多台服务器集群搭建方案

upstream backend_cluster {
    # 基于 cookie 的会话粘滞
    sticky cookie srv_id expires=1h domain=.example.com path=/;

    server 10.0.0.11:8080 weight=1 max_fails=3 fail_timeout=10s;
    server 10.0.0.12:8080 weight=1 max_fails=3 fail_timeout=10s;
    keepalive 64;
}

# 安装与启动
sudo apt install -y chrony
sudo systemctl enable --now chronyd

# 查看同步状态
chronyc sources -v
chronyc tracking

# /etc/chrony/chrony.conf 推荐配置
pool ntp.aliyun.com iburst
pool time.cloudflare.com iburst

# 内网场景：主节点对外同步，其余节点同步主节点
# server 10.0.0.11 iburst

driftfile /var/lib/chrony/chrony.drift
makestep 1.0 3
rtcsync
logdir /var/log/chrony

# 允许内网其他节点同步本机的网段
allow 10.0.0.0/24

# 两台都要安装
sudo apt install -y keepalived

# 允许绑定非本机 IP（VIP 必需）
echo 'net.ipv4.ip_nonlocal_bind = 1' | sudo tee -a /etc/sysctl.d/99-cluster.conf
sudo sysctl --system

! Configuration File for keepalived - MASTER node

global_defs {
    router_id nginx_lb_01          # 集群内唯一
    script_user root
    enable_script_security
}

# 健康检查脚本：Nginx 挂了就降低本节点优先级触发漂移
vrrp_script chk_nginx {
    script "/usr/bin/pgrep nginx"
    interval 2
    timeout 2
    weight -30
    fall 2
    rise 1
}

vrrp_instance VI_1 {
    state MASTER                   # 备机写 BACKUP
    interface eth0                 # 改成实际网卡名
    virtual_router_id 51           # 同一集群必须一致，0-255
    priority 150                   # 备机写 100，必须低于主机
    advert_int 1                   # VRRP 通告间隔，单位秒

    authentication {
        auth_type PASS
        auth_pass Cluster@2026     # 8 位以内，主备必须一致
    }

    unicast_src_ip 10.0.0.11       # 云服务器不支持组播时必须配单播
    unicast_peer {
        10.0.0.12
    }

    virtual_ipaddress {
        10.0.0.100/24 dev eth0 label eth0:0
    }

    track_script {
        chk_nginx
    }

    notify_master "/etc/keepalived/scripts/notify.sh master"
    notify_backup "/etc/keepalived/scripts/notify.sh backup"
    notify_fault  "/etc/keepalived/scripts/notify.sh fault"
}

#!/usr/bin/env bash
# /etc/keepalived/scripts/notify.sh
LOG=/var/log/keepalived-notify.log
case "$1" in
    master)
        echo "$(date '+%F %T') [$(hostname)] 切换为 MASTER，VIP 已接管" >> "$LOG"
        systemctl reload nginx
        curl -s -X POST "https://oapi.example.com/hook" \
             -H 'Content-Type: application/json' \
             -d "{\"msg\":\"[$(hostname)] Keepalived VIP 漂移：本机已变为 MASTER\"}"
        ;;
    backup|fault)
        echo "$(date '+%F %T') [$(hostname)] 切换为 $1" >> "$LOG"
        ;;
esac

sudo chmod +x /etc/keepalived/scripts/notify.sh
sudo systemctl enable --now keepalived

# 验证：应该看到 VIP 绑定在 eth0 上
ip addr show eth0 | grep -E 'inet |10.0.0.100'

# 抓 VRRP 报文确认心跳是否正常（云上抓不到说明安全组没放行协议 112）
sudo tcpdump -i eth0 -nn proto 112

upstream app_backend {
    least_conn;                     # 最少连接调度，长连接场景优于轮询

    server 10.0.0.11:8080 weight=2 max_fails=3 fail_timeout=10s slow_start=30s;
    server 10.0.0.12:8080 weight=2 max_fails=3 fail_timeout=10s slow_start=30s;
    server 10.0.0.13:8080 backup;   # 备用节点，主节点全挂才启用

    keepalive 128;                  # 到后端的空闲连接池
    keepalive_requests 1000;
    keepalive_timeout 60s;
}

server {
    listen 80;
    server_name example.com;

    location / {
        proxy_pass http://app_backend;
        proxy_http_version 1.1;
        proxy_set_header Connection "";        # keepalive 必需
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_connect_timeout 3s;
        proxy_send_timeout    10s;
        proxy_read_timeout    30s;

        # 后端返回 5xx 或超时，自动重试下一个节点
        proxy_next_upstream error timeout http_500 http_502 http_503 http_504;
        proxy_next_upstream_tries 2;
        proxy_next_upstream_timeout 5s;
    }

    # 对外健康检查端点，供云 SLB 或监控系统调用
    location /healthz {
        access_log off;
        return 200 "ok\n";
    }
}

vrrp_instance VI_1 {
    state BACKUP           # 双 BACKUP + nopreempt 是防抖动的最佳实践
    nopreempt              # 主节点恢复后不自动抢占，避免频繁切换
    preempt_delay 300      # 若必须抢占，延迟 300 秒再执行

    # 双活/多活时给每个实例不同的 virtual_router_id
    # 也可配合 allow_duplicate 做双主（不推荐用于有状态服务）
}

# 用 ping 网关作为第三方仲裁：网关都 ping 不通说明是自己断网，主动降权退出主角色
cat > /etc/keepalived/scripts/chk_gateway.sh <<'EOF'
#!/usr/bin/env bash
GATEWAY=$(ip route | awk '/default/ {print $3; exit}')
ping -c 2 -W 2 "$GATEWAY" >/dev/null 2>&1
exit $?
EOF
chmod +x /etc/keepalived/scripts/chk_gateway.sh