HAProxy常見的安裝方式
作者：尹正傑
版權聲明：原創作品，謝絕轉載！否則將追究法律責任。
一.常見負載均衡軟件概述
1>.什么是負載均衡
負載均衡(Load Balance，簡稱LB)是一種服務或基於硬件設備等實現的高可用反向代理技術，負載均衡將特定的業務(web服務、網絡流量等)分擔給指定的一個或多個后端特定的服務器或設備，從而提高了公司業務的並發處理能力、保證了業務的高可用性、方便了業務后期的水平動態擴展。 博主推薦閱讀: https://yq.aliyun.com/articles/1803
2>.為什么使用負載均衡
Web服務器的動態水平擴展
對用戶無感知
增加業務並發訪問及處理能力
解決單服務器瓶頸問題(單點故障)
節約公網IP地址
降低IT支出成本
隱藏內部服務器IP
提高內部服務器安全性
配置簡單
固定格式的配置文件
功能豐富
支持四層和七層，支持動態下線主機
性能較強
並發數萬甚至數十萬
3>.常見有哪些負載均衡
軟件負載(一般選擇開源軟件)：
四層(可以和硬件防火牆相抗衡的性能)：
LVS(Linux Virtual Server，生產環境中大多使用DR模式性能要比HAProxy強)
HAProxy(High Availability Proxy，一般中小型公司使用HAproxy基本上夠用了)
Nginx(需要1.9版本以上才支持)
……
七層：
HAProxy(和Nginx一樣，都支持基於四層和七層的負載均衡)
Nginx(生產環境中小型企業一般使用HAProxy做四層的負載均衡，使用Nginx做七層的負載均衡)
……
硬件負載(需要花錢)：
F5
Netscaler
……
4>.典型的負載均衡應用場景
四層(傳輸層，一般基於監聽本地端口實現負載均衡)：
Redis
Mysql
RabbitMQ
Memcache
......
七層(應用層,直接反向代理到后端服務器)：
Nginx
Tomcat
Apache
PHP
圖片
動靜分離
API
......
二.HaProxy概述
1>.什么是HAProxy
HAProxy是法國開發者Willy Tarreau開發的一個開源軟件，是一款具備高並發、高性能的TCP和HTTP負載均衡器，支持基於cookie的持久性，自動故障切換，支持正則表達式及web狀態統計。 官網: http://www.haproxy.org https://www.haproxy.com 博主推薦閱讀: https://cbonte.github.io/haproxy-dconv/
2>.調度器集群(Load Balance Cluster,簡稱LB Cluster)
四層： lvs nginx(stream模式且nginx1.9.0或更新版本) haproxy(mode tcp) 七層： http協議: nginx(http), haproxy(mode http), httpd... 關於四層和七層的區別，博主推薦閱讀: https://www.cnblogs.com/yinzhengjie/p/12127959.html
3>.HAProxy功能
HAProxy是TCP/ HTTP反向代理服務器(不支持反向代理)，尤其適合於高可用性(需要依賴於keepalive軟件)高並發環境 可以針對HTTP請求添加cookie，進行路由后端服務器 可平衡負載至后端服務器，並支持持久連接(可以基於用戶的源地址進行hash) 支持基於cookie進行調度 支持所有主服務器故障切換至備用服務器 支持專用端口實現監控服務 支持不影響現有連接情況下停止接受新連接請求 可以在雙向添加，修改或刪除HTTP報文首部 支持基於pattern實現連接請求的訪問控制 通過特定的URI為授權用戶提供詳細的狀態信息 歷史版本更新功能：1.4 1.5 1.6 1.7 1.8 1.9 2.0-dev 1.8：多線程，HTTP/2緩存……(生產環境中推薦使用該版本) 1.7：服務器動態配置，多類型證書…… 1.6：DNS解析支持，HTTP連接多路復用…… 1.5：開始支持SSL，IPV6，keepalived……(CentOS 7.6的yum倉庫默認支持的版本，生產環境中並不推薦使用)
三.yum安裝HAProxy
1>.CentOS安裝HAProxy(溫馨提示:較新haproxy1.8版本中，比如動態禁用后端服務器，日志管理等功能支持的並沒有haproxy1.5系列要友好)
[root@node101.yinzhengjie.org.cn ~]# yum list haproxy Loaded plugins: fastestmirror Determining fastest mirrors * base: mirrors.huaweicloud.com * epel: mirrors.yun-idc.com * extras: mirrors.huaweicloud.com * updates: mirrors.huaweicloud.com Available Packages haproxy.x86_64 1.5.18-9.el7 base [root@node101.yinzhengjie.org.cn ~]#
[root@node101.yinzhengjie.org.cn ~]# yum -y install haproxy Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile epel/x86_64/metalink | 8.7 kB 00:00:00 * base: mirrors.huaweicloud.com * epel: mirrors.yun-idc.com * extras: mirrors.huaweicloud.com * updates: mirrors.huaweicloud.com base | 3.6 kB 00:00:00 extras | 2.9 kB 00:00:00 updates | 2.9 kB 00:00:00 Resolving Dependencies --> Running transaction check ---> Package haproxy.x86_64 0:1.5.18-9.el7 will be installed --> Finished Dependency Resolution Dependencies Resolved ============================================================================================================================================================================ Package Arch Version Repository Size ============================================================================================================================================================================ Installing: haproxy x86_64 1.5.18-9.el7 base 834 k Transaction Summary ============================================================================================================================================================================ Install 1 Package Total download size: 834 k Installed size: 2.6 M Downloading packages: haproxy-1.5.18-9.el7.x86_64.rpm | 834 kB 00:00:00 Running transaction check Running transaction test Transaction test succeeded Running transaction Installing : haproxy-1.5.18-9.el7.x86_64 1/1 Verifying : haproxy-1.5.18-9.el7.x86_64 1/1 Installed: haproxy.x86_64 0:1.5.18-9.el7 Complete! [root@node101.yinzhengjie.org.cn ~]# [root@node101.yinzhengjie.org.cn ~]#
[root@node101.yinzhengjie.org.cn ~]# haproxy -v #該版本測試用還行，但是生產環境中使用該版本在並發較高情況下估計會hold不住。 HA-Proxy version 1.5.18 2016/05/10 Copyright 2000-2016 Willy Tarreau <willy@haproxy.org> [root@node101.yinzhengjie.org.cn ~]#
[root@node101.yinzhengjie.org.cn ~]# ss -ntl State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 127.0.0.1:9000 *:* LISTEN 0 128 *:80 *:* LISTEN 0 128 *:22 *:* LISTEN 0 128 *:443 *:* LISTEN 0 128 :::22 :::* [root@node101.yinzhengjie.org.cn ~]# [root@node101.yinzhengjie.org.cn ~]# systemctl start haproxy [root@node101.yinzhengjie.org.cn ~]# [root@node101.yinzhengjie.org.cn ~]# ss -ntl State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 *:5000 *:* LISTEN 0 128 127.0.0.1:9000 *:* LISTEN 0 128 *:80 *:* LISTEN 0 128 *:22 *:* LISTEN 0 128 *:443 *:* LISTEN 0 128 :::22 :::* [root@node101.yinzhengjie.org.cn ~]# [root@node101.yinzhengjie.org.cn ~]# ps -ef | grep haproxy | grep -v grep root 15216 1 0 11:19 ? 00:00:00 /usr/sbin/haproxy-systemd-wrapper -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid haproxy 15217 15216 0 11:19 ? 00:00:00 /usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -Ds haproxy 15218 15217 0 11:19 ? 00:00:00 /usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -Ds [root@node101.yinzhengjie.org.cn ~]#
2>.Ubantu安裝HAProxy
[root@node201.yinzhengjie.org.cn ~]# apt-get install haproxy
3>.使用yum方式安裝較新的haproxy版本(僅供參考，如果非要安裝較新版本我還是推薦使用下面介紹的編譯安裝方式)
訪問"https://pkgs.org/"查看haproxy的軟件包yum安裝方式： https://centos.pkgs.org/7/ius-x86_64/haproxy18u-1.8.20-1.el7.ius.x86_64.rpm.html) 安裝步驟如下圖所示: wget https://centos7.iuscommunity.org/ius-release.rpm rpm -ivh ius-release.rpm yum -y install haproxy18u
四.編譯安裝HAProxy
1>.安裝依賴工具包
[root@node102.yinzhengjie.org.cn ~]# yum -y install gcc gcc-c++ glibc glibc-devel pcre pcre-devel openssl openssl-devel systemd-devel net-tools vim iotop bc zip unzip zlib-devel lrzsz tree screen lsof tcpdump wget ntpdate
2>.解壓haproxy軟件包
[root@node102.yinzhengjie.org.cn ~]# cd /usr/local/src/ [root@node102.yinzhengjie.org.cn /usr/local/src]# [root@node102.yinzhengjie.org.cn /usr/local/src]# ll #將haproxy軟件下載到服務器端 total 2036 -rw-r--r-- 1 root root 2083917 Dec 12 12:44 haproxy-1.8.20.tar.gz [root@node102.yinzhengjie.org.cn /usr/local/src]# [root@node102.yinzhengjie.org.cn /usr/local/src]# tar -xf haproxy-1.8.20.tar.gz #解壓haproxy軟件包 [root@node102.yinzhengjie.org.cn /usr/local/src]# [root@node102.yinzhengjie.org.cn /usr/local/src]# ll total 2036 drwxrwxr-x 11 root root 312 Apr 26 2019 haproxy-1.8.20 -rw-r--r-- 1 root root 2083917 Dec 12 12:44 haproxy-1.8.20.tar.gz [root@node102.yinzhengjie.org.cn /usr/local/src]# [root@node102.yinzhengjie.org.cn /usr/local/src]# ll haproxy-1.8.20 total 648 -rw-rw-r-- 1 root root 513114 Apr 26 2019 CHANGELOG drwxrwxr-x 18 root root 273 Apr 26 2019 contrib -rw-rw-r-- 1 root root 41508 Apr 26 2019 CONTRIBUTING drwxrwxr-x 5 root root 4096 Apr 26 2019 doc drwxrwxr-x 2 root root 4096 Apr 26 2019 ebtree drwxrwxr-x 3 root root 4096 Apr 26 2019 examples drwxrwxr-x 6 root root 60 Apr 26 2019 include -rw-rw-r-- 1 root root 2029 Apr 26 2019 LICENSE -rw-rw-r-- 1 root root 3087 Apr 26 2019 MAINTAINERS -rw-rw-r-- 1 root root 37713 Apr 26 2019 Makefile -rw-rw-r-- 1 root root 15355 Apr 26 2019 README drwxrwxr-x 5 root root 50 Apr 26 2019 reg-tests -rw-rw-r-- 1 root root 2713 Apr 26 2019 ROADMAP drwxrwxr-x 2 root root 101 Apr 26 2019 scripts drwxrwxr-x 2 root root 4096 Apr 26 2019 src -rw-rw-r-- 1 root root 14 Apr 26 2019 SUBVERS drwxrwxr-x 2 root root 4096 Apr 26 2019 tests -rw-rw-r-- 1 root root 24 Apr 26 2019 VERDATE -rw-rw-r-- 1 root root 7 Apr 26 2019 VERSION [root@node102.yinzhengjie.org.cn /usr/local/src]# [root@node102.yinzhengjie.org.cn /usr/local/src]#
3>.查看HAProxy的幫助文檔
[root@node102.yinzhengjie.org.cn /usr/local/src]# ll total 2036 drwxrwxr-x 11 root root 312 Apr 26 2019 haproxy-1.8.20 -rw-r--r-- 1 root root 2083917 Dec 12 12:44 haproxy-1.8.20.tar.gz [root@node102.yinzhengjie.org.cn /usr/local/src]# [root@node102.yinzhengjie.org.cn /usr/local/src]# [root@node102.yinzhengjie.org.cn /usr/local/src]# ll haproxy-1.8.20 total 648 -rw-rw-r-- 1 root root 513114 Apr 26 2019 CHANGELOG drwxrwxr-x 18 root root 273 Apr 26 2019 contrib -rw-rw-r-- 1 root root 41508 Apr 26 2019 CONTRIBUTING drwxrwxr-x 5 root root 4096 Apr 26 2019 doc drwxrwxr-x 2 root root 4096 Apr 26 2019 ebtree drwxrwxr-x 3 root root 4096 Apr 26 2019 examples drwxrwxr-x 6 root root 60 Apr 26 2019 include -rw-rw-r-- 1 root root 2029 Apr 26 2019 LICENSE -rw-rw-r-- 1 root root 3087 Apr 26 2019 MAINTAINERS -rw-rw-r-- 1 root root 37713 Apr 26 2019 Makefile -rw-rw-r-- 1 root root 15355 Apr 26 2019 README drwxrwxr-x 5 root root 50 Apr 26 2019 reg-tests -rw-rw-r-- 1 root root 2713 Apr 26 2019 ROADMAP drwxrwxr-x 2 root root 101 Apr 26 2019 scripts drwxrwxr-x 2 root root 4096 Apr 26 2019 src -rw-rw-r-- 1 root root 14 Apr 26 2019 SUBVERS drwxrwxr-x 2 root root 4096 Apr 26 2019 tests -rw-rw-r-- 1 root root 24 Apr 26 2019 VERDATE -rw-rw-r-- 1 root root 7 Apr 26 2019 VERSION [root@node102.yinzhengjie.org.cn /usr/local/src]# [root@node102.yinzhengjie.org.cn /usr/local/src]# [root@node102.yinzhengjie.org.cn /usr/local/src]# cat haproxy-1.8.20/README #查看HAProxy的幫助文檔 ---------------------- HAProxy how-to ---------------------- version 1.8 willy tarreau 2019/04/25 1) How to build it ------------------ This version is a stable version, which means that it belongs to a branch which will get some fixes for bugs as they are discovered. Versions which include the suffix "-dev" are development versions and should be avoided in production. If you are not used to build from sources or if you are not used to follow updates then it is recommended that instead you use the packages provided by your software vendor or Linux distribution. Most of them are taking this task seriously and are doing a good job at backporting important fixes. If for any reason you'd prefer a different version than the one packaged for your system, you want to be certain to have all the fixes or to get some commercial support, other choices are available at : http://www.haproxy.com/ To build haproxy, you will need : - GNU make. Neither Solaris nor OpenBSD's make work with the GNU Makefile. If you get many syntax errors when running "make", you may want to retry with "gmake" which is the name commonly used for GNU make on BSD systems. - GCC between 2.95 and 4.8. Others may work, but not tested. - GNU ld Also, you might want to build with libpcre support, which will provide a very efficient regex implementation and will also fix some badness on Solaris' one. To build haproxy, you have to choose your target OS amongst the following ones and assign it to the TARGET variable : - linux22 for Linux 2.2 - linux24 for Linux 2.4 and above (default) - linux24e for Linux 2.4 with support for a working epoll (> 0.21) - linux26 for Linux 2.6 and above - linux2628 for Linux 2.6.28, 3.x, and above (enables splice and tproxy) - solaris for Solaris 8 or 10 (others untested) - freebsd for FreeBSD 5 to 10 (others untested) - netbsd for NetBSD - osx for Mac OS/X - openbsd for OpenBSD 5.7 and above - aix51 for AIX 5.1 - aix52 for AIX 5.2 - cygwin for Cygwin - haiku for Haiku - generic for any other OS or version. - custom to manually adjust every setting You may also choose your CPU to benefit from some optimizations. This is particularly important on UltraSparc machines. For this, you can assign one of the following choices to the CPU variable : - i686 for intel PentiumPro, Pentium 2 and above, AMD Athlon - i586 for intel Pentium, AMD K6, VIA C3. - ultrasparc : Sun UltraSparc I/II/III/IV processor - native : use the build machine's specific processor optimizations. Use with extreme care, and never in virtualized environments (known to break). - generic : any other processor or no CPU-specific optimization. (default) Alternatively, you may just set the CPU_CFLAGS value to the optimal GCC options for your platform. You may want to build specific target binaries which do not match your native compiler's target. This is particularly true on 64-bit systems when you want to build a 32-bit binary. Use the ARCH variable for this purpose. Right now it only knows about a few x86 variants (i386,i486,i586,i686,x86_64), two generic ones (32,64) and sets -m32/-m64 as well as -march=<arch> accordingly. If your system supports PCRE (Perl Compatible Regular Expressions), then you really should build with libpcre which is between 2 and 10 times faster than other libc implementations. Regex are used for header processing (deletion, rewriting, allow, deny). The only inconvenient of libpcre is that it is not yet widely spread, so if you build for other systems, you might get into trouble if they don't have the dynamic library. In this situation, you should statically link libpcre into haproxy so that it will not be necessary to install it on target systems. Available build options for PCRE are : - USE_PCRE=1 to use libpcre, in whatever form is available on your system (shared or static) - USE_STATIC_PCRE=1 to use a static version of libpcre even if the dynamic one is available. This will enhance portability. - with no option, use your OS libc's standard regex implementation (default). Warning! group references on Solaris seem broken. Use static-pcre whenever possible. If your system doesn't provide PCRE, you are encouraged to download it from http://www.pcre.org/ and build it yourself, it's fast and easy. Recent systems can resolve IPv6 host names using getaddrinfo(). This primitive is not present in all libcs and does not work in all of them either. Support in glibc was broken before 2.3. Some embedded libs may not properly work either, thus, support is disabled by default, meaning that some host names which only resolve as IPv6 addresses will not resolve and configs might emit an error during parsing. If you know that your OS libc has reliable support for getaddrinfo(), you can add USE_GETADDRINFO=1 on the make command line to enable it. This is the recommended option for most Linux distro packagers since it's working fine on all recent mainstream distros. It is automatically enabled on Solaris 8 and above, as it's known to work. It is possible to add native support for SSL using the GNU makefile, by passing "USE_OPENSSL=1" on the make command line. The libssl and libcrypto will automatically be linked with haproxy. Some systems also require libz, so if the build fails due to missing symbols such as deflateInit(), then try again with "ADDLIB=-lz". Your are strongly encouraged to always use an up-to-date version of OpenSSL, as found on https://www.openssl.org/ as vulnerabilities are occasionally found and you don't want them on your systems. HAProxy is known to build correctly on all currently supported branches (0.9.8, 1.0.0, 1.0.1, 1.0.2 and 1.1.0 at the time of writing). Branch 1.0.2 is currently recommended for the best combination of features and stability. Asynchronous engines require OpenSSL 1.1.0 though. It's worth mentioning that some OpenSSL derivatives are also reported to work but may occasionally break. Patches to fix them are welcome but please read the CONTRIBUTING file first. To link OpenSSL statically against haproxy, build OpenSSL with the no-shared keyword and install it to a local directory, so your system is not affected : $ export STATICLIBSSL=/tmp/staticlibssl $ ./config --prefix=$STATICLIBSSL no-shared $ make && make install_sw When building haproxy, pass that path via SSL_INC and SSL_LIB to make and include additional libs with ADDLIB if needed (in this case for example libdl): $ make TARGET=linux26 USE_OPENSSL=1 SSL_INC=$STATICLIBSSL/include SSL_LIB=$STATICLIBSSL/lib ADDLIB=-ldl It is also possible to include native support for zlib to benefit from HTTP compression. For this, pass "USE_ZLIB=1" on the "make" command line and ensure that zlib is present on the system. Alternatively it is possible to use libslz for a faster, memory less, but slightly less efficient compression, by passing "USE_SLZ=1". Zlib is commonly found on most systems, otherwise updates can be retrieved from http://www.zlib.net/. It is easy and fast to build. Libslz can be downloaded from http://1wt.eu/projects/libslz/ and is even easier to build. By default, the DEBUG variable is set to '-g' to enable debug symbols. It is not wise to disable it on uncommon systems, because it's often the only way to get a complete core when you need one. Otherwise, you can set DEBUG to '-s' to strip the binary. For example, I use this to build for Solaris 8 : $ make TARGET=solaris CPU=ultrasparc USE_STATIC_PCRE=1 And I build it this way on OpenBSD or FreeBSD : $ gmake TARGET=freebsd USE_PCRE=1 USE_OPENSSL=1 USE_ZLIB=1 And on a classic Linux with SSL and ZLIB support (eg: Red Hat 5.x) : $ make TARGET=linux26 USE_PCRE=1 USE_OPENSSL=1 USE_ZLIB=1 And on a recent Linux >= 2.6.28 with SSL and ZLIB support : $ make TARGET=linux2628 USE_PCRE=1 USE_OPENSSL=1 USE_ZLIB=1 In order to build a 32-bit binary on an x86_64 Linux system with SSL support without support for compression but when OpenSSL requires ZLIB anyway : $ make TARGET=linux26 ARCH=i386 USE_OPENSSL=1 ADDLIB=-lz The SSL stack supports session cache synchronization between all running processes. This involves some atomic operations and synchronization operations which come in multiple flavors depending on the system and architecture : Atomic operations : - internal assembler versions for x86/x86_64 architectures - gcc builtins for other architectures. Some architectures might not be fully supported or might require a more recent version of gcc. If your architecture is not supported, you willy have to either use pthread if supported, or to disable the shared cache. - pthread (posix threads). Pthreads are very common but inter-process support is not that common, and some older operating systems did not report an error when enabling multi-process mode, so they used to silently fail, possibly causing crashes. Linux's implementation is fine. OpenBSD doesn't support them and doesn't build. FreeBSD 9 builds and reports an error at runtime, while certain older versions might silently fail. Pthreads are enabled using USE_PTHREAD_PSHARED=1. Synchronization operations : - internal spinlock : this mode is OS-independent, light but will not scale well to many processes. However, accesses to the session cache are rare enough that this mode could certainly always be used. This is the default mode. - Futexes, which are Linux-specific highly scalable light weight mutexes implemented in user-space with some limited assistance from the kernel. This is the default on Linux 2.6 and above and is enabled by passing USE_FUTEX=1 - pthread (posix threads). See above. If none of these mechanisms is supported by your platform, you may need to build with USE_PRIVATE_CACHE=1 to totally disable SSL cache sharing. Then it is better not to run SSL on multiple processes. If you need to pass other defines, includes, libraries, etc... then please check the Makefile to see which ones will be available in your case, and use the USE_* variables in the Makefile. AIX 5.3 is known to work with the generic target. However, for the binary to also run on 5.2 or earlier, you need to build with DEFINE="-D_MSGQSUPPORT", otherwise __fd_select() will be used while not being present in the libc, but this is easily addressed using the "aix52" target. If you get build errors because of strange symbols or section mismatches, simply remove -g from DEBUG_CFLAGS. You can easily define your own target with the GNU Makefile. Unknown targets are processed with no default option except USE_POLL=default. So you can very well use that property to define your own set of options. USE_POLL can even be disabled by setting USE_POLL="". For example : $ gmake TARGET=tiny USE_POLL="" TARGET_CFLAGS=-fomit-frame-pointer 1.1) Device Detection --------------------- HAProxy supports several device detection modules relying on third party products. Some of them may provide free code, others free libs, others free evaluation licenses. Please read about their respective details in the following files : doc/DeviceAtlas-device-detection.txt for DeviceAtlas doc/51Degrees-device-detection.txt for 51Degrees doc/WURFL-device-detection.txt for Scientiamobile WURFL 2) How to install it -------------------- To install haproxy, you can either copy the single resulting binary to the place you want, or run : $ sudo make install If you're packaging it for another system, you can specify its root directory in the usual DESTDIR variable. 3) How to set it up ------------------- There is some documentation in the doc/ directory : - intro.txt : this is an introduction to haproxy, it explains what it is what it is not. Useful for beginners or to re-discover it when planning for an upgrade. - architecture.txt : this is the architecture manual. It is quite old and does not tell about the nice new features, but it's still a good starting point when you know what you want but don't know how to do it. - configuration.txt : this is the configuration manual. It recalls a few essential HTTP basic concepts, and details all the configuration file syntax (keywords, units). It also describes the log and stats format. It is normally always up to date. If you see that something is missing from it, please report it as this is a bug. Please note that this file is huge and that it's generally more convenient to review Cyril Bont禳 HTML translation online here : http://cbonte.github.io/haproxy-dconv/configuration-1.6.html - management.txt : it explains how to start haproxy, how to manage it at runtime, how to manage it on multiple nodes, how to proceed with seamless upgrades. - gpl.txt / lgpl.txt : the copy of the licenses covering the software. See the 'LICENSE' file at the top for more information. - the rest is mainly for developers. There are also a number of nice configuration examples in the "examples" directory as well as on several sites and articles on the net which are linked to from the haproxy web site. 4) How to report a bug ---------------------- It is possible that from time to time you'll find a bug. A bug is a case where what you see is not what is documented. Otherwise it can be a misdesign. If you find that something is stupidly design, please discuss it on the list (see the "how to contribute" section below). If you feel like you're proceeding right and haproxy doesn't obey, then first ask yourself if it is possible that nobody before you has even encountered this issue. If it's unlikely, the you probably have an issue in your setup. Just in case of doubt, please consult the mailing list archives : http://marc.info/?l=haproxy Otherwise, please try to gather the maximum amount of information to help reproduce the issue and send that to the mailing list : haproxy@formilux.org Please include your configuration and logs. You can mask your IP addresses and passwords, we don't need them. But it's essential that you post your config if you want people to guess what is happening. Also, keep in mind that haproxy is designed to NEVER CRASH. If you see it die without any reason, then it definitely is a critical bug that must be reported and urgently fixed. It has happened a couple of times in the past, essentially on development versions running on new architectures. If you think your setup is fairly common, then it is possible that the issue is totally unrelated. Anyway, if that happens, feel free to contact me directly, as I will give you instructions on how to collect a usable core file, and will probably ask for other captures that you'll not want to share with the list. 5) How to contribute -------------------- Please carefully read the CONTRIBUTING file that comes with the sources. It is mandatory. -- end [root@node102.yinzhengjie.org.cn /usr/local/src]#
4>.編譯HAProxy
[root@node102.yinzhengjie.org.cn /usr/local/src]# ll total 2036 drwxrwxr-x 11 root root 312 Apr 26 2019 haproxy-1.8.20 -rw-r--r-- 1 root root 2083917 Dec 12 12:44 haproxy-1.8.20.tar.gz [root@node102.yinzhengjie.org.cn /usr/local/src]# [root@node102.yinzhengjie.org.cn /usr/local/src]# cd haproxy-1.8.20 [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# make ARCH=x86_64 TARGET=linux2628 USE_PCRE=1 USE_OPENSSL=1 USE_ZLIB=1 USE_SYSTEMD=1 USE_CPU_AFFINITY=1 PREFIX=/yinzhengjie/softwares/haproxy ...... [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# echo $? 0 [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# 以上通用編譯參數說明如下: ARCH=x86_64: 指定CPU的架構為"x86_64"。 TARGET=linux2628: 指定HAProxy安裝平台的內核版本,表示"Linux內核版本 >= 2.6.28"。 USE_PCRE=1: 開啟正則表達式。 USE_OPENSSL=1: 開啟OPENSSL功能。 USE_ZLIB=1: 開啟壓縮和解壓縮功能。 USE_SYSTEMD=1: 支持以"systemd"的方式啟動。 USE_CPU_AFFINITY=1 開啟CPU的親和性。 PREFIX=/yinzhengjie/softwares/haproxy: 指定Haproxy的安裝路徑為"/yinzhengjie/softwares/haproxy"。
5>.安裝HAProxy
[root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# ll /yinzhengjie/softwares/haproxy ls: cannot access /yinzhengjie/softwares/haproxy: No such file or directory [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# make install PREFIX=/yinzhengjie/softwares/haproxy install -d "/yinzhengjie/softwares/haproxy/sbin" install haproxy "/yinzhengjie/softwares/haproxy/sbin" install -d "/yinzhengjie/softwares/haproxy/share/man"/man1 install -m 644 doc/haproxy.1 "/yinzhengjie/softwares/haproxy/share/man"/man1 install -d "/yinzhengjie/softwares/haproxy/doc/haproxy" for x in configuration management architecture peers-v2.0 cookie-options lua WURFL-device-detection proxy-protocol linux-syn-cookies network-name spaces DeviceAtlas-device-detection 51Degrees-device-detection netscaler-client-ip-insertion-protocol peers close-options SPOE intro; do \ install -m 644 doc/$x.txt "/yinzhengjie/softwares/haproxy/doc/haproxy" ; \ done [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# ll /yinzhengjie/softwares/haproxy total 0 drwxr-xr-x 3 root root 21 Jan 1 11:41 doc drwxr-xr-x 2 root root 21 Jan 1 11:41 sbin drwxr-xr-x 3 root root 17 Jan 1 11:41 share [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]#
6>.查看"haproxy"腳本的幫助信息
[root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# ll total 8724 -rw-rw-r-- 1 root root 513114 Apr 26 2019 CHANGELOG drwxrwxr-x 18 root root 273 Apr 26 2019 contrib -rw-rw-r-- 1 root root 41508 Apr 26 2019 CONTRIBUTING drwxrwxr-x 5 root root 4096 Apr 26 2019 doc drwxrwxr-x 2 root root 4096 Jan 1 11:36 ebtree drwxrwxr-x 3 root root 4096 Apr 26 2019 examples -rwxr-xr-x 1 root root 8259352 Jan 1 11:37 haproxy #安裝Haproxy服務后，會生成該文件 drwxrwxr-x 6 root root 60 Apr 26 2019 include -rw-rw-r-- 1 root root 2029 Apr 26 2019 LICENSE -rw-rw-r-- 1 root root 3087 Apr 26 2019 MAINTAINERS -rw-rw-r-- 1 root root 37713 Apr 26 2019 Makefile -rw-rw-r-- 1 root root 15355 Apr 26 2019 README drwxrwxr-x 5 root root 50 Apr 26 2019 reg-tests -rw-rw-r-- 1 root root 2713 Apr 26 2019 ROADMAP drwxrwxr-x 2 root root 101 Apr 26 2019 scripts drwxrwxr-x 2 root root 8192 Jan 1 11:37 src -rw-rw-r-- 1 root root 14 Apr 26 2019 SUBVERS drwxrwxr-x 2 root root 4096 Apr 26 2019 tests -rw-rw-r-- 1 root root 24 Apr 26 2019 VERDATE -rw-rw-r-- 1 root root 7 Apr 26 2019 VERSION [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# ./haproxy -v #查看安裝的版本號 HA-Proxy version 1.8.20 2019/04/25 Copyright 2000-2019 Willy Tarreau <willy@haproxy.org> [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]#
[root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# ./haproxy -h #查看幫助信息 HA-Proxy version 1.8.20 2019/04/25 Copyright 2000-2019 Willy Tarreau <willy@haproxy.org> Usage : haproxy [-f <cfgfile|cfgdir>]* [ -vdVD ] [ -n <maxconn> ] [ -N <maxpconn> ] [ -p <pidfile> ] [ -m <max megs> ] [ -C <dir> ] [-- <cfgfile>*] -v displays version ; -vv shows known build options. -d enters debug mode ; -db only disables background mode. -dM[<byte>] poisons memory with <byte> (defaults to 0x50) -V enters verbose mode (disables quiet mode) -D goes daemon ; -C changes to <dir> before loading files. -W master-worker mode. -Ws master-worker mode with systemd notify support. -q quiet mode : don't display messages -c check mode : only check config files and exit -n sets the maximum total # of connections (2000) -m limits the usable amount of memory (in MB) -N sets the default, per-proxy maximum # of connections (2000) -L set local peer name (default to hostname) -p writes pids of all children to this file -de disables epoll() usage even when available -dp disables poll() usage even when available -dS disables splice usage (broken on old kernels) -dR disables SO_REUSEPORT usage -dr ignores server address resolution failures -dV disables SSL verify on servers side -sf/-st [pid ]* finishes/terminates old pids. -x <unix_socket> get listening sockets from a unix socket [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]#
[root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# ./haproxy -vv HA-Proxy version 1.8.20 2019/04/25 Copyright 2000-2019 Willy Tarreau <willy@haproxy.org> Build options : TARGET = linux2628 CPU = generic CC = gcc CFLAGS = -m64 -march=x86-64 -O2 -g -fno-strict-aliasing -Wdeclaration-after-statement -fwrapv -Wno-unused-label OPTIONS = USE_ZLIB=1 USE_CPU_AFFINITY=1 USE_OPENSSL=1 USE_SYSTEMD=1 USE_PCRE=1 Default settings : maxconn = 2000, bufsize = 16384, maxrewrite = 1024, maxpollevents = 200 Built with OpenSSL version : OpenSSL 1.0.2k-fips 26 Jan 2017 Running on OpenSSL version : OpenSSL 1.0.2k-fips 26 Jan 2017 OpenSSL library supports TLS extensions : yes OpenSSL library supports SNI : yes OpenSSL library supports : SSLv3 TLSv1.0 TLSv1.1 TLSv1.2 Built with transparent proxy support using: IP_TRANSPARENT IPV6_TRANSPARENT IP_FREEBIND Encrypted password support via crypt(3): yes Built with multi-threading support. Built with PCRE version : 8.32 2012-11-30 Running on PCRE version : 8.32 2012-11-30 PCRE library supports JIT : no (USE_PCRE_JIT not set) Built with zlib version : 1.2.7 Running on zlib version : 1.2.7 Compression algorithms supported : identity("identity"), deflate("deflate"), raw-deflate("deflate"), gzip("gzip") Built with network namespace support. Available polling systems : epoll : pref=300, test result OK poll : pref=200, test result OK select : pref=150, test result OK Total: 3 (3 usable), will use epoll. Available filters : [SPOE] spoe [COMP] compression [TRACE] trace [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]#
7>.創建haproxy的啟動腳本
[root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# cp haproxy /usr/sbin/ [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# which haproxy /usr/sbin/haproxy [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# cd [root@node102.yinzhengjie.org.cn ~]# [root@node102.yinzhengjie.org.cn ~]# vim /usr/lib/systemd/system/haproxy.service [root@node102.yinzhengjie.org.cn ~]# [root@node102.yinzhengjie.org.cn ~]# cat /usr/lib/systemd/system/haproxy.service [Unit] Description=Yinzhengjie's HAProxyLoad Balancer After=syslog.target network.target [Service] ExecStartPre=/usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg -c -q ExecStart=/usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /yinzhengjie/softwares/haproxy/haproxy.pid ExecReload=/bin/kill -USR2 $MAINPID [Install] WantedBy=multi-user.target [root@node102.yinzhengjie.org.cn ~]#
8>.編輯haproxy的配置文件
[root@node102.yinzhengjie.org.cn ~]# mkdir /etc/haproxy
[root@node102.yinzhengjie.org.cn ~]#
[root@node102.yinzhengjie.org.cn ~]# vim /etc/haproxy/haproxy.cfg
[root@node102.yinzhengjie.org.cn ~]#
[root@node102.yinzhengjie.org.cn ~]# cat /etc/haproxy/haproxy.cfg
global
maxconn 100000
chroot /yinzhengjie/softwares/haproxy
user nobody
group nobody
daemon
nbproc 2
cpu-map 1 0
cpu-map 2 1
nbthread 2
pidfile /yinzhengjie/softwares/haproxy/haproxy.pid
log 127.0.0.1 local5 info
defaults
option http-keep-alive
mode http
listen status_page
bind 172.30.1.102:8888
stats enable
stats uri /haproxy-status
stats auth admin:yinzhengjie
stats realm "Welcome to the haproxy load balancer status page of YinZhengjie"
[root@node102.yinzhengjie.org.cn ~]#
9>.啟動haproxy服務
[root@node102.yinzhengjie.org.cn ~]# netstat -untalp | grep haproxy
[root@node102.yinzhengjie.org.cn ~]#
[root@node102.yinzhengjie.org.cn ~]# ss -ntl
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 *:22 *:*
LISTEN 0 128 :::22 :::*
[root@node102.yinzhengjie.org.cn ~]#
[root@node102.yinzhengjie.org.cn ~]# systemctl start haproxy
[root@node102.yinzhengjie.org.cn ~]#
[root@node102.yinzhengjie.org.cn ~]# ss -ntl
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 *:22 *:*
LISTEN 0 128 172.30.1.102:8888 *:*
LISTEN 0 128 :::22 :::*
[root@node102.yinzhengjie.org.cn ~]#
[root@node102.yinzhengjie.org.cn ~]# netstat -untalp | grep haproxy
tcp 0 0 172.30.1.102:8888 0.0.0.0:* LISTEN 6984/haproxy
[root@node102.yinzhengjie.org.cn ~]#
[root@node102.yinzhengjie.org.cn ~]# ps -ef | grep haproxy | grep -v grep
root 6981 1 0 10:43 ? 00:00:00 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /yinzhengjie/softwares/haproxy/haproxy.pid
nobody 6984 6981 0 10:43 ? 00:00:00 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /yinzhengjie/softwares/haproxy/haproxy.pid
nobody 6985 6981 0 10:43 ? 00:00:00 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /yinzhengjie/softwares/haproxy/haproxy.pid
[root@node102.yinzhengjie.org.cn ~]#
[root@node102.yinzhengjie.org.cn ~]#
10>.瀏覽器訪問"http://node102.yinzhengjie.org.cn:8888/haproxy-status"查看haproxy的工作狀態
如上圖所示，將HAProxy的用戶名密碼(記錄在咱們配置的"/etc/haproxy/haproxy.cfg"文件中)輸入后就會驗證成功，驗證成功就會跳轉到HAProxy的監控頁面，如下圖所示。
五.博主推薦閱讀
配置文件說明:
https://www.cnblogs.com/yinzhengjie/p/12114081.html
狀態頁配置:
https://www.cnblogs.com/yinzhengjie/p/12147925.html