sestatus | grep "current mode"
# 輸出應為：current mode: permissive

# 安裝依賴
sudo dnf groupinstall "Development Tools" -y
sudo dnf install pcre-devel zlib-devel openssl-devel wget tar gcc make -y

# 下載并編譯 Nginx（以 1.24.0 為例）
cd /tmp
wget https://nginx.org/download/nginx-1.24.0.tar.gz
tar -zxvf nginx-1.24.0.tar.gz
cd nginx-1.24.0

./configure \
  --prefix=/usr/local/nginx \
  --sbin-path=/usr/local/nginx/sbin/nginx \
  --conf-path=/usr/local/nginx/conf/nginx.conf \
  --pid-path=/usr/local/nginx/logs/nginx.pid \
  --with-http_ssl_module \
  --with-http_v2_module \
  --with-http_realip_module \
  --with-http_stub_status_module \
  --with-stream \
  --with-stream_ssl_module \
  --with-compat

make && sudo make install

/usr/local/nginx/sbin/nginx -V 2>&1 | grep -E "(SSL|HTTP_V2|STREAM)"
# 應輸出包含 ssl, http_v2, stream 字樣

sudo dnf install keepalived -y
# 啟用開機自啟（但先不啟動）
sudo systemctl enable keepalived

# 全局塊
user  nginx;
worker_processes  auto;
worker_rlimit_nofile 65535;
events {
    use epoll;
    worker_connections  65535;
    multi_accept on;
}
# HTTP 塊：處理 Web 流量
http {
    include       mime.types;
    default_type  application/octet-stream;
    # 日志格式增強：記錄 upstream 響應時間、狀態(tài)、地址
    log_format main '$remote_addr - $remote_user [$time_local] '
                      '"$request" $status $body_bytes_sent '
                      '"$http_referer" "$http_user_agent" '
                      'rt=$request_time uct="$upstream_connect_time" '
                      'uht="$upstream_header_time" urt="$upstream_response_time" '
                      'upstream_addr=$upstream_addr';
    access_log  /usr/local/nginx/logs/access.log  main;
    error_log   /usr/local/nginx/logs/error.log  warn;
    sendfile        on;
    tcp_nopush      on;
    tcp_nodelay     on;
    keepalive_timeout  65;
    types_hash_max_size 2048;
    # 啟用健康檢查狀態(tài)頁（供 Keepalived 腳本調(diào)用）
    server {
        listen 127.0.0.1:8081;
        location /healthz {
            return 200 "OK\n";
            add_header Content-Type text/plain;
        }
        # 檢查 upstream 是否可達（curl 后端 Java 服務）
        location /backend-health {
            proxy_pass http://192.168.56.20:8080/actuator/health;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_read_timeout 3;
            proxy_connect_timeout 3;
        }
    }
    # 主業(yè)務 Server 塊
    server {
        listen       80;
        server_name  _;
        # 靜態(tài)資源緩存
        location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
            expires 1y;
            add_header Cache-Control "public, immutable";
        }
        # 反向代理到 Java 后端
        location / {
            proxy_pass http://192.168.56.20:8080;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            # 超時設(shè)置（防止長連接阻塞）
            proxy_connect_timeout 5;
            proxy_send_timeout 30;
            proxy_read_timeout 30;
            # 傳遞真實客戶端 IP（配合 real_ip 模塊）
            set_real_ip_from 192.168.56.0/24;
            real_ip_header X-Forwarded-For;
        }
    }
}

# 創(chuàng)建 nginx 用戶（若不存在）
sudo useradd -r -s /sbin/nologin nginx

# 創(chuàng)建日志目錄
sudo mkdir -p /usr/local/nginx/logs

# 啟動 Nginx
sudo /usr/local/nginx/sbin/nginx

# 驗證配置語法 & 端口監(jiān)聽
sudo /usr/local/nginx/sbin/nginx -t
sudo ss -tlnp | grep ':80\|:8081'

# 測試健康接口
curl http://127.0.0.1:8081/healthz    # 應返回 OK
curl http://127.0.0.1:8081/backend-health  # 應返回 {"status":"UP"}

! Configuration File for keepalived
global_defs {
    # 路由器標識（每臺機器唯一，用于日志區(qū)分）
    router_id NGINX_MASTER_01
    # 通知郵箱（可選，生產(chǎn)環(huán)境建議對接企業(yè)微信/釘釘）
    # notification_email {
    #    admin@example.com
    # }
    # smtp_server 127.0.0.1
    # smtp_connect_timeout 30
}
# 自定義健康檢查腳本（關(guān)鍵！）
vrrp_script chk_nginx {
    script "/etc/keepalived/check_nginx.sh"
    interval 2                    # 每2秒執(zhí)行一次
    weight 2                      # 成功時權(quán)重+2，失敗時-2
    fall 2                        # 連續(xù)2次失敗才判定為 down
    rise 2                        # 連續(xù)2次成功才判定為 up
}
# VRRP 實例定義
vrrp_instance VI_1 {
    state MASTER                    # 當前節(jié)點角色：MASTER
    interface eth0                  # VIP 綁定的業(yè)務網(wǎng)卡（非心跳網(wǎng)卡！）
    virtual_router_id 51            # VRID，主備必須一致（1-255）
    priority 100                    # 優(yōu)先級，越高越可能成為 Master（Backup 設(shè)為 90）
    advert_int 1                    # VRRP 通告間隔（秒）
    authentication {
        auth_type PASS
        auth_pass 1111              # 認證密碼（主備必須一致）
    }
    # 虛擬 IP（VIP）配置
    virtual_ipaddress {
        192.168.56.100/24 dev eth0 label eth0:1  # VIP + 子網(wǎng)掩碼 + 綁定網(wǎng)卡別名
    }
    # 跟蹤腳本：當 chk_nginx 失敗時，降低本節(jié)點優(yōu)先級，觸發(fā)切換
    track_script {
        chk_nginx
    }
    # 防腦裂：當檢測到與 Backup 心跳中斷時，執(zhí)行強制降級
    # （需配合獨立心跳網(wǎng)卡 eth1）
    notify_master "/etc/keepalived/notify.sh master"
    notify_backup "/etc/keepalived/notify.sh backup"
    notify_fault "/etc/keepalived/notify.sh fault"
}

! Configuration File for keepalived
global_defs {
    router_id NGINX_BACKUP_01
}
vrrp_script chk_nginx {
    script "/etc/keepalived/check_nginx.sh"
    interval 2
    weight 2
    fall 2
    rise 2
}
vrrp_instance VI_1 {
    state BACKUP                    # 角色為 BACKUP
    interface eth0
    virtual_router_id 51            # 必須與 Master 一致！
    priority 90                       # 低于 Master，確保初始為 Backup
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 1111              # 密碼必須一致！
    }
    virtual_ipaddress {
        192.168.56.100/24 dev eth0 label eth0:1
    }
    track_script {
        chk_nginx
    }
    # 關(guān)鍵：啟用非搶占模式！
    # 一旦 Backup 升為 Master，即使原 Master 恢復也不搶回 VIP
    nopreempt
    notify_master "/etc/keepalived/notify.sh master"
    notify_backup "/etc/keepalived/notify.sh backup"
    notify_fault "/etc/keepalived/notify.sh fault"
}

#!/bin/bash
# /etc/keepalived/check_nginx.sh
# 功能：雙重健康檢查
# 1. 檢查 nginx master 進程是否存在
# 2. 檢查 nginx 能否通過 /backend-health 接口連通 Java 后端

NGINX_PID_FILE="/usr/local/nginx/logs/nginx.pid"
NGINX_HEALTH_URL="http://127.0.0.1:8081/backend-health"
TIMEOUT=3

# 檢查 nginx 進程
if ! kill -0 $(cat $NGINX_PID_FILE 2>/dev/null) 2>/dev/null; then
    echo "[ERROR] nginx process not running"
    exit 1
fi

# 檢查 nginx 健康接口（端到端）
if ! curl -s --max-time $TIMEOUT -f $NGINX_HEALTH_URL >/dev/null 2>&1; then
    echo "[ERROR] nginx /backend-health check failed"
    exit 1
fi

# 檢查 nginx 自身健康（快速兜底）
if ! curl -s --max-time $TIMEOUT -f http://127.0.0.1:8081/healthz >/dev/null 2>&1; then
    echo "[ERROR] nginx /healthz check failed"
    exit 1
fi

echo "[OK] All health checks passed"
exit 0

sudo chmod +x /etc/keepalived/check_nginx.sh
sudo chown root:root /etc/keepalived/check_nginx.sh

#!/bin/bash
# /etc/keepalived/notify.sh
# 參數(shù)：$1 = master|backup|fault

ROLE=$1
TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')
VIP="192.168.56.100"
NODE_IP=$(hostname -I | awk '{print $1}')

LOG_FILE="/var/log/keepalived-state.log"

echo "[$TIMESTAMP] KEEPALIVED $ROLE on $(hostname) ($NODE_IP). VIP: $VIP" >> $LOG_FILE

case "$ROLE" in
    "master")
        echo "[$TIMESTAMP] $(hostname) is now MASTER. Enabling VIP..." >> $LOG_FILE
        # 可在此處添加：啟動特定服務、更新 DNS、發(fā)送企業(yè)微信消息等
        ;;
    "backup")
        echo "[$TIMESTAMP] $(hostname) is now BACKUP. VIP released." >> $LOG_FILE
        ;;
    "fault")
        echo "[$TIMESTAMP] $(hostname) entered FAULT state! Check network & nginx." >> $LOG_FILE
        ;;
esac

sudo tail -f /var/log/keepalived-state.log

# 編輯 /etc/sysctl.conf
echo "
# Keepalived VIP ARP 優(yōu)化
net.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2
net.ipv4.conf.eth0.arp_ignore = 1
net.ipv4.conf.eth0.arp_announce = 2
" | sudo tee -a /etc/sysctl.conf

# 生效配置
sudo sysctl -p

<dependencies>
    <!-- Web -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <!-- Actuator（健康檢查核心） -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-actuator</artifactId>
    </dependency>
    <!-- 可選：暴露所有端點（生產(chǎn)環(huán)境請按需開放） -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-devtools</artifactId>
        <scope>runtime</scope>
        <optional>true</optional>
    </dependency>
</dependencies>

management:
  endpoints:
    web:
      exposure:
        include: health,info,metrics,prometheus  # 至少暴露 health
  endpoint:
    health:
      show-details: when_authorized  # 生產(chǎn)環(huán)境建議設(shè)為 never 或 when_authorized
      probes:
        enabled: true
  server:
    port: 8081  # Actuator 獨立端口（與業(yè)務端口 8080 分離）
# 業(yè)務服務器配置
server:
  port: 8080
  address: 0.0.0.0
spring:
  application:
    name: demo-java-service

package com.example.demo.health;

import org.springframework.boot.actuate.health.Health;
import org.springframework.boot.actuate.health.HealthIndicator;
import org.springframework.stereotype.Component;

import java.util.concurrent.atomic.AtomicBoolean;

@Component
public class DatabaseHealthIndicator implements HealthIndicator {

    private final AtomicBoolean dbAvailable = new AtomicBoolean(true);

    @Override
    public Health health() {
        if (dbAvailable.get()) {
            return Health.up()
                    .withDetail("database", "connected")
                    .withDetail("version", "PostgreSQL 14.5")
                    .build();
        } else {
            return Health.down()
                    .withDetail("error", "Database connection failed")
                    .build();
        }
    }
}

# 打包并運行（假設(shè) jar 名為 demo.jar）
java -jar demo.jar

# 驗證健康接口（應在 Nginx 的 /backend-health 中被調(diào)用）
curl http://192.168.56.20:8081/actuator/health
# 返回示例：
# {"status":"UP","components":{"diskSpace":{"status":"UP","details":{"total":53660876800,"free":42847272960,"threshold":10485760}},"ping":{"status":"UP"}}}

# 在 Node A（Master）上執(zhí)行
sudo pkill -f "nginx: master"

# 觀察日志
sudo tail -f /var/log/keepalived-state.log
# 應看到：... entered FAULT state! ... 然后 ... is now BACKUP.

# 同時在 Node B（Backup）日志中應看到：
# ... is now MASTER. Enabling VIP...

# 驗證 VIP 是否已漂移到 Node B
ip addr show eth0 | grep 192.168.56.100
# Node B 應輸出：inet 192.168.56.100/24 scope global secondary eth0:1

# 從客戶端（如另一臺機器）curl VIP
curl http://192.168.56.100
# 應正常返回 Java 應用首頁，毫秒級無感切換！ ?

# 在 Java 服務節(jié)點（192.168.56.20）上停止應用
pkill -f "demo.jar"

# 等待 4 秒（2次失敗 × 2秒間隔）
# 此時 Keepalived 會因 /backend-health 失敗而降權(quán)

# 查看 Node A 的優(yōu)先級變化
sudo ipvsadm -Ln | grep "192.168.56.100"
# 或查看 keepalived 進程日志：
sudo journalctl -u keepalived -n 20 --no-pager

# 預期：Node A 優(yōu)先級降至 98（100-2），Node B 仍為 90，但若 Node A 降為 98 < Node B 90？不會切換！
# 因此，我們需讓 Node B 優(yōu)先級更高（如設(shè)為 95），或增加 weight（如設(shè)為 5）

# ? 正確做法：在 chk_nginx.sh 中，失敗時 exit 1，Keepalived 會立即觸發(fā) vrrp_script 失敗邏輯，
# 并結(jié)合 priority + weight 實現(xiàn)平滑降級。

# /etc/rsyslog.d/keepalived.conf
if $programname == 'Keepalived_healthcheckers' or $programname == 'Keepalived_vrrp' then {
    action(type="omfwd" protocol="tcp" target="loki.example.com" port="3100" template="RSYSLOG_SyslogProtocol23Format")
    stop
}

server {
    listen 443 ssl http2;
    server_name example.com;
    ssl_certificate /etc/ssl/certs/fullchain.pem;
    ssl_certificate_key /etc/ssl/private/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    location / {
        proxy_pass http://192.168.56.20:8080;
        # ... 其他 proxy_* 設(shè)置
    }
}

# 使用 nginx-upstream-check-module（需重新編譯）
upstream backend_java {
    server 192.168.56.20:8080 max_fails=3 fail_timeout=30s;
    server 192.168.56.21:8080 max_fails=3 fail_timeout=30s;
    check interval=3 rise=2 fall=5 timeout=10 type=http;
    check_http_send "HEAD /actuator/health HTTP/1.0\r\n\r\n";
    check_http_expect_alive http_2xx http_3xx;
}

# 實時跟蹤 Keepalived 狀態(tài)
sudo journalctl -u keepalived -f

# 查看 VRRP 詳細狀態(tài)
sudo ipvsadm -Ln

# 抓包分析 VRRP 心跳（在 eth1 上）
sudo tcpdump -i eth1 -n vrrp -c 10