EC2 Nginx で高可用性+ロードバランス(Floating IP パターン)

[root@ng-lb-1 ~]# mkdir /etc/ssl/nginx/
[root@ng-lb-1 ~]# cp ~/CA.crt /etc/ssl/nginx/
[root@ng-lb-1 ~]# cp ~/nginx-repo.crt /etc/ssl/nginx/
[root@ng-lb-1 ~]# cp ~/nginx-repo.key /etc/ssl/nginx/

[root@ng-lb-1 ~]# yum install -y nginx-plus

[root@ng-lb-1 ~]# cat /etc/nginx/conf.d/default.conf
upstream backend {
    server 172.16.10.21;
    server 172.16.10.22;
}
server {
    listen       80;
    server_name  _;

    access_log  /var/log/nginx/access.log  main;

    location = /favicon.ico {
        log_not_found off;
    }

    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-Server $host;
    proxy_set_header X-Real-IP $remote_addr;

    location / {
        proxy_pass http://backend;
        health_check interval=5 fails=1 passes=1 uri=/;
    }
}

[root@ng-lb-1 ~]# chkconfig nginx on
[root@ng-lb-1 ~]# service nginx start

[root@ng-lb-1 ~]# yum install -y unzip java-1.6.0-openjdk
[root@ng-lb-1 ~]# mkdir -p /opt/aws
[root@ng-lb-1 ~]# curl -LO http://s3.amazonaws.com/ec2-downloads/ec2-api-tools.zip
[root@ng-lb-1 ~]# unzip ec2-api-tools.zip
[root@ng-lb-1 ~]# mv ec2-api-tools-1.7.1.0 /opt/aws

[root@ng-lb-1 ~]# curl -LO http://media.amazonwebservices.com/articles/vip_monitor_files/vip_monitor.sh
[root@ng-lb-1 ~]# chmod a+x vip_monitor.sh

#!/bin/sh
# This script will monitor another HA node and take over a Virtual IP (VIP)
# if communication with the other node fails
export JAVA_HOME=/etc/alternatives/jre
export EC2_HOME=/opt/aws/ec2-api-tools
export AWS_ACCESS_KEY=XXXXXXXXXXXXXXXXXXXX
export AWS_SECRET_KEY=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
export EC2_URL=https://ec2.ap-northeast-1.amazonaws.com
export PATH=$PATH:$JAVA_HOME/bin:$EC2_HOME/bin

# High Availability IP variables
# Other node's IP to ping and VIP to swap if other node goes down
HA_Node_IP=172.16.10.12
VIP=172.16.10.10

# Specify the EC2 region that this will be running in
REGION=ap-northeast-1

# Run aws-apitools-common.sh to set up default environment variables and to
# leverage AWS security credentials provided by EC2 roles
#. /etc/profile.d/aws-apitools-common.sh

# Determine the instance and ENI IDs so we can reassign the VIP to the
# correct ENI.  Requires EC2 describe-instances and assign-private-ip-address
# permissions.  The following example EC2 Roles policy will authorize these
# commands:
# {
#  "Statement": [
#    {
#      "Action": [
#        "ec2:AssignPrivateIpAddresses",
#        "ec2:DescribeInstances"
#      ],
#      "Effect": "Allow",
#      "Resource": "*"
#    }
#  ]
# }

Instance_ID=`/usr/bin/curl --silent http://169.254.169.254/latest/meta-data/instance-id`
ENI_ID=`/opt/aws/ec2-api-tools/bin/ec2-describe-instances $Instance_ID --region $REGION | grep eni -m 1 | awk '{print $2;}'`

echo `date` "-- Starting HA monitor"
while [ . ]; do
  pingresult=`ping -c 3 -W 1 $HA_Node_IP | grep time= | wc -l`
  if [ "$pingresult" == "0" ]; then
    echo `date` "-- HA heartbeat failed, taking over VIP"
    /opt/aws/ec2-api-tools/bin/ec2-assign-private-ip-addresses -n $ENI_ID --secondary-private-ip-address $VIP --allow-reassignment --region $REGION
    /sbin/ifconfig eth0:1 $VIP netmask 255.255.255.0
    pingresult=`ping -c 1 -W 1 $VIP | grep time= | wc -l`
    if [ "$pingresult" == "0" ]; then
      echo `date` "-- Restarting network"
      /sbin/service network restart > /dev/null 2>&1
    fi
    sleep 60
  fi
  sleep 2
done

[root@ng-lb-1 ~]# echo '@reboot /root/vip_monitor.sh >> /var/log/vip_monitor.log' | crontab
[root@ng-lb-1 ~]# /root/vip_monitor.sh >> /var/log/vip_monitor.log &

[root@ng-lb-1 ~]# ifconfig eth0:1 172.16.10.10 netmask 255.255.255.0

[root@ng-lb-1 ~]# tailf /var/log/vip_monitor.log

[root@ng-lb-2 ~]# tailf /var/log/vip_monitor.log

Sun Aug 10 02:09:53 JST 2014 -- HA heartbeat failed, taking over VIP
RETURN  true