1. 为什么需要Nginx高可用集群现代Web服务对可用性的要求已经达到99.99%甚至更高。单节点Nginx服务存在单点故障风险一旦服务器宕机或网络中断整个服务就会不可用。去年某电商平台因负载均衡器故障导致2小时服务中断直接损失超过300万元——这就是我们需要构建高可用集群的现实意义。高可用集群通过多节点冗余部署配合健康检查和故障自动转移可以实现服务不间断单个节点故障时自动切换到备用节点负载均衡将流量合理分配到多个服务器平滑升级逐个节点更新不影响整体服务2. 集群架构设计要点2.1 典型双节点主备架构[客户端] | [VIP: 192.168.1.100] ├── [Nginx主节点: 192.168.1.101] └── [Nginx备节点: 192.168.1.102] | [后端应用服务器集群]关键组件VIP虚拟IP客户端统一访问的入口IPKeepalived实现VIP漂移和健康检查Nginx实际处理请求的负载均衡器2.2 多节点负载均衡架构对于超高流量场景可以采用多活架构[客户端] | [L4负载均衡器] ├── [Nginx节点1] ├── [Nginx节点2] └── [Nginx节点3] | [应用服务器集群]这种架构下每个Nginx节点都是平等的通过DNS轮询或硬件负载均衡器分发流量。3. 详细搭建步骤3.1 基础环境准备在两台服务器上安装Nginx和Keepalived# Ubuntu/Debian sudo apt update sudo apt install -y nginx keepalived # CentOS/RHEL sudo yum install -y epel-release sudo yum install -y nginx keepalived注意确保两台服务器的时间同步使用ntp或chrony时间不同步会导致集群异常。3.2 Keepalived配置主节点配置/etc/keepalived/keepalived.confvrrp_instance VI_1 { state MASTER interface eth0 virtual_router_id 51 priority 100 # 备用节点设为90 advert_int 1 authentication { auth_type PASS auth_pass 1111 } virtual_ipaddress { 192.168.1.100/24 } track_script { chk_nginx } } vrrp_script chk_nginx { script /usr/bin/killall -0 nginx interval 2 weight -20 }备节点配置只需修改state BACKUPpriority 903.3 Nginx负载均衡配置统一的Nginx配置/etc/nginx/nginx.confupstream backend { server 10.0.0.1:8080; server 10.0.0.2:8080; keepalive 32; } server { listen 80; location / { proxy_pass http://backend; proxy_http_version 1.1; proxy_set_header Connection ; } }3.4 启动与验证sudo systemctl enable --now nginx keepalived验证VIP漂移在主节点执行ip a查看VIP绑定停止主节点Nginxsystemctl stop nginx10秒内VIP应自动迁移到备节点4. 高级配置与优化4.1 健康检查增强默认的进程检查不够全面建议使用主动健康检查upstream backend { server 10.0.0.1:8080 max_fails3 fail_timeout30s; server 10.0.0.2:8080 max_fails3 fail_timeout30s; check interval3000 rise2 fall3 timeout1000 typehttp; check_http_send HEAD /health HTTP/1.0\r\n\r\n; check_http_expect_alive http_2xx http_3xx; }需要安装nginx_upstream_check_module模块。4.2 会话保持配置对于需要会话保持的应用upstream backend { ip_hash; server 10.0.0.1:8080; server 10.0.0.2:8080; }或者使用cookieupstream backend { server 10.0.0.1:8080; server 10.0.0.2:8080; sticky cookie srv_id expires1h domain.example.com path/; }5. 常见问题排查5.1 VIP不漂移检查步骤确认keepalived进程运行ps aux | grep keepalived检查日志journalctl -u keepalived -f验证防火墙是否放行VRRP协议IP协议号1125.2 脑裂问题现象两台服务器同时持有VIP 解决方法检查网络连通性确保心跳线正常调整advert_int和priority参数配置多播检测如果网络支持5.3 性能调优关键参数调整worker_processes auto; worker_rlimit_nofile 100000; events { worker_connections 4096; multi_accept on; use epoll; } http { sendfile on; tcp_nopush on; tcp_nodelay on; keepalive_timeout 65; keepalive_requests 10000; }6. 生产环境建议监控指标Nginxactive connections, request rate, upstream响应时间系统CPU、内存、网络带宽KeepalivedVIP状态变化次数安全加固server { listen 80 default_server; return 444; }禁止未绑定域名的访问日志分析log_format main $remote_addr - $remote_user [$time_local] $request $status $body_bytes_sent $http_referer $http_user_agent upstream:$upstream_addr $upstream_response_time;灰度发布方案split_clients ${remote_addr}${http_user_agent} $variant { 50% backend_v1; 50% backend_v2; }在实际运维中我们遇到过VIP漂移延迟的问题最终发现是服务器ARP缓存设置不当导致。解决方法是在keepalived配置中添加vrrp_garp_master_refresh 60 vrrp_garp_master_repeat 2这个配置可以确保VIP切换后立即发送GARP包更新网络设备缓存。