------------------------------------------
# main frontend which proxys to the backends
#---------------------------------------------------------------------
frontend front
bind 192.168.14.251:80
reqadd X-Forwarded-Proto:\ http
default_backend app
#---------------------------------------------------------------------
# static backend for serving up images, stylesheets and such
#---------------------------------------------------------------------
backend app
balance roundrobin
server s1 192.168.14.65:443 weight 1 maxconn 100 check ssl verify none
server s2 192.168.14.200:443 weight 1 maxconn 100 check ssl verify none
#---------------------------------------------------------------------
# round robin balancing between the various backends
#---------------------------------------------------------------------
listen stats *:8080
mode http
log global
maxconn 10
clitimeout 100s
srvtimeout 100s
contimeout 100s
timeout queue 100s
stats refresh 30s
stats show-node