HAproxy+varnish動靜分離部署wordpress

author：JevonWei
版權聲明：原創做品

---

實驗背景：將wordpress應用部署在後端服務器上，使用HAProxy作代理服務器，Varnish作緩存服務器，後端有四臺web服務器，web1和web2服務器組成一個動態資源組dynsrvs，web3和web4服務器組成靜態資源組stasrvs，Varnish用來緩存靜態資源組stasrvs的數據； 受條件限制，在此使用web虛擬主機作爲物理主機使用，使用NFS共享wordpress文件，wordpress與mysql爲同一主機

實驗目的：爲了提升應用的訪問速度和訪問承載量，使用HAProxy技術作負載均衡，使用HAProxy的ACL訪問控制實現動靜分離的效果，將動態資源存放在動態web組中，將靜態資源存放在靜態資源組中，爲了提升訪問速度，在靜態服務器組和代理服務器之間使用了緩存服務器作數據緩存

網絡拓撲圖

環境：

HAProxy 172.16.252.82
dynsrvs爲後端動態網頁web組 
    web1：172.16.252.92:80
    web2：172.16.252.92:8080
stasrvs爲後端靜態網頁web組
    web3：172.16.253.67：80
    web4：172.16.253.67：8080
Varnish   172.16.252.100
NFS+Mysql 172.16.252.103

配置後端動態web組

[root@dynsrvs ~]# yum -y install httpd php  php-mysql
[root@dynsrvs ~]# mkdir /data/web/vhost{1,2} -pv

編輯動態php的測試頁面

[root@dynsrvs ~]# vim /data/web/vhost1/index.php
<h1> Application Server 1</h1>
<?php
    phpinfo();
?>
[root@dynsrvs ~]# vim /data/web/vhost2/index.php 
<h1> Application Server 2</h1>
<?php
    phpinfo();
?>

配置後端web主機

[root@dynsrvs ~]# vim /etc/httpd/conf.d/vhost1.conf 
<VirtualHost *:80>
    ServerName web1.danran.com
    DocumentRoot "/data/web/vhost1"
    <Directory "/data/web/vhost1">
        Options FollowSymLinks
        AllowOverride None
        Require all granted
    </Directory>
</VirtualHost>

Listen 8080
<VirtualHost *:8080>
    ServerName web2.danran.com
    DocumentRoot "/data/web/vhost2"
    <Directory "/data/web/vhost2">
        Options FollowSymLinks
        AllowOverride None
        Require all granted
    </Directory>
</VirtualHost>

訪問測試php動態頁面

http://172.16.252.92/

http://172.16.252.92/:8080

配置後端動態web組

[root@stasrvs ~]# yum -y install httpd
[root@stasrvs ~]# iptables -F
[root@stasrvs ~]# setenforce  0
[root@stasrvs ~]#  mkdir -pv /data/web/vhost{1,2}
[root@stasrvs ~]# mkdir /data/web/vhost1/png
[root@stasrvs ~]# mkdir /data/web/vhost2/png

複製靜態資源作測試
[root@stasrvs ~]# find /usr/share/ -iname "*.jpg" -exec cp {} /data/web/vhost1/png/ \;
[root@stasrvs ~]# find /usr/share/ -iname "*.jpg" -exec cp {} /data/web/vhost2/png/ \;
[root@stasrvs ~]# vim /data/web/vhost1/index.html
<h1> Image Server 1 </h1>
[root@stasrvs ~]# vim /data/web/vhost2/index.html
<h1> Image Server 2 </h1>

配置虛擬主機

[root@stasrvs ~]# vim  /etc/httpd/conf.d/vhost1.conf 
<VirtualHost *:80>
    ServerName web3.danran.com
    DocumentRoot "/data/web/vhost1"
    <Directory "/data/web/vhost1">
        Options FollowSymLinks
        AllowOverride None
        Require all granted
    </Directory>
</VirtualHost>
[root@stasrvs ~]# vim  /etc/httpd/conf.d/vhost2.conf
Listen 8080
<VirtualHost *:8080>
    ServerName web4.danran.com
    DocumentRoot "/data/web/vhost1"
    <Directory "/data/web/vhost1">
        Options FollowSymLinks
        AllowOverride None
        Require all granted
    </Directory>
</VirtualHost>
[root@stasrvs ~]# systemctl start httpd.service

訪問測試靜態頁面

http://172.16.252.67/png/3.jpg
http://172.16.252.67:8080/png/3.jpg

配置NFS+Mysql

Mysql

[root@mysql ~]# yum -y install mariadb-server
[root@mysql ~]# systemctl start mariadb
[root@mysql ~]# systemctl enable mariadb
[root@mysql ~]# systemctl disable firewalld
[root@mysql ~]# systemctl stop firewalld
[root@mysql ~]# iptables -F 關閉防火牆
[root@mysql ~]# setenforce 0

建立數據庫帳號
[root@mysql ~]# mysql_secure_installation   \\數據庫安全初始化
[root@mysql ~]# mysql -uroot -hlocalhost -p
MariaDB [(none)]> create database blog;
MariaDB [(none)]> grant all on blog.* to blog@'172.16.%.%' identified by 'blog'; 

登陸測試
[root@mysql ~]# mysql -ublog -h172.16.252.103 -p

添加防火牆，僅容許RS1和RS2及本身自己鏈接數據庫
[root@mysql ~]# iptables -A INPUT -s 172.16.252.92 -p tcp --dport 3306 -j ACCEPT
[root@mysql ~]# iptables -A INPUT -s 172.16.252.67 -p tcp --dport 3306 -j ACCEPT  
[root@mysql ~]# iptables -A INPUT -s 172.16.252.103 -p tcp --dport 3306 -j ACCEPT   
[root@mysql ~]# iptables -A INPUT -j REJECT

NFS

[root@NFS ~]# iptables -F
[root@NFS ~]# setenforce 0
[root@NFS ~]# rpm -ql nfs-utils
package nfs-utils is not installed
[root@NFS ~]# yum -y install nfs-utils

將wordpress程序包解壓縮
[root@NFS ~]# tar xf wordpress-4.8-zh_CN.tar.gz -C /app
[root@NFS ~]# cd /app/wordpress
[root@NFS wordpress]# cp wp-config-sample.php wp-config.php
[root@NFS ~]# chmod o+w /app/blog/wp-config.php 
[root@NFS wordpress]# vim wp-config.php
/** WordPress數據庫的名稱 */
define('DB_NAME', 'blog');

/** MySQL數據庫用戶名 */
define('DB_USER', 'blog');

/** MySQL數據庫密碼 */
define('DB_PASSWORD', 'blog');

/** MySQL主機 */
define('DB_HOST', '172.16.252.103');

建立與dynsrvs和stasrvs主機上相同UID的apache用戶
[root@NFS blog]# useradd -u 48 -r -s /sbin/nologin apache    \\dynsrvs和stasrvs的apache用戶UID爲48

修改blog目錄的屬組，從而使apache用戶對blog有讀寫權限
[root@NFS app]# useradd -u 48 -r -s /sbin/nologin apache 
[root@NFS app]# chown -R apache:apache blog/
[root@NFS app]# ll -d blog/
drwxr-xr-x. 2 apache apache 6 Sep  8 13:12 blog/

配置NFS
[root@NFS ~]# vim /etc/exports  
/app/blog    172.16.252.0/24(rw,all_squash,anonuid=48,anongid=48)  \\all_squash爲壓縮全部用戶名，anonuid意爲壓縮爲UID爲48的用戶，anongid組壓縮爲GID爲48的組
[root@NFS ~]# systemctl start nfs-server

dynsrvs和stasrvs服務器掛載NFS共享目錄

stasrvs

[root@stasrvs ~]# yum -y install nfs-utils
[root@stasrvs ~]# cd /data/web/vhost2/
[root@stasrvs vhost2]# mkdir blog
[root@stasrvs vhost2]# chmod o+w blog
[root@stasrvs ~]# vim /etc/fstab
172.16.252.103:/app/blog  /data/web/vhost2/blog  nfs defaults 0 0 
[root@stasrvs ~]# mount -a
[root@stasrvs ~]# df 

將web1的根文件路徑修改成/data/web/vhost2，同web2路徑一致     
[root@stasrvs vhost1]# vim /etc/httpd/conf.d/vhost1.conf 
<VirtualHost *:80>
    ServerName web3.danran.com
    DocumentRoot "/data/web/vhost2"
    <Directory "/data/web/vhost2">
        Options FollowSymLinks
        AllowOverride None
        Require all granted
    </Directory>
</VirtualHost>
[root@stasrvs ~]# systemctl restart httpd

dynsrvs

[root@dynsrvs ~]# yum -y install nfs-utils
[root@dynsrvs ~]# cd /data/web/vhost2/
[root@dynsrvs vhost2]# mkdir blog
[root@dynsrvs vhost2]# chmod o+w blog
[root@dynsrvs ~]# vim /etc/fstab
172.16.252.103:/app/blog  /data/web/vhost2/blog  nfs defaults 0 0 
[root@dynsrvs ~]# mount -a
[root@dynsrvs ~]# df 

將web1的根文件路徑修改成/data/web/vhost2，同web2路徑一致     
[root@stasrvs vhost1]# vim /etc/httpd/conf.d/vhost1.conf 
<VirtualHost *:80>
    ServerName web1.danran.com
    DocumentRoot "/data/web/vhost2"
    <Directory "/data/web/vhost2">
        Options FollowSymLinks
        AllowOverride None
        Require all granted
    </Directory>
</VirtualHost>
[root@dynsrvs ~]# systemctl restart httpd

HAProxy

安裝HAProxy

[root@haproxy ~]# yum -y install haproxy
[root@haproxy ~]# rpm -ql haproxy
[root@haproxy ~]# iptables -F
[root@haproxy ~]# setenforce 0
[root@haproxy ~]# systemctl enable haproxy
[root@haproxy ~]# cp /etc/haproxy/haproxy.cfg{,.bak}

配置HAProxy代理

[root@haproxy ~]# vim /etc/haproxy/haproxy.cfg
frontend myweb *:80
    rspadd  X-Via:\ HAProxy-1
    rspidel Server.*
    acl static path_end .jpg .jpeg .png .gif .txt .html
    acl static path_beg -i /images /static
    use_backend staticsrvs  if static
    default_backend dynsrvs

backend dynsrvs
    balance uri
    option      forwardfor header X-Client
    server dynsrv1 172.16.252.92:80 check cookie dynsrv1
    server dynsrv2 172.16.252.92:8080 check cookie dynsrv2
    hash-type consistent
backend staticsrvs
    option      forwardfor header X-Client
    balance uri
    server staticsrv1 172.16.252.67:80 check
    server staticsrv2 172.16.252.67:8080 check
    hash-type consistent

listen status
    bind *:9009
    acl auth_admin src 172.16.251.196
    stats enable
    stats uri /myhaproxy?status
    stats realm HAProxy\ Admin\ Area
    stats auth admin:admin
    stats admin if auth_admin
[root@haproxy ~]# systemctl restart haproxy

測試HAProxy的狀態頁

http://172.16.252.82:9009/myhaproxy?status

Varnish

[root@varnish ~]# yum -y install varnish
[root@varnish ~]# iptables -F   
[root@varnish ~]# setenforce 0
[root@varnish ~]# vim /etc/varnish/varnish.params 
VARNISH_LISTEN_PORT=80 \\監聽端口爲80，默認爲6081
VARNISH_ADMIN_LISTEN_ADDRESS=127.0.0.1 \\監聽管理接口的IP，默認爲本機
VARNISH_ADMIN_LISTEN_PORT=6082 \\管理接口的端口，默認爲6082
VARNISH_SECRET_FILE=/etc/varnish/secret \\認證密碼文件
#DAEMON_OPTS="-p thread_pool_min=5 -p thread_pool_max=500 -p thread_pool_timeout=300" \\定義運行時參數
[root@varnish ~]# vim /etc/varnish/default.vcl 
import directors;  # 導入負載均衡模塊
probe healthchk {    # 配置健康狀態檢查
    .url = "/.healthchk.html";   # 檢查狀態檢查的URL
    .timeout = 2s; # 超時時間
    .interval = 2s;# 每2秒檢查一次
    .window = 8; # 一共檢查的次數
    .threshold = 5; # 若是大於4次則爲健康
}

# Default backend definition. Set this to point to your content server.
backend imgsrv1 {  # 配置後端主機
    .host = "172.16.252.67";
    .port = "80";
    .probe = healthchk;
}
backend imgsrv2 {  # 配置後端主機
    .host = "172.16.252.67";
    .port = "8080";
    .probe = healthchk;
}

sub vcl_init {  # 初始化負載均衡
    new imgsrvs = directors.round_robin();
    imgsrvs.add_backend(imgsrv1);
    imgsrvs.add_backend(imgsrv2);
}

sub vcl_recv {
    if (req.url ~ "(?i)\.(jpg|jpeg|png|gif|svg|txt|html|css|js)$") {
    set req.backend_hint = websrvs.backend();
    }
    if (req.restarts == 0) {
    
    if (req.http.X-Fowarded-For) {
       set req.http.X-Forwarded-For = req.http.X-Forwarded-For + "," + client.ip;
    } else {
       set req.http.X-Forwarded-For = client.ip;
    }

}
sub vcl_deliver {
    if (obj.hits > 0) {
        set resp.http.X-Cache = " Hit via " + server.ip;
    } else {
        set resp.http.X-Cache = " Miss  via " + server.ip;
    }
}
[root@varnish ~]# systemctl start varnish

修改HAproxy配置文件，使HAproxy調用Varnish服務器

[root@haproxy ~]# vim /etc/haproxy/haproxy.cfg
backend staticsrvs
    option      forwardfor header X-Client
    balance uri
    server staticsrv1  172.16.252.100:80 check
    hash-type consistent
[root@haproxy ~]# systemctl restart haproxy

訪問測試

http://172.16.252.82/blog/