ロードバランサを使ったProxy冗長化
（HAProxy + Heartbeat/Pacemaker）

# Set ENABLED to 1 if you want the init script to start haproxy.
# ENABLED=0
ENABLED=1
# Add extra flags here.
#EXTRAOPTS="-de -m 16"

# this config needs haproxy-1.1.28 or haproxy-1.2.1

global
log 127.0.0.1 local0
log 127.0.0.1 local1 notice
#log loghost local0 info
maxconn 4096 # --- 最大接続数
#chroot /usr/share/haproxy
user haproxy
group haproxy
daemon
#debug
#quiet
pidfile /var/run/haproxy.pid # --- Heartbeatで必要となるので指定しておくこと

defaults # --- デフォルト値の定義
log global
mode http # --- L7(HTTP)モードで動作させる
option httplog
option dontlognull
retries 3
option redispatch # --- cookie使用中に利用中のProxyサーバが不調の場合、別のProxyに切り替えて接続を継続する
maxconn 4096 # --- デフォルトの最大接続数
contimeout 5000
clitimeout 50000
srvtimeout 50000

# listen webfarm 0.0.0.0:8080
listen webfarm 192.168.1.20:8080
mode http
cookie SERVERID insert indirect nocache
balance roundrobin # --- ラウンドロビン方式で負荷分散を行う。セッションの維持を考えると "balance leastconn" の方が良いと思われる。
option httpclose
option forwardfor # --- 上位のProxyへクライアントIPを渡す
server proxy1 192.168.1.10:3128 check inter 2000 rise 2 fall 5 # --- 上位のProxyサーバの指定。2秒間隔でヘルスチェックし、5回反応しないと落ちていると判断。2回成功すれば復旧。
server proxy2 192.168.1.11:3128 check inter 2000 rise 2 fall 5
server proxy3 192.168.1.12:3128 check inter 2000 rise 2 fall 5

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
#- allow-hotplug eth0
#- iface eth0 inet dhcp

# -
allow-hotplug eth0
auto eth0
iface eth0 inet static
address 192.168.1.21
netmask 255.255.255.0
gateway 192.168.1.254

auto eth1
iface eth1 inet static
address 10.0.0.1
netmask 255.255.255.0

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
#- allow-hotplug eth0
#- iface eth0 inet dhcp

# -
allow-hotplug eth0
auto eth0
iface eth0 inet static
address 192.168.1.22
netmask 255.255.255.0
gateway 192.168.1.254

auto eth1
iface eth1 inet static
address 10.0.0.2
netmask 255.255.255.0

127.0.0.1 localhost

192.168.1.21 hanode1.example.jp hanode1
192.168.1.22 hanode2.example.jp hanode2


# The following lines are desirable for IPv6 capable hosts
::1 ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

auth 2 # --- 暗号方式として sha1 を使う (CRC, MD5は単に定義しているだけ）
1 crc
2 sha1 haproxy_Password # --- パスワードとして"haproxy_Password"を指定
3 md5 Hello!

::
::
# Facility to use for syslog()/logger
#
logfacility local0
::
# keepalive: how long between heartbeats?
#
keepalive 2
::
# deadtime: how long-to-declare-host-dead?
#
# If you set this too low you will get the problematic
# split-brain (or cluster partition) problem.
# See the FAQ for how to use warntime to tune deadtime.
deadtime 30
::
# warntime: how long before issuing "late heartbeat" warning?
# See the FAQ for how to use warntime to tune deadtime.
warntime 10
::
# What UDP port to use for bcast/ucast communication?
#
udpport 694
::
# Set up a unicast / udp heartbeat medium
# ucast [dev] [peer-ip-addr]
#
# [dev] device to send/rcv heartbeats on
# [peer-ip-addr] IP address of peer to send packets to
#
ucast eth1 10.0.0.2 # --- Heartbeat で監視する相手のIPアドレス
::
# The default value for auto_failback is "legacy", which
# will issue a warning at startup. So, make sure you put
# an auto_failback directive in your ha.cf file.
# (note: auto_failback can be any boolean or "legacy")
#
auto_failback off # --- 待機系へ切り替わった場合、稼働系が動き出した際に切り返す場合は "on" (時間を節約するなら"off")
::
# Tell what machines are in the cluster
# node nodename ... -- must match uname -n
#node ken3
#node kathy
#
# HA の対象となるノードの名前を指定。
node hanode1 # --- それぞれのノードの "uname -n"での名前と一致する名前を指定すること。
node hanode2

::
::
# Facility to use for syslog()/logger
#
logfacility local0
::
# keepalive: how long between heartbeats?
#
keepalive 2
::
# deadtime: how long-to-declare-host-dead?
#
# If you set this too low you will get the problematic
# split-brain (or cluster partition) problem.
# See the FAQ for how to use warntime to tune deadtime.
deadtime 30
::
# warntime: how long before issuing "late heartbeat" warning?
# See the FAQ for how to use warntime to tune deadtime.
warntime 10
::
# What UDP port to use for bcast/ucast communication?
#
udpport 694
::
# Set up a unicast / udp heartbeat medium
# ucast [dev] [peer-ip-addr]
#
# [dev] device to send/rcv heartbeats on
# [peer-ip-addr] IP address of peer to send packets to
#
ucast eth1 10.0.0.1
::
# The default value for auto_failback is "legacy", which
# will issue a warning at startup. So, make sure you put
# an auto_failback directive in your ha.cf file.
# (note: auto_failback can be any boolean or "legacy")
#
auto_failback off # --- 待機系へ切り替わった場合、稼働系が動き出した際に切り返す場合は "on" (時間を節約するなら"off")
::
# Tell what machines are in the cluster
# node nodename ... -- must match uname -n
#node ken3
#node kathy
node hanode1
node hanode2

hanode1 192.168.1.20/24/eth0 haproxy # hanode1では、仮想IPをeth0に割り当ててから haproxy サービスを起動

hanode2 192.168.1.20/24/eth0 haproxy

::
::
crm yes

#!/bin/sh
#
# Resource script for haproxy daemon
#
# Description:  Manages haproxy daemon as an OCF resource in
#               an High Availability setup.
#
# HAProxy OCF script's Author: Russki
# Rsync OCF script's Author: Dhairesh Oza <[email protected]>
# License: GNU General Public License (GPL)
#
#
#       usage: $0 {start|stop|status|monitor|validate-all|meta-data}
#
#       The "start" arg starts haproxy.
#
#       The "stop" arg stops it.
#
# OCF parameters:
# OCF_RESKEY_binpath
# OCF_RESKEY_conffile
# OCF_RESKEY_extraconf
#
# Note:This RA requires that the haproxy config files has a "pidfile"
# entry so that it is able to act on the correct process
##########################################################################
# Initialization:

: ${OCF_FUNCTIONS_DIR=${OCF_ROOT}/resource.d/heartbeat}
. ${OCF_FUNCTIONS_DIR}/.ocf-shellfuncs

USAGE="Usage: $0 {start|stop|status|monitor|validate-all|meta-data}";

##########################################################################

usage()
{
        echo $USAGE >&2
}

meta_data()
{
cat <<END
<?xml version="1.0"?>
<!DOCTYPE resource-agent SYSTEM "ra-api-1.dtd">
<resource-agent name="haproxy">
<version>1.0</version>
<longdesc lang="en">
This script manages haproxy daemon
</longdesc>
<shortdesc lang="en">Manages an haproxy daemon</shortdesc>

<parameters>

<parameter name="binpath">
<longdesc lang="en">
The haproxy binary path.
For example, "/usr/sbin/haproxy"
</longdesc>
<shortdesc lang="en">Full path to the haproxy binary</shortdesc>
<content type="string" default="/usr/sbin/haproxy"/>
</parameter>

<parameter name="conffile">
<longdesc lang="en">
The haproxy daemon configuration file name with full path.
For example, "/etc/haproxy/haproxy.cfg"
</longdesc>
<shortdesc lang="en">Configuration file name with full path</shortdesc>
<content type="string" default="/etc/haproxy/haproxy.cfg" />
</parameter>

<parameter name="extraconf">
<longdesc lang="en">
Extra command line arguments to pass to haproxy.
For example, "-f /etc/haproxy/shared.cfg"
</longdesc>
<shortdesc lang="en">Extra command line arguments for haproxy</shortdesc>
<content type="string" default="" />
</parameter>

</parameters>

<actions>
<action name="start" timeout="20s"/>
<action name="stop" timeout="20s"/>
<action name="monitor" depth="0" timeout="20s" interval="60s" />
<action name="validate-all" timeout="20s"/>
<action name="meta-data"  timeout="5s"/>
</actions>
</resource-agent>
END
exit $OCF_SUCCESS
}

get_pid_and_conf_file()
{
        if [ -n "$OCF_RESKEY_conffile" ]; then
                CONF_FILE=$OCF_RESKEY_conffile
        else
                CONF_FILE="/etc/haproxy/haproxy.cfg"
        fi

        PIDFILE="`grep -v \"#\" ${CONF_FILE} | grep \"pidfile\" | sed 's/^[ \t]*pidfile[ \t]*//'`"
        if [ "${PIDFILE}" = '' ]; then
                PIDFILE="/var/run/${OCF_RESOURCE_INSTANCE}.pid"
        fi
}

haproxy_status()
{
        if [ -n "$PIDFILE" -a -f "$PIDFILE" ]; then
                # haproxy is probably running
                PID=`cat $PIDFILE`
                if [ -n "$PID" ]; then
                        if ps -p $PID | grep haproxy >/dev/null ; then
                                ocf_log info "haproxy daemon running"
                                return $OCF_SUCCESS
                        else
                                ocf_log info "haproxy daemon is not running but pid file exists"
                                return $OCF_NOT_RUNNING
                        fi
                else
                        ocf_log err "PID file empty!"
                        return $OCF_ERR_GENERIC
                fi
        fi

        # haproxy is not running
        ocf_log info "haproxy daemon is not running"
        return $OCF_NOT_RUNNING
}

haproxy_start()
{
        # if haproxy is running return success
        haproxy_status
        retVal=$?
        if [ $retVal -eq $OCF_SUCCESS ]; then
                exit $OCF_SUCCESS
        elif [ $retVal -ne $OCF_NOT_RUNNING ]; then
                ocf_log err "Error. Unknown status."
                exit $OCF_ERR_GENERIC
        fi

        if [ -n "$OCF_RESKEY_binpath" ]; then
                COMMAND="$OCF_RESKEY_binpath"
        else
                COMMAND="/usr/sbin/haproxy"
        fi

        $COMMAND $OCF_RESKEY_extraconf -f $CONF_FILE -p $PIDFILE;
        if [ $? -ne 0 ]; then
                ocf_log err "Error. haproxy daemon returned error $?."
                exit $OCF_ERR_GENERIC
        fi

        ocf_log info "Started haproxy daemon."
        exit $OCF_SUCCESS
}


haproxy_stop()
{
        if haproxy_status ; then
                PID=`cat $PIDFILE`
                if [ -n "$PID" ] ; then
                        kill $PID
                        if [ $? -ne 0 ]; then
                                kill -SIGKILL $PID
                                if [ $? -ne 0 ]; then
                                        ocf_log err "Error. Could not stop haproxy daemon."
                                        return $OCF_ERR_GENERIC
                                fi
                        fi
                        rm $PIDFILE 2>/dev/null
                fi
        fi
        ocf_log info "Stopped haproxy daemon."
        exit $OCF_SUCCESS
}

haproxy_monitor()
{
        haproxy_status
}

haproxy_validate_all()
{
        if [ -n "$OCF_RESKEY_binpath" -a ! -x "$OCF_RESKEY_binpath" ]; then
                ocf_log err "Binary path $OCF_RESKEY_binpath does not exist."
                exit $OCF_ERR_ARGS
        fi
        if [ -n "$OCF_RESKEY_conffile" -a ! -f "$OCF_RESKEY_conffile" ]; then
                ocf_log err "Config file $OCF_RESKEY_conffile does not exist."
                exit $OCF_ERR_ARGS
        fi

        if  grep -v "^#" "$CONF_FILE" | grep "pidfile" > /dev/null ; then
                :
        else
                ocf_log err "Error. \"pidfile\" entry required in the haproxy config file by haproxy OCF RA."
                return $OCF_ERR_GENERIC
        fi

        return $OCF_SUCCESS
}


#
# Main
#

if [ $# -ne 1 ]; then
        usage
        exit $OCF_ERR_ARGS
fi

case $1 in
        start)  get_pid_and_conf_file
                haproxy_start
                ;;

        stop)   get_pid_and_conf_file
                haproxy_stop
                ;;

        status) get_pid_and_conf_file
                haproxy_status
                ;;

        monitor)get_pid_and_conf_file
                haproxy_monitor
                ;;

        validate-all)   get_pid_and_conf_file
                        haproxy_validate_all
                        ;;

        meta-data)      meta_data
                        ;;

        usage)  usage
                exit $OCF_SUCCESS
                ;;

        *)      usage
                exit $OCF_ERR_UNIMPLEMENTED
                ;;
esac

::
acl haproxys src 192.168.1.21/32
acl haproxys src 192.168.1.22/32
::
follow_x_forwarded_for allow haproxys
::
acl_uses_indirect_client on