HAProxy常见的安装方式
作者：尹正杰
版权声明：原创作品，谢绝转载！否则将追究法律责任。
一.常见负载均衡软件概述
1>.什么是负载均衡
负载均衡(Load Balance，简称LB)是一种服务或基于硬件设备等实现的高可用反向代理技术，负载均衡将特定的业务(web服务、网络流量等)分担给指定的一个或多个后端特定的服务器或设备，从而提高了公司业务的并发处理能力、保证了业务的高可用性、方便了业务后期的水平动态扩展。 博主推荐阅读: https://yq.aliyun.com/articles/1803
2>.为什么使用负载均衡
Web服务器的动态水平扩展
对用户无感知
增加业务并发访问及处理能力
解决单服务器瓶颈问题(单点故障)
节约公网IP地址
降低IT支出成本
隐藏内部服务器IP
提高内部服务器安全性
配置简单
固定格式的配置文件
功能丰富
支持四层和七层，支持动态下线主机
性能较强
并发数万甚至数十万
3>.常见有哪些负载均衡
软件负载(一般选择开源软件)：
四层(可以和硬件防火墙相抗衡的性能)：
LVS(Linux Virtual Server，生产环境中大多使用DR模式性能要比HAProxy强)
HAProxy(High Availability Proxy，一般中小型公司使用HAproxy基本上够用了)
Nginx(需要1.9版本以上才支持)
……
七层：
HAProxy(和Nginx一样，都支持基于四层和七层的负载均衡)
Nginx(生产环境中小型企业一般使用HAProxy做四层的负载均衡，使用Nginx做七层的负载均衡)
……
硬件负载(需要花钱)：
F5
Netscaler
……
4>.典型的负载均衡应用场景
四层(传输层，一般基于监听本地端口实现负载均衡)：
Redis
Mysql
RabbitMQ
Memcache
......
七层(应用层,直接反向代理到后端服务器)：
Nginx
Tomcat
Apache
PHP
图片
动静分离
API
......
二.HaProxy概述
1>.什么是HAProxy
HAProxy是法国开发者Willy Tarreau开发的一个开源软件，是一款具备高并发、高性能的TCP和HTTP负载均衡器，支持基于cookie的持久性，自动故障切换，支持正则表达式及web状态统计。 官网: http://www.haproxy.org https://www.haproxy.com 博主推荐阅读: https://cbonte.github.io/haproxy-dconv/
2>.调度器集群(Load Balance Cluster,简称LB Cluster)
四层： lvs nginx(stream模式且nginx1.9.0或更新版本) haproxy(mode tcp) 七层： http协议: nginx(http), haproxy(mode http), httpd... 关于四层和七层的区别，博主推荐阅读: https://www.cnblogs.com/yinzhengjie/p/12127959.html
3>.HAProxy功能
HAProxy是TCP/ HTTP反向代理服务器(不支持反向代理)，尤其适合于高可用性(需要依赖于keepalive软件)高并发环境 可以针对HTTP请求添加cookie，进行路由后端服务器 可平衡负载至后端服务器，并支持持久连接(可以基于用户的源地址进行hash) 支持基于cookie进行调度 支持所有主服务器故障切换至备用服务器 支持专用端口实现监控服务 支持不影响现有连接情况下停止接受新连接请求 可以在双向添加，修改或删除HTTP报文首部 支持基于pattern实现连接请求的访问控制 通过特定的URI为授权用户提供详细的状态信息 历史版本更新功能：1.4 1.5 1.6 1.7 1.8 1.9 2.0-dev 1.8：多线程，HTTP/2缓存……(生产环境中推荐使用该版本) 1.7：服务器动态配置，多类型证书…… 1.6：DNS解析支持，HTTP连接多路复用…… 1.5：开始支持SSL，IPV6，keepalived……(CentOS 7.6的yum仓库默认支持的版本，生产环境中并不推荐使用)
三.yum安装HAProxy
1>.CentOS安装HAProxy(温馨提示:较新haproxy1.8版本中，比如动态禁用后端服务器，日志管理等功能支持的并没有haproxy1.5系列要友好)
[root@node101.yinzhengjie.org.cn ~]# yum list haproxy Loaded plugins: fastestmirror Determining fastest mirrors * base: mirrors.huaweicloud.com * epel: mirrors.yun-idc.com * extras: mirrors.huaweicloud.com * updates: mirrors.huaweicloud.com Available Packages haproxy.x86_64 1.5.18-9.el7 base [root@node101.yinzhengjie.org.cn ~]#
[root@node101.yinzhengjie.org.cn ~]# yum -y install haproxy Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile epel/x86_64/metalink | 8.7 kB 00:00:00 * base: mirrors.huaweicloud.com * epel: mirrors.yun-idc.com * extras: mirrors.huaweicloud.com * updates: mirrors.huaweicloud.com base | 3.6 kB 00:00:00 extras | 2.9 kB 00:00:00 updates | 2.9 kB 00:00:00 Resolving Dependencies --> Running transaction check ---> Package haproxy.x86_64 0:1.5.18-9.el7 will be installed --> Finished Dependency Resolution Dependencies Resolved ============================================================================================================================================================================ Package Arch Version Repository Size ============================================================================================================================================================================ Installing: haproxy x86_64 1.5.18-9.el7 base 834 k Transaction Summary ============================================================================================================================================================================ Install 1 Package Total download size: 834 k Installed size: 2.6 M Downloading packages: haproxy-1.5.18-9.el7.x86_64.rpm | 834 kB 00:00:00 Running transaction check Running transaction test Transaction test succeeded Running transaction Installing : haproxy-1.5.18-9.el7.x86_64 1/1 Verifying : haproxy-1.5.18-9.el7.x86_64 1/1 Installed: haproxy.x86_64 0:1.5.18-9.el7 Complete! [root@node101.yinzhengjie.org.cn ~]# [root@node101.yinzhengjie.org.cn ~]#
[root@node101.yinzhengjie.org.cn ~]# haproxy -v #该版本测试用还行，但是生产环境中使用该版本在并发较高情况下估计会hold不住。 HA-Proxy version 1.5.18 2016/05/10 Copyright 2000-2016 Willy Tarreau <willy@haproxy.org> [root@node101.yinzhengjie.org.cn ~]#
[root@node101.yinzhengjie.org.cn ~]# ss -ntl State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 127.0.0.1:9000 *:* LISTEN 0 128 *:80 *:* LISTEN 0 128 *:22 *:* LISTEN 0 128 *:443 *:* LISTEN 0 128 :::22 :::* [root@node101.yinzhengjie.org.cn ~]# [root@node101.yinzhengjie.org.cn ~]# systemctl start haproxy [root@node101.yinzhengjie.org.cn ~]# [root@node101.yinzhengjie.org.cn ~]# ss -ntl State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 *:5000 *:* LISTEN 0 128 127.0.0.1:9000 *:* LISTEN 0 128 *:80 *:* LISTEN 0 128 *:22 *:* LISTEN 0 128 *:443 *:* LISTEN 0 128 :::22 :::* [root@node101.yinzhengjie.org.cn ~]# [root@node101.yinzhengjie.org.cn ~]# ps -ef | grep haproxy | grep -v grep root 15216 1 0 11:19 ? 00:00:00 /usr/sbin/haproxy-systemd-wrapper -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid haproxy 15217 15216 0 11:19 ? 00:00:00 /usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -Ds haproxy 15218 15217 0 11:19 ? 00:00:00 /usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -Ds [root@node101.yinzhengjie.org.cn ~]#
2>.Ubantu安装HAProxy
[root@node201.yinzhengjie.org.cn ~]# apt-get install haproxy
3>.使用yum方式安装较新的haproxy版本(仅供参考，如果非要安装较新版本我还是推荐使用下面介绍的编译安装方式)
访问"https://pkgs.org/"查看haproxy的软件包yum安装方式： https://centos.pkgs.org/7/ius-x86_64/haproxy18u-1.8.20-1.el7.ius.x86_64.rpm.html) 安装步骤如下图所示: wget https://centos7.iuscommunity.org/ius-release.rpm rpm -ivh ius-release.rpm yum -y install haproxy18u
四.编译安装HAProxy
1>.安装依赖工具包
[root@node102.yinzhengjie.org.cn ~]# yum -y install gcc gcc-c++ glibc glibc-devel pcre pcre-devel openssl openssl-devel systemd-devel net-tools vim iotop bc zip unzip zlib-devel lrzsz tree screen lsof tcpdump wget ntpdate
2>.解压haproxy软件包
[root@node102.yinzhengjie.org.cn ~]# cd /usr/local/src/ [root@node102.yinzhengjie.org.cn /usr/local/src]# [root@node102.yinzhengjie.org.cn /usr/local/src]# ll #将haproxy软件下载到服务器端 total 2036 -rw-r--r-- 1 root root 2083917 Dec 12 12:44 haproxy-1.8.20.tar.gz [root@node102.yinzhengjie.org.cn /usr/local/src]# [root@node102.yinzhengjie.org.cn /usr/local/src]# tar -xf haproxy-1.8.20.tar.gz #解压haproxy软件包 [root@node102.yinzhengjie.org.cn /usr/local/src]# [root@node102.yinzhengjie.org.cn /usr/local/src]# ll total 2036 drwxrwxr-x 11 root root 312 Apr 26 2019 haproxy-1.8.20 -rw-r--r-- 1 root root 2083917 Dec 12 12:44 haproxy-1.8.20.tar.gz [root@node102.yinzhengjie.org.cn /usr/local/src]# [root@node102.yinzhengjie.org.cn /usr/local/src]# ll haproxy-1.8.20 total 648 -rw-rw-r-- 1 root root 513114 Apr 26 2019 CHANGELOG drwxrwxr-x 18 root root 273 Apr 26 2019 contrib -rw-rw-r-- 1 root root 41508 Apr 26 2019 CONTRIBUTING drwxrwxr-x 5 root root 4096 Apr 26 2019 doc drwxrwxr-x 2 root root 4096 Apr 26 2019 ebtree drwxrwxr-x 3 root root 4096 Apr 26 2019 examples drwxrwxr-x 6 root root 60 Apr 26 2019 include -rw-rw-r-- 1 root root 2029 Apr 26 2019 LICENSE -rw-rw-r-- 1 root root 3087 Apr 26 2019 MAINTAINERS -rw-rw-r-- 1 root root 37713 Apr 26 2019 Makefile -rw-rw-r-- 1 root root 15355 Apr 26 2019 README drwxrwxr-x 5 root root 50 Apr 26 2019 reg-tests -rw-rw-r-- 1 root root 2713 Apr 26 2019 ROADMAP drwxrwxr-x 2 root root 101 Apr 26 2019 scripts drwxrwxr-x 2 root root 4096 Apr 26 2019 src -rw-rw-r-- 1 root root 14 Apr 26 2019 SUBVERS drwxrwxr-x 2 root root 4096 Apr 26 2019 tests -rw-rw-r-- 1 root root 24 Apr 26 2019 VERDATE -rw-rw-r-- 1 root root 7 Apr 26 2019 VERSION [root@node102.yinzhengjie.org.cn /usr/local/src]# [root@node102.yinzhengjie.org.cn /usr/local/src]#
3>.查看HAProxy的帮助文档
[root@node102.yinzhengjie.org.cn /usr/local/src]# ll total 2036 drwxrwxr-x 11 root root 312 Apr 26 2019 haproxy-1.8.20 -rw-r--r-- 1 root root 2083917 Dec 12 12:44 haproxy-1.8.20.tar.gz [root@node102.yinzhengjie.org.cn /usr/local/src]# [root@node102.yinzhengjie.org.cn /usr/local/src]# [root@node102.yinzhengjie.org.cn /usr/local/src]# ll haproxy-1.8.20 total 648 -rw-rw-r-- 1 root root 513114 Apr 26 2019 CHANGELOG drwxrwxr-x 18 root root 273 Apr 26 2019 contrib -rw-rw-r-- 1 root root 41508 Apr 26 2019 CONTRIBUTING drwxrwxr-x 5 root root 4096 Apr 26 2019 doc drwxrwxr-x 2 root root 4096 Apr 26 2019 ebtree drwxrwxr-x 3 root root 4096 Apr 26 2019 examples drwxrwxr-x 6 root root 60 Apr 26 2019 include -rw-rw-r-- 1 root root 2029 Apr 26 2019 LICENSE -rw-rw-r-- 1 root root 3087 Apr 26 2019 MAINTAINERS -rw-rw-r-- 1 root root 37713 Apr 26 2019 Makefile -rw-rw-r-- 1 root root 15355 Apr 26 2019 README drwxrwxr-x 5 root root 50 Apr 26 2019 reg-tests -rw-rw-r-- 1 root root 2713 Apr 26 2019 ROADMAP drwxrwxr-x 2 root root 101 Apr 26 2019 scripts drwxrwxr-x 2 root root 4096 Apr 26 2019 src -rw-rw-r-- 1 root root 14 Apr 26 2019 SUBVERS drwxrwxr-x 2 root root 4096 Apr 26 2019 tests -rw-rw-r-- 1 root root 24 Apr 26 2019 VERDATE -rw-rw-r-- 1 root root 7 Apr 26 2019 VERSION [root@node102.yinzhengjie.org.cn /usr/local/src]# [root@node102.yinzhengjie.org.cn /usr/local/src]# [root@node102.yinzhengjie.org.cn /usr/local/src]# cat haproxy-1.8.20/README #查看HAProxy的帮助文档 ---------------------- HAProxy how-to ---------------------- version 1.8 willy tarreau 2019/04/25 1) How to build it ------------------ This version is a stable version, which means that it belongs to a branch which will get some fixes for bugs as they are discovered. Versions which include the suffix "-dev" are development versions and should be avoided in production. If you are not used to build from sources or if you are not used to follow updates then it is recommended that instead you use the packages provided by your software vendor or Linux distribution. Most of them are taking this task seriously and are doing a good job at backporting important fixes. If for any reason you'd prefer a different version than the one packaged for your system, you want to be certain to have all the fixes or to get some commercial support, other choices are available at : http://www.haproxy.com/ To build haproxy, you will need : - GNU make. Neither Solaris nor OpenBSD's make work with the GNU Makefile. If you get many syntax errors when running "make", you may want to retry with "gmake" which is the name commonly used for GNU make on BSD systems. - GCC between 2.95 and 4.8. Others may work, but not tested. - GNU ld Also, you might want to build with libpcre support, which will provide a very efficient regex implementation and will also fix some badness on Solaris' one. To build haproxy, you have to choose your target OS amongst the following ones and assign it to the TARGET variable : - linux22 for Linux 2.2 - linux24 for Linux 2.4 and above (default) - linux24e for Linux 2.4 with support for a working epoll (> 0.21) - linux26 for Linux 2.6 and above - linux2628 for Linux 2.6.28, 3.x, and above (enables splice and tproxy) - solaris for Solaris 8 or 10 (others untested) - freebsd for FreeBSD 5 to 10 (others untested) - netbsd for NetBSD - osx for Mac OS/X - openbsd for OpenBSD 5.7 and above - aix51 for AIX 5.1 - aix52 for AIX 5.2 - cygwin for Cygwin - haiku for Haiku - generic for any other OS or version. - custom to manually adjust every setting You may also choose your CPU to benefit from some optimizations. This is particularly important on UltraSparc machines. For this, you can assign one of the following choices to the CPU variable : - i686 for intel PentiumPro, Pentium 2 and above, AMD Athlon - i586 for intel Pentium, AMD K6, VIA C3. - ultrasparc : Sun UltraSparc I/II/III/IV processor - native : use the build machine's specific processor optimizations. Use with extreme care, and never in virtualized environments (known to break). - generic : any other processor or no CPU-specific optimization. (default) Alternatively, you may just set the CPU_CFLAGS value to the optimal GCC options for your platform. You may want to build specific target binaries which do not match your native compiler's target. This is particularly true on 64-bit systems when you want to build a 32-bit binary. Use the ARCH variable for this purpose. Right now it only knows about a few x86 variants (i386,i486,i586,i686,x86_64), two generic ones (32,64) and sets -m32/-m64 as well as -march=<arch> accordingly. If your system supports PCRE (Perl Compatible Regular Expressions), then you really should build with libpcre which is between 2 and 10 times faster than other libc implementations. Regex are used for header processing (deletion, rewriting, allow, deny). The only inconvenient of libpcre is that it is not yet widely spread, so if you build for other systems, you might get into trouble if they don't have the dynamic library. In this situation, you should statically link libpcre into haproxy so that it will not be necessary to install it on target systems. Available build options for PCRE are : - USE_PCRE=1 to use libpcre, in whatever form is available on your system (shared or static) - USE_STATIC_PCRE=1 to use a static version of libpcre even if the dynamic one is available. This will enhance portability. - with no option, use your OS libc's standard regex implementation (default). Warning! group references on Solaris seem broken. Use static-pcre whenever possible. If your system doesn't provide PCRE, you are encouraged to download it from http://www.pcre.org/ and build it yourself, it's fast and easy. Recent systems can resolve IPv6 host names using getaddrinfo(). This primitive is not present in all libcs and does not work in all of them either. Support in glibc was broken before 2.3. Some embedded libs may not properly work either, thus, support is disabled by default, meaning that some host names which only resolve as IPv6 addresses will not resolve and configs might emit an error during parsing. If you know that your OS libc has reliable support for getaddrinfo(), you can add USE_GETADDRINFO=1 on the make command line to enable it. This is the recommended option for most Linux distro packagers since it's working fine on all recent mainstream distros. It is automatically enabled on Solaris 8 and above, as it's known to work. It is possible to add native support for SSL using the GNU makefile, by passing "USE_OPENSSL=1" on the make command line. The libssl and libcrypto will automatically be linked with haproxy. Some systems also require libz, so if the build fails due to missing symbols such as deflateInit(), then try again with "ADDLIB=-lz". Your are strongly encouraged to always use an up-to-date version of OpenSSL, as found on https://www.openssl.org/ as vulnerabilities are occasionally found and you don't want them on your systems. HAProxy is known to build correctly on all currently supported branches (0.9.8, 1.0.0, 1.0.1, 1.0.2 and 1.1.0 at the time of writing). Branch 1.0.2 is currently recommended for the best combination of features and stability. Asynchronous engines require OpenSSL 1.1.0 though. It's worth mentioning that some OpenSSL derivatives are also reported to work but may occasionally break. Patches to fix them are welcome but please read the CONTRIBUTING file first. To link OpenSSL statically against haproxy, build OpenSSL with the no-shared keyword and install it to a local directory, so your system is not affected : $ export STATICLIBSSL=/tmp/staticlibssl $ ./config --prefix=$STATICLIBSSL no-shared $ make && make install_sw When building haproxy, pass that path via SSL_INC and SSL_LIB to make and include additional libs with ADDLIB if needed (in this case for example libdl): $ make TARGET=linux26 USE_OPENSSL=1 SSL_INC=$STATICLIBSSL/include SSL_LIB=$STATICLIBSSL/lib ADDLIB=-ldl It is also possible to include native support for zlib to benefit from HTTP compression. For this, pass "USE_ZLIB=1" on the "make" command line and ensure that zlib is present on the system. Alternatively it is possible to use libslz for a faster, memory less, but slightly less efficient compression, by passing "USE_SLZ=1". Zlib is commonly found on most systems, otherwise updates can be retrieved from http://www.zlib.net/. It is easy and fast to build. Libslz can be downloaded from http://1wt.eu/projects/libslz/ and is even easier to build. By default, the DEBUG variable is set to '-g' to enable debug symbols. It is not wise to disable it on uncommon systems, because it's often the only way to get a complete core when you need one. Otherwise, you can set DEBUG to '-s' to strip the binary. For example, I use this to build for Solaris 8 : $ make TARGET=solaris CPU=ultrasparc USE_STATIC_PCRE=1 And I build it this way on OpenBSD or FreeBSD : $ gmake TARGET=freebsd USE_PCRE=1 USE_OPENSSL=1 USE_ZLIB=1 And on a classic Linux with SSL and ZLIB support (eg: Red Hat 5.x) : $ make TARGET=linux26 USE_PCRE=1 USE_OPENSSL=1 USE_ZLIB=1 And on a recent Linux >= 2.6.28 with SSL and ZLIB support : $ make TARGET=linux2628 USE_PCRE=1 USE_OPENSSL=1 USE_ZLIB=1 In order to build a 32-bit binary on an x86_64 Linux system with SSL support without support for compression but when OpenSSL requires ZLIB anyway : $ make TARGET=linux26 ARCH=i386 USE_OPENSSL=1 ADDLIB=-lz The SSL stack supports session cache synchronization between all running processes. This involves some atomic operations and synchronization operations which come in multiple flavors depending on the system and architecture : Atomic operations : - internal assembler versions for x86/x86_64 architectures - gcc builtins for other architectures. Some architectures might not be fully supported or might require a more recent version of gcc. If your architecture is not supported, you willy have to either use pthread if supported, or to disable the shared cache. - pthread (posix threads). Pthreads are very common but inter-process support is not that common, and some older operating systems did not report an error when enabling multi-process mode, so they used to silently fail, possibly causing crashes. Linux's implementation is fine. OpenBSD doesn't support them and doesn't build. FreeBSD 9 builds and reports an error at runtime, while certain older versions might silently fail. Pthreads are enabled using USE_PTHREAD_PSHARED=1. Synchronization operations : - internal spinlock : this mode is OS-independent, light but will not scale well to many processes. However, accesses to the session cache are rare enough that this mode could certainly always be used. This is the default mode. - Futexes, which are Linux-specific highly scalable light weight mutexes implemented in user-space with some limited assistance from the kernel. This is the default on Linux 2.6 and above and is enabled by passing USE_FUTEX=1 - pthread (posix threads). See above. If none of these mechanisms is supported by your platform, you may need to build with USE_PRIVATE_CACHE=1 to totally disable SSL cache sharing. Then it is better not to run SSL on multiple processes. If you need to pass other defines, includes, libraries, etc... then please check the Makefile to see which ones will be available in your case, and use the USE_* variables in the Makefile. AIX 5.3 is known to work with the generic target. However, for the binary to also run on 5.2 or earlier, you need to build with DEFINE="-D_MSGQSUPPORT", otherwise __fd_select() will be used while not being present in the libc, but this is easily addressed using the "aix52" target. If you get build errors because of strange symbols or section mismatches, simply remove -g from DEBUG_CFLAGS. You can easily define your own target with the GNU Makefile. Unknown targets are processed with no default option except USE_POLL=default. So you can very well use that property to define your own set of options. USE_POLL can even be disabled by setting USE_POLL="". For example : $ gmake TARGET=tiny USE_POLL="" TARGET_CFLAGS=-fomit-frame-pointer 1.1) Device Detection --------------------- HAProxy supports several device detection modules relying on third party products. Some of them may provide free code, others free libs, others free evaluation licenses. Please read about their respective details in the following files : doc/DeviceAtlas-device-detection.txt for DeviceAtlas doc/51Degrees-device-detection.txt for 51Degrees doc/WURFL-device-detection.txt for Scientiamobile WURFL 2) How to install it -------------------- To install haproxy, you can either copy the single resulting binary to the place you want, or run : $ sudo make install If you're packaging it for another system, you can specify its root directory in the usual DESTDIR variable. 3) How to set it up ------------------- There is some documentation in the doc/ directory : - intro.txt : this is an introduction to haproxy, it explains what it is what it is not. Useful for beginners or to re-discover it when planning for an upgrade. - architecture.txt : this is the architecture manual. It is quite old and does not tell about the nice new features, but it's still a good starting point when you know what you want but don't know how to do it. - configuration.txt : this is the configuration manual. It recalls a few essential HTTP basic concepts, and details all the configuration file syntax (keywords, units). It also describes the log and stats format. It is normally always up to date. If you see that something is missing from it, please report it as this is a bug. Please note that this file is huge and that it's generally more convenient to review Cyril Bont禳 HTML translation online here : http://cbonte.github.io/haproxy-dconv/configuration-1.6.html - management.txt : it explains how to start haproxy, how to manage it at runtime, how to manage it on multiple nodes, how to proceed with seamless upgrades. - gpl.txt / lgpl.txt : the copy of the licenses covering the software. See the 'LICENSE' file at the top for more information. - the rest is mainly for developers. There are also a number of nice configuration examples in the "examples" directory as well as on several sites and articles on the net which are linked to from the haproxy web site. 4) How to report a bug ---------------------- It is possible that from time to time you'll find a bug. A bug is a case where what you see is not what is documented. Otherwise it can be a misdesign. If you find that something is stupidly design, please discuss it on the list (see the "how to contribute" section below). If you feel like you're proceeding right and haproxy doesn't obey, then first ask yourself if it is possible that nobody before you has even encountered this issue. If it's unlikely, the you probably have an issue in your setup. Just in case of doubt, please consult the mailing list archives : http://marc.info/?l=haproxy Otherwise, please try to gather the maximum amount of information to help reproduce the issue and send that to the mailing list : haproxy@formilux.org Please include your configuration and logs. You can mask your IP addresses and passwords, we don't need them. But it's essential that you post your config if you want people to guess what is happening. Also, keep in mind that haproxy is designed to NEVER CRASH. If you see it die without any reason, then it definitely is a critical bug that must be reported and urgently fixed. It has happened a couple of times in the past, essentially on development versions running on new architectures. If you think your setup is fairly common, then it is possible that the issue is totally unrelated. Anyway, if that happens, feel free to contact me directly, as I will give you instructions on how to collect a usable core file, and will probably ask for other captures that you'll not want to share with the list. 5) How to contribute -------------------- Please carefully read the CONTRIBUTING file that comes with the sources. It is mandatory. -- end [root@node102.yinzhengjie.org.cn /usr/local/src]#
4>.编译HAProxy
[root@node102.yinzhengjie.org.cn /usr/local/src]# ll total 2036 drwxrwxr-x 11 root root 312 Apr 26 2019 haproxy-1.8.20 -rw-r--r-- 1 root root 2083917 Dec 12 12:44 haproxy-1.8.20.tar.gz [root@node102.yinzhengjie.org.cn /usr/local/src]# [root@node102.yinzhengjie.org.cn /usr/local/src]# cd haproxy-1.8.20 [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# make ARCH=x86_64 TARGET=linux2628 USE_PCRE=1 USE_OPENSSL=1 USE_ZLIB=1 USE_SYSTEMD=1 USE_CPU_AFFINITY=1 PREFIX=/yinzhengjie/softwares/haproxy ...... [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# echo $? 0 [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# 以上通用编译参数说明如下: ARCH=x86_64: 指定CPU的架构为"x86_64"。 TARGET=linux2628: 指定HAProxy安装平台的内核版本,表示"Linux内核版本 >= 2.6.28"。 USE_PCRE=1: 开启正则表达式。 USE_OPENSSL=1: 开启OPENSSL功能。 USE_ZLIB=1: 开启压缩和解压缩功能。 USE_SYSTEMD=1: 支持以"systemd"的方式启动。 USE_CPU_AFFINITY=1 开启CPU的亲和性。 PREFIX=/yinzhengjie/softwares/haproxy: 指定Haproxy的安装路径为"/yinzhengjie/softwares/haproxy"。
5>.安装HAProxy
[root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# ll /yinzhengjie/softwares/haproxy ls: cannot access /yinzhengjie/softwares/haproxy: No such file or directory [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# make install PREFIX=/yinzhengjie/softwares/haproxy install -d "/yinzhengjie/softwares/haproxy/sbin" install haproxy "/yinzhengjie/softwares/haproxy/sbin" install -d "/yinzhengjie/softwares/haproxy/share/man"/man1 install -m 644 doc/haproxy.1 "/yinzhengjie/softwares/haproxy/share/man"/man1 install -d "/yinzhengjie/softwares/haproxy/doc/haproxy" for x in configuration management architecture peers-v2.0 cookie-options lua WURFL-device-detection proxy-protocol linux-syn-cookies network-name spaces DeviceAtlas-device-detection 51Degrees-device-detection netscaler-client-ip-insertion-protocol peers close-options SPOE intro; do install -m 644 doc/$x.txt "/yinzhengjie/softwares/haproxy/doc/haproxy" ; done [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# ll /yinzhengjie/softwares/haproxy total 0 drwxr-xr-x 3 root root 21 Jan 1 11:41 doc drwxr-xr-x 2 root root 21 Jan 1 11:41 sbin drwxr-xr-x 3 root root 17 Jan 1 11:41 share [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]#
6>.查看"haproxy"脚本的帮助信息
[root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# ll total 8724 -rw-rw-r-- 1 root root 513114 Apr 26 2019 CHANGELOG drwxrwxr-x 18 root root 273 Apr 26 2019 contrib -rw-rw-r-- 1 root root 41508 Apr 26 2019 CONTRIBUTING drwxrwxr-x 5 root root 4096 Apr 26 2019 doc drwxrwxr-x 2 root root 4096 Jan 1 11:36 ebtree drwxrwxr-x 3 root root 4096 Apr 26 2019 examples -rwxr-xr-x 1 root root 8259352 Jan 1 11:37 haproxy #安装Haproxy服务后，会生成该文件 drwxrwxr-x 6 root root 60 Apr 26 2019 include -rw-rw-r-- 1 root root 2029 Apr 26 2019 LICENSE -rw-rw-r-- 1 root root 3087 Apr 26 2019 MAINTAINERS -rw-rw-r-- 1 root root 37713 Apr 26 2019 Makefile -rw-rw-r-- 1 root root 15355 Apr 26 2019 README drwxrwxr-x 5 root root 50 Apr 26 2019 reg-tests -rw-rw-r-- 1 root root 2713 Apr 26 2019 ROADMAP drwxrwxr-x 2 root root 101 Apr 26 2019 scripts drwxrwxr-x 2 root root 8192 Jan 1 11:37 src -rw-rw-r-- 1 root root 14 Apr 26 2019 SUBVERS drwxrwxr-x 2 root root 4096 Apr 26 2019 tests -rw-rw-r-- 1 root root 24 Apr 26 2019 VERDATE -rw-rw-r-- 1 root root 7 Apr 26 2019 VERSION [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# ./haproxy -v #查看安装的版本号 HA-Proxy version 1.8.20 2019/04/25 Copyright 2000-2019 Willy Tarreau <willy@haproxy.org> [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]#
[root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# ./haproxy -h #查看帮助信息 HA-Proxy version 1.8.20 2019/04/25 Copyright 2000-2019 Willy Tarreau <willy@haproxy.org> Usage : haproxy [-f <cfgfile|cfgdir>]* [ -vdVD ] [ -n <maxconn> ] [ -N <maxpconn> ] [ -p <pidfile> ] [ -m <max megs> ] [ -C <dir> ] [-- <cfgfile>*] -v displays version ; -vv shows known build options. -d enters debug mode ; -db only disables background mode. -dM[<byte>] poisons memory with <byte> (defaults to 0x50) -V enters verbose mode (disables quiet mode) -D goes daemon ; -C changes to <dir> before loading files. -W master-worker mode. -Ws master-worker mode with systemd notify support. -q quiet mode : don't display messages -c check mode : only check config files and exit -n sets the maximum total # of connections (2000) -m limits the usable amount of memory (in MB) -N sets the default, per-proxy maximum # of connections (2000) -L set local peer name (default to hostname) -p writes pids of all children to this file -de disables epoll() usage even when available -dp disables poll() usage even when available -dS disables splice usage (broken on old kernels) -dR disables SO_REUSEPORT usage -dr ignores server address resolution failures -dV disables SSL verify on servers side -sf/-st [pid ]* finishes/terminates old pids. -x <unix_socket> get listening sockets from a unix socket [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]#
[root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# ./haproxy -vv HA-Proxy version 1.8.20 2019/04/25 Copyright 2000-2019 Willy Tarreau <willy@haproxy.org> Build options : TARGET = linux2628 CPU = generic CC = gcc CFLAGS = -m64 -march=x86-64 -O2 -g -fno-strict-aliasing -Wdeclaration-after-statement -fwrapv -Wno-unused-label OPTIONS = USE_ZLIB=1 USE_CPU_AFFINITY=1 USE_OPENSSL=1 USE_SYSTEMD=1 USE_PCRE=1 Default settings : maxconn = 2000, bufsize = 16384, maxrewrite = 1024, maxpollevents = 200 Built with OpenSSL version : OpenSSL 1.0.2k-fips 26 Jan 2017 Running on OpenSSL version : OpenSSL 1.0.2k-fips 26 Jan 2017 OpenSSL library supports TLS extensions : yes OpenSSL library supports SNI : yes OpenSSL library supports : SSLv3 TLSv1.0 TLSv1.1 TLSv1.2 Built with transparent proxy support using: IP_TRANSPARENT IPV6_TRANSPARENT IP_FREEBIND Encrypted password support via crypt(3): yes Built with multi-threading support. Built with PCRE version : 8.32 2012-11-30 Running on PCRE version : 8.32 2012-11-30 PCRE library supports JIT : no (USE_PCRE_JIT not set) Built with zlib version : 1.2.7 Running on zlib version : 1.2.7 Compression algorithms supported : identity("identity"), deflate("deflate"), raw-deflate("deflate"), gzip("gzip") Built with network namespace support. Available polling systems : epoll : pref=300, test result OK poll : pref=200, test result OK select : pref=150, test result OK Total: 3 (3 usable), will use epoll. Available filters : [SPOE] spoe [COMP] compression [TRACE] trace [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]#
7>.创建haproxy的启动脚本
[root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# cp haproxy /usr/sbin/ [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# which haproxy /usr/sbin/haproxy [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# [root@node102.yinzhengjie.org.cn /usr/local/src/haproxy-1.8.20]# cd [root@node102.yinzhengjie.org.cn ~]# [root@node102.yinzhengjie.org.cn ~]# vim /usr/lib/systemd/system/haproxy.service [root@node102.yinzhengjie.org.cn ~]# [root@node102.yinzhengjie.org.cn ~]# cat /usr/lib/systemd/system/haproxy.service [Unit] Description=Yinzhengjie's HAProxyLoad Balancer After=syslog.target network.target [Service] ExecStartPre=/usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg -c -q ExecStart=/usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /yinzhengjie/softwares/haproxy/haproxy.pid ExecReload=/bin/kill -USR2 $MAINPID [Install] WantedBy=multi-user.target [root@node102.yinzhengjie.org.cn ~]#
8>.编辑haproxy的配置文件
[root@node102.yinzhengjie.org.cn ~]# mkdir /etc/haproxy
[root@node102.yinzhengjie.org.cn ~]#
[root@node102.yinzhengjie.org.cn ~]# vim /etc/haproxy/haproxy.cfg
[root@node102.yinzhengjie.org.cn ~]#
[root@node102.yinzhengjie.org.cn ~]# cat /etc/haproxy/haproxy.cfg
global
maxconn 100000
chroot /yinzhengjie/softwares/haproxy
user nobody
group nobody
daemon
nbproc 2
cpu-map 1 0
cpu-map 2 1
nbthread 2
pidfile /yinzhengjie/softwares/haproxy/haproxy.pid
log 127.0.0.1 local5 info
defaults
option http-keep-alive
mode http
listen status_page
bind 172.30.1.102:8888
stats enable
stats uri /haproxy-status
stats auth admin:yinzhengjie
stats realm "Welcome to the haproxy load balancer status page of YinZhengjie"
[root@node102.yinzhengjie.org.cn ~]#
9>.启动haproxy服务
[root@node102.yinzhengjie.org.cn ~]# netstat -untalp | grep haproxy
[root@node102.yinzhengjie.org.cn ~]#
[root@node102.yinzhengjie.org.cn ~]# ss -ntl
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 *:22 *:*
LISTEN 0 128 :::22 :::*
[root@node102.yinzhengjie.org.cn ~]#
[root@node102.yinzhengjie.org.cn ~]# systemctl start haproxy
[root@node102.yinzhengjie.org.cn ~]#
[root@node102.yinzhengjie.org.cn ~]# ss -ntl
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 *:22 *:*
LISTEN 0 128 172.30.1.102:8888 *:*
LISTEN 0 128 :::22 :::*
[root@node102.yinzhengjie.org.cn ~]#
[root@node102.yinzhengjie.org.cn ~]# netstat -untalp | grep haproxy
tcp 0 0 172.30.1.102:8888 0.0.0.0:* LISTEN 6984/haproxy
[root@node102.yinzhengjie.org.cn ~]#
[root@node102.yinzhengjie.org.cn ~]# ps -ef | grep haproxy | grep -v grep
root 6981 1 0 10:43 ? 00:00:00 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /yinzhengjie/softwares/haproxy/haproxy.pid
nobody 6984 6981 0 10:43 ? 00:00:00 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /yinzhengjie/softwares/haproxy/haproxy.pid
nobody 6985 6981 0 10:43 ? 00:00:00 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /yinzhengjie/softwares/haproxy/haproxy.pid
[root@node102.yinzhengjie.org.cn ~]#
[root@node102.yinzhengjie.org.cn ~]#
10>.浏览器访问"http://node102.yinzhengjie.org.cn:8888/haproxy-status"查看haproxy的工作状态
如上图所示，将HAProxy的用户名密码(记录在咱们配置的"/etc/haproxy/haproxy.cfg"文件中)输入后就会验证成功，验证成功就会跳转到HAProxy的监控页面，如下图所示。
五.博主推荐阅读
配置文件说明:
https://www.cnblogs.com/yinzhengjie/p/12114081.html
状态页配置:
https://www.cnblogs.com/yinzhengjie/p/12147925.html