jumpserver+Keepalived中一些配置

haproxy的配置

這裏只代理了luna

coco的2222端口暫時沒代理。後期有需求再改造

(py3) [root@dawn-jump-2 /app]# cat /etc/haproxy/haproxy.cfg 
global
    #設置日誌
    log 127.0.0.1 local3 info
    chroot /var/lib/haproxy
    #用戶與用戶組
    user haproxy
    group haproxy
    #守護進程啓動
    daemon
    #最大鏈接數
    maxconn 100000
    nbproc 1 

#默認配置
defaults
    log global
    mode http
    option http-keep-alive
    maxconn 100000
    retries 3  #鏈接後端服務器的失敗重試次數
    option httplog
    option dontlognull   #日誌中不記錄空鏈接，好比不記錄健康檢查的鏈接
    option forwardfor   #這裏設置以後,下面的frontend和backend默認會繼承它
    timeout connect 10s
    timeout client 20s
    timeout server 30s
    timeout check  5s    #對後端服務器的檢測超時時間

#設置管理頁面,開啓Haproxy Status狀態監控，增長驗證
listen admin_stats
    bind *:9188
    mode http
    log 127.0.0.1 local3 err
    stats refresh 30s
    stats uri /my_haproxy_status
    stats realm welcome login\ Haproxy
    stats auth ha_admin:ha_admixxxx
    stats hide-version
    stats admin if TRUE

#前端配置，http_front名稱可自定義
frontend http_front_end
    bind *:80
    mode http
    option httpclose #每次請求完畢後主動關閉http通道
    default_backend http_back_end

#後端配置,http_back名稱可自定義
backend http_back_end
    mode http
    balance source 
    option httpchk HEAD /static/check.html HTTP/1.0 #設置健康檢查頁面
    server node1 10.0.2.54:8181 check inter 2000 rise 3 fall 3 weight 6
    server node2 10.0.2.55:8181 check inter 2000 rise 3 fall 3 weight 6
(py3) [root@dawn-jump-2 /app]#

　　

 

nginx的配置

(py3) [root@dawn-jump-2 ~]# cat /etc/nginx/nginx.conf
# For more information on configuration, see:
#   * Official English Documentation: http://nginx.org/en/docs/
#   * Official Russian Documentation: http://nginx.org/ru/docs/

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

# Load dynamic modules. See /usr/share/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    # Load modular configuration files from the /etc/nginx/conf.d directory.
    # See http://nginx.org/en/docs/ngx_core_module.html#include
    # for more information.
    include /etc/nginx/conf.d/*.conf;

    server {
        listen       8181;
        root         /usr/share/nginx/html;

        # Load configuration files for the default server block.
        include /etc/nginx/default.d/*.conf;
    
        location /luna/ {
            try_files $uri / /index.html;
            alias /opt/luna/;  # luna 路徑，若是修改安裝目錄，此處須要修改
        }

        location /media/ {
            add_header Content-Encoding gzip;
            root /opt/jumpserver/data/;  # 錄像位置，若是修改安裝目錄，此處須要修改
        }

        location /static/ {
            root /opt/jumpserver/data/;  # 靜態資源，若是修改安裝目錄，此處須要修改
        }

        location /socket.io/ {
            proxy_pass       http://localhost:5000/socket.io/;  # 若是coco安裝在別的服務器，請填寫它的ip
            proxy_buffering off;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            access_log off;
        }

        location /guacamole/ {
            proxy_pass       http://localhost:8081/;  # 若是guacamole安裝在別的服務器，請填寫它的ip
            proxy_buffering off;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $http_connection;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            access_log off;
            client_max_body_size 1000m;  # Windows 文件上傳大小限制
        }

        location / {
            proxy_pass http://localhost:8080;  # 若是jumpserver安裝在別的服務器，請填寫它的ip
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }


        error_page 404 /404.html;
            location = /40x.html {
        }

        error_page 500 502 503 504 /50x.html;
            location = /50x.html {
        }
    }
}

(py3) [root@dawn-jump-2 ~]#

　　

 

coco的配置

(py3) [root@dawn-jump-2 /opt/coco]# cat conf.py 
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
#

import os

BASE_DIR = os.path.dirname(__file__)


class Config:
    """
    Coco config file, coco also load config from server update setting below
    """
    # 項目名稱, 會用來向Jumpserver註冊, 識別而已, 不能重複
    NAME = "coco"

    # Jumpserver項目的url, api請求註冊會使用
    CORE_HOST = 'http://127.0.0.1:8080'

    # 啓動時綁定的ip, 默認 0.0.0.0
    BIND_HOST = '0.0.0.0'

    # 監聽的SSH端口號, 默認2222
    SSHD_PORT = 2222

    # 監聽的HTTP/WS端口號，默認5000
    HTTPD_PORT = 5000

    # 項目使用的ACCESS KEY, 默認會註冊,並保存到 ACCESS_KEY_STORE中,
    # 若是有需求, 能夠寫到配置文件中, 格式 access_key_id:access_key_secret
    # ACCESS_KEY = None

    # ACCESS KEY 保存的地址, 默認註冊後會保存到該文件中
    # ACCESS_KEY_STORE = os.path.join(BASE_DIR, 'keys', '.access_key')

    # 加密密鑰
    # SECRET_KEY = None

    # 設置日誌級別 ['DEBUG', 'INFO', 'WARN', 'ERROR', 'FATAL', 'CRITICAL']
    # LOG_LEVEL = 'INFO'

    # 日誌存放的目錄
    # LOG_DIR = os.path.join(BASE_DIR, 'logs')

    # Session錄像存放目錄
    # SESSION_DIR = os.path.join(BASE_DIR, 'sessions')

    # 資產顯示排序方式, ['ip', 'hostname']
    # ASSET_LIST_SORT_BY = 'ip'

    # 登陸是否支持密碼認證
    # PASSWORD_AUTH = True

    # 登陸是否支持祕鑰認證
    # PUBLIC_KEY_AUTH = True

    # 和Jumpserver 保持心跳時間間隔
    # HEARTBEAT_INTERVAL = 5

    # Admin的名字，出問題會提示給用戶
    # ADMINS = ''
    COMMAND_STORAGE = {
        "TYPE": "server"
    }
    REPLAY_STORAGE = {
        "TYPE": "server"
    }


config = Config()
(py3) [root@dawn-jump-2 /opt/coco]#