Grundlagen der Hochverfügbarkeit

# Install on all nodes
sudo apt update
sudo apt install keepalived -y

Node 1 (MASTER): 192.168.1.11
Node 2 (BACKUP): 192.168.1.12
Virtual IP (VIP): 192.168.1.100

sudo tee /etc/keepalived/keepalived.conf << 'EOF'
global_defs {
    router_id LVS_NODE1
    script_user root
    enable_script_security
}
 
# Health check script
vrrp_script check_nginx {
    script "/usr/bin/curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1 | grep -q 200"
    interval 5
    weight -20
    fall 3
    rise 2
}
 
vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 51
    priority 100
    advert_int 1
 
    authentication {
        auth_type PASS
        auth_pass MyS3cretP@ss
    }
 
    virtual_ipaddress {
        192.168.1.100/24 dev eth0
    }
 
    track_script {
        check_nginx
    }
 
    # Notification scripts (optional)
    notify_master "/etc/keepalived/notify.sh master"
    notify_backup "/etc/keepalived/notify.sh backup"
    notify_fault  "/etc/keepalived/notify.sh fault"
}
EOF

sudo tee /etc/keepalived/keepalived.conf << 'EOF'
global_defs {
    router_id LVS_NODE2
    script_user root
    enable_script_security
}
 
vrrp_script check_nginx {
    script "/usr/bin/curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1 | grep -q 200"
    interval 5
    weight -20
    fall 3
    rise 2
}
 
vrrp_instance VI_1 {
    state BACKUP
    interface eth0
    virtual_router_id 51
    priority 90
    advert_int 1
 
    authentication {
        auth_type PASS
        auth_pass MyS3cretP@ss
    }
 
    virtual_ipaddress {
        192.168.1.100/24 dev eth0
    }
 
    track_script {
        check_nginx
    }
}
EOF

sudo tee /etc/keepalived/notify.sh << 'SCRIPT'
#!/bin/bash
STATE=$1
DATETIME=$(date '+%Y-%m-%d %H:%M:%S')
echo "${DATETIME} - State changed to: ${STATE}" >> /var/log/keepalived-notify.log
 
case $STATE in
    master)
        echo "${DATETIME} - This node became MASTER" >> /var/log/keepalived-notify.log
        # You can send alert notifications here
        ;;
    backup)
        echo "${DATETIME} - This node became BACKUP" >> /var/log/keepalived-notify.log
        ;;
    fault)
        echo "${DATETIME} - This node entered FAULT state" >> /var/log/keepalived-notify.log
        ;;
esac
SCRIPT
 
sudo chmod +x /etc/keepalived/notify.sh

# Start on all nodes
sudo systemctl enable --now keepalived
 
# Check status
sudo systemctl status keepalived
 
# Verify VIP
ip addr show eth0 | grep 192.168.1.100
 
# View logs
sudo journalctl -u keepalived -f
 
# Test failover
# Stop keepalived on the primary node
sudo systemctl stop keepalived
# Observe whether the backup node takes over the VIP

sudo apt update
sudo apt install haproxy -y
 
# Check version
haproxy -v

sudo tee /etc/haproxy/haproxy.cfg << 'EOF'
global
    log /dev/log local0
    log /dev/log local1 notice
    chroot /var/lib/haproxy
    stats socket /run/haproxy/admin.sock mode 660 level admin
    stats timeout 30s
    user haproxy
    group haproxy
    daemon
 
    # Performance tuning
    maxconn 50000
    tune.ssl.default-dh-param 2048
 
defaults
    log     global
    mode    http
    option  httplog
    option  dontlognull
    option  forwardfor
    option  http-server-close
    timeout connect 5000
    timeout client  50000
    timeout server  50000
    errorfile 400 /etc/haproxy/errors/400.http
    errorfile 403 /etc/haproxy/errors/403.http
    errorfile 408 /etc/haproxy/errors/408.http
    errorfile 500 /etc/haproxy/errors/500.http
    errorfile 502 /etc/haproxy/errors/502.http
    errorfile 503 /etc/haproxy/errors/503.http
    errorfile 504 /etc/haproxy/errors/504.http
 
# Statistics page
listen stats
    bind *:8404
    stats enable
    stats uri /stats
    stats refresh 10s
    stats admin if LOCALHOST
    stats auth admin:haproxy_pass
 
# HTTP frontend
frontend http_front
    bind *:80
    # HTTPS redirect
    # redirect scheme https code 301 if !{ ssl_fc }
    default_backend http_back
 
# HTTPS frontend
frontend https_front
    bind *:443 ssl crt /etc/haproxy/certs/example.com.pem
    http-request set-header X-Forwarded-Proto https
 
    # Domain-based routing
    acl host_app1 hdr(host) -i app1.example.com
    acl host_app2 hdr(host) -i app2.example.com
 
    use_backend app1_back if host_app1
    use_backend app2_back if host_app2
    default_backend http_back
 
# Backend server group
backend http_back
    balance roundrobin
    option httpchk GET /health
    http-check expect status 200
 
    server web1 192.168.1.21:80 check inter 5s fall 3 rise 2
    server web2 192.168.1.22:80 check inter 5s fall 3 rise 2
    server web3 192.168.1.23:80 check inter 5s fall 3 rise 2 backup
 
backend app1_back
    balance leastconn
    option httpchk GET /health
    server app1a 192.168.1.31:8080 check
    server app1b 192.168.1.32:8080 check
 
backend app2_back
    balance source
    server app2a 192.168.1.41:8080 check
    server app2b 192.168.1.42:8080 check
EOF

# Append to haproxy.cfg
cat << 'EOF' | sudo tee -a /etc/haproxy/haproxy.cfg
 
# MySQL load balancing
listen mysql_cluster
    bind *:3306
    mode tcp
    option mysql-check user haproxy
    balance roundrobin
    server mysql1 192.168.1.51:3306 check inter 5s
    server mysql2 192.168.1.52:3306 check inter 5s backup
 
# Redis Sentinel
listen redis
    bind *:6379
    mode tcp
    option tcp-check
    balance first
    server redis1 192.168.1.61:6379 check inter 3s
    server redis2 192.168.1.62:6379 check inter 3s
EOF

# Check configuration
sudo haproxy -c -f /etc/haproxy/haproxy.cfg
 
# Start service
sudo systemctl enable --now haproxy
 
# View stats page
curl http://localhost:8404/stats
 
# Firewall
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 8404/tcp

# keepalived configuration to check HAProxy status
sudo tee /etc/keepalived/keepalived.conf << 'EOF'
global_defs {
    router_id HAPROXY_NODE1
    script_user root
    enable_script_security
}
 
vrrp_script check_haproxy {
    script "/usr/bin/killall -0 haproxy"
    interval 2
    weight -30
    fall 3
    rise 2
}
 
vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 51
    priority 100
    advert_int 1
 
    authentication {
        auth_type PASS
        auth_pass HAProxy_HA
    }
 
    virtual_ipaddress {
        192.168.1.100/24
    }
 
    track_script {
        check_haproxy
    }
}
EOF

# Install on all nodes
sudo apt update
sudo apt install pacemaker corosync pcs resource-agents -y
 
# Set hacluster user password (same on all nodes)
sudo passwd hacluster
 
# Start the pcs management service
sudo systemctl enable --now pcsd

# Authenticate all nodes from one node
sudo pcs host auth node1 node2 -u hacluster -p yourpassword
 
# Create the cluster
sudo pcs cluster setup ha-cluster node1 node2
 
# Start the cluster
sudo pcs cluster start --all
sudo pcs cluster enable --all
 
# Check cluster status
sudo pcs cluster status
sudo pcs status
 
# For two-node clusters, disable quorum policy
sudo pcs property set no-quorum-policy=ignore
# Disable STONITH (test environments; production should configure fencing devices)
sudo pcs property set stonith-enabled=false

# Add a virtual IP resource
sudo pcs resource create cluster_vip ocf:heartbeat:IPaddr2 \
  ip=192.168.1.100 \
  cidr_netmask=24 \
  nic=eth0 \
  op monitor interval=10s
 
# Add an Nginx resource
sudo pcs resource create web_server ocf:heartbeat:nginx \
  configfile=/etc/nginx/nginx.conf \
  op monitor interval=10s timeout=30s \
  op start timeout=60s \
  op stop timeout=60s
 
# Ensure VIP and Nginx are on the same node
sudo pcs constraint colocation add web_server with cluster_vip INFINITY
 
# Ensure VIP starts before Nginx
sudo pcs constraint order cluster_vip then web_server
 
# Create a resource group (simpler approach)
sudo pcs resource group add web_group cluster_vip web_server
 
# View resource status
sudo pcs resource status
sudo pcs constraint show

# Manually migrate resources
sudo pcs resource move web_group node2
 
# Clear migration constraints (must run after migration)
sudo pcs resource clear web_group
 
# Enable/disable resources
sudo pcs resource disable web_server
sudo pcs resource enable web_server
 
# Clear resource error state
sudo pcs resource cleanup web_server
 
# Maintenance mode
sudo pcs node standby node1       # Put node in standby
sudo pcs node unstandby node1     # Restore node
sudo pcs property set maintenance-mode=true   # Global maintenance mode
sudo pcs property set maintenance-mode=false

# Real-time cluster status monitoring
sudo crm_mon -1
 
# View cluster configuration
sudo pcs config show
 
# View cluster logs
sudo journalctl -u pacemaker -f
sudo journalctl -u corosync -f
 
# Corosync membership status
sudo corosync-cmapctl | grep members