高可用性（Keepalived+VRRP）

单点 NGINX 故障会导致整个服务不可用。Keepalived 基于 VRRP 协议实现多台 NGINX 之间的自动故障转移。

VRRP 协议

原理

• VRRP（Virtual Router Redundancy Protocol）提供路由器冗余
• 多台服务器共享一个虚拟 IP（VIP）
• Master 处理流量，Backup 监听 Master 心跳
• Master 故障时 Backup 接管 VIP

Keepalived 安装配置

Master 节点配置

# 安装
apt install keepalived

# 配置

# /etc/keepalived/keepalived.conf
vrrp_script chk_nginx {
    script "/etc/keepalived/check_nginx.sh"
    interval 2
    weight -20
    fall 3
    rise 2
}

vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 51
    priority 100
    advert_int 1
    
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    
    virtual_ipaddress {
        192.168.1.100/24 dev eth0 label eth0:0
    }
    
    track_script {
        chk_nginx
    }
    
    notify_master "/etc/keepalived/notify_master.sh"
    notify_backup "/etc/keepalived/notify_backup.sh"
}

Backup 节点配置

# /etc/keepalived/keepalived.conf
vrrp_instance VI_1 {
    state BACKUP
    interface eth0
    virtual_router_id 51
    priority 90
    advert_int 1
    
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    
    virtual_ipaddress {
        192.168.1.100/24
    }
    
    track_script {
        chk_nginx
    }
}

priority 值高的成为 Master。Master 故障后 priority 最高的 Backup 接管。virtual_router_id 必须相同。

健康检查脚本

检测 NGINX 状态

#!/bin/bash
# /etc/keepalived/check_nginx.sh

if ! pgrep -x nginx > /dev/null; then
    exit 1
fi

# 检查是否能正常响应
curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:80 | grep -q "200\|301\|302"
exit $?

chmod +x /etc/keepalived/check_nginx.sh

通知脚本

状态变更通知

#!/bin/bash
# /etc/keepalived/notify_master.sh
echo "$(date) - This node is now MASTER" >> /var/log/keepalived.log
# 可选：发送邮件告警

#!/bin/bash
# /etc/keepalived/notify_backup.sh
echo "$(date) - This node is now BACKUP" >> /var/log/keepalived.log

脑裂问题

防止脑裂

vrrp_instance VI_1 {
    # 减少 advert 间隔加快切换
    advert_int 1
    
    # 设置抢占延迟
    preempt_delay 300
}

• 确保网络连通性，避免防火墙阻断 VRRP 包
• virtual_router_id 在同一网络唯一
• authentication 防止非法节点加入
• 使用 unicast_src_ip 和 unicast_peer 替代组播

单播配置（推荐）

vrrp_instance VI_1 {
    unicast_src_ip 192.168.1.10
    unicast_peer {
        192.168.1.11
        192.168.1.12
    }
}

单播模式避免组播问题，特别适合云环境和虚拟化网络。

验证配置

# 查看 VIP 绑定
ip addr show eth0

# 查看 Keepalived 状态
systemctl status keepalived

# 查看日志
tail -f /var/log/keepalived.log

# 模拟故障
systemctl stop nginx
# 观察 VIP 是否漂移到 Backup

要点总结

• VRRP 协议实现虚拟 IP 在多台服务器间漂移
• Master 和 Backup 通过 priority 区分，高优先级成为 Master
• 健康检查脚本检测 NGINX 状态，故障时自动降级
• 使用单播模式替代组播更适合现代网络环境
• advert_int 控制心跳间隔，越小切换越快但网络开销越大
• 注意防止脑裂：确保网络通畅、配置一致的 virtual_router_id
• Keepalived 仅提供故障转移，不解决 NGINX 自身性能瓶颈