Nginx负载均衡高可用集群搭建配置实战教程

Nginx负载均衡是服务器运维中的核心组件，通过将请求分发到多台后端服务器实现横向扩展。结合Keepalived可实现VIP（虚拟IP）自动漂移，构建高可用集群架构。本文演示在Linux系统管理环境下搭建Nginx + Keepalived双机热备负载均衡集群的完整流程。

Nginx负载均衡架构设计

标准架构由两台Nginx负载均衡器（主/备）和N台后端应用服务器组成。主Nginx持有VIP对外提供服务，Keepalived监控Nginx进程健康状态，主节点故障时VIP自动漂移到备节点，切换时间在1-3秒内。后端服务器可使用轮询、最少连接、IP哈希等策略分配请求。

以4台服务器为例：LB-MASTER(192.168.1.10)、LB-BACKUP(192.168.1.11)、WEB1(192.168.1.20)、WEB2(192.168.1.21)，VIP设为192.168.1.100。所有服务器运行CentOS Stream 9或Ubuntu 22.04。

安装Nginx与Keepalived

在两台负载均衡器上安装Nginx和Keepalived：

# CentOS/RHEL
yum install -y nginx keepalived
systemctl enable nginx keepalived

# Ubuntu/Debian
apt update && apt install -y nginx keepalived
systemctl enable nginx keepalived

安装完成后验证版本：

nginx -v
keepalived -v

Nginx负载均衡配置

编辑主负载均衡器的Nginx配置文件 /etc/nginx/conf.d/load-balancer.conf：

upstream backend_pool {
    # 负载均衡策略：least_conn最少连接 / ip_hash会话保持 / 默认轮询
    least_conn;
    
    server 192.168.1.20:8080 weight=5 max_fails=3 fail_timeout=30s;
    server 192.168.1.21:8080 weight=5 max_fails=3 fail_timeout=30s;
    
    # 备用服务器，所有主服务器不可用时启用
    # server 192.168.1.22:8080 backup;
    
    keepalive 32;
    keepalive_requests 1000;
    keepalive_timeout 60s;
}

server {
    listen 80;
    server_name 192.168.1.100;
    
    # 健康检查端点
    location /nginx-health {
        access_log off;
        return 200 "ok\n";
        add_header Content-Type text/plain;
    }
    
    # 负载均衡代理
    location / {
        proxy_pass http://backend_pool;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # WebSocket支持
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        
        # 超时设置
        proxy_connect_timeout 5s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
    }
    
    # 被动健康检查：后端返回502/503/504时自动剔除
    proxy_next_upstream error timeout http_502 http_503 http_504;
    proxy_next_upstream_tries 3;
    proxy_next_upstream_timeout 10s;
}

max_fails和fail_timeout组成被动健康检查机制：在fail_timeout时间内失败max_fails次，该服务器被标记为不可用并剔除fail_timeout时长。proxy_next_upstream定义触发重试的错误类型，确保单台后端故障不影响用户请求。

Keepalived高可用配置

创建Nginx健康检查脚本 /etc/keepalived/check_nginx.sh：

#!/bin/bash
# 检查Nginx进程是否存在
if ! pidof nginx > /dev/null 2>&1; then
    systemctl start nginx
    sleep 2
    if ! pidof nginx > /dev/null 2>&1; then
        systemctl stop keepalived
        exit 1
    fi
fi
exit 0

chmod +x /etc/keepalived/check_nginx.sh

主负载均衡器（LB-MASTER）的Keepalived配置 /etc/keepalived/keepalived.conf：

global_defs {
    router_id NGINX_LB_MASTER
    enable_script_security
    script_user root
}

vrrp_script check_nginx {
    script "/etc/keepalived/check_nginx.sh"
    interval 2
    weight -20
    fall 2
    rise 1
}

vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 51
    priority 100
    advert_int 1
    
    authentication {
        auth_type PASS
        auth_pass MyStr0ngP@ss
    }
    
    virtual_ipaddress {
        192.168.1.100/24 dev eth0
    }
    
    track_script {
        check_nginx
    }
    
    notify_master "/etc/keepalived/notify.sh master"
    notify_backup "/etc/keepalived/notify.sh backup"
    notify_fault "/etc/keepalived/notify.sh fault"
}

备负载均衡器（LB-BACKUP）的配置与主服务器基本相同，需修改三处参数：

router_id NGINX_LB_BACKUP    # 修改router_id
state BACKUP                  # 状态设为BACKUP
priority 90                   # 优先级低于主服务器

priority值决定VIP归属，主服务器(100)高于备服务器(90)。当主Nginx故障时，check_nginx脚本触发weight -20，priority降至80，低于备服务器的90，VIP自动漂移到备节点。主节点恢复后priority回到100，VIP重新漂回。

故障切换通知脚本

创建 /etc/keepalived/notify.sh 实现切换告警：

#!/bin/bash
STATE=$1
HOSTNAME=$(hostname)
VIP="192.168.1.100"

case "$STATE" in
    master)
        MSG="${HOSTNAME}切换为MASTER状态，已接管VIP ${VIP}"
        ;;
    backup)
        MSG="${HOSTNAME}切换为BACKUP状态，已释放VIP ${VIP}"
        ;;
    fault)
        MSG="${HOSTNAME}进入FAULT状态，Nginx服务异常"
        ;;
esac

# 写入日志
logger -t keepalived "$MSG"

# 发送告警（邮件/Webhook等）
# curl -s -X POST "https://alert.example.com/api/notify" \
#   -d "{\"content\": \"$MSG\"}"

chmod +x /etc/keepalived/notify.sh

启动服务与验证高可用

启动两台负载均衡器的服务：

systemctl start nginx
systemctl start keepalived
systemctl status keepalived

验证VIP绑定状态：

# 在主节点执行
ip addr show eth0 | grep 192.168.1.100
# 应看到VIP绑定在eth0上

# 测试负载均衡
curl -s http://192.168.1.100/nginx-health
# 返回 "ok"

模拟主节点故障测试切换：

# 在主节点停止Nginx
systemctl stop nginx

# 观察VIP漂移（在备节点执行）
ip addr show eth0 | grep 192.168.1.100
# VIP应出现在备节点

# 恢复主节点
systemctl start nginx
# 等待2-4秒后VIP漂回主节点

后端服务器健康检查优化

Nginx开源版默认仅支持被动健康检查。主动健康检查需配合nginx_upstream_check_module模块或使用Nginx Plus。安装第三方模块后的配置：

upstream backend_pool {
    server 192.168.1.20:8080;
    server 192.168.1.21:8080;
    
    check interval=3000 rise=2 fall=3 timeout=2000 type=http;
    check_http_send "GET /health HTTP/1.0\r\n\r\n";
    check_http_expect_alive http_2xx http_3xx;
}

interval=3000表示每3秒检查一次，连续2次成功标记为可用，连续3次失败标记为不可用。主动检查能在用户请求到达前发现故障节点，相比被动检查减少错误响应。

生产环境安全加固建议

防火墙层面限制VRRP协议仅允许负载均衡器之间通信：

# iptables规则
iptables -A INPUT -p vrrp -s 192.168.1.11 -j ACCEPT
iptables -A INPUT -p vrrp -j DROP

# firewalld规则
firewall-cmd --add-rich-rule='rule protocol value="vrrp" accept' --permanent
firewall-cmd --reload

SSL/TLS终止配置，在Nginx层处理HTTPS加密，后端使用HTTP明文通信减少性能开销：

server {
    listen 443 ssl http2;
    server_name lb.example.com;
    
    ssl_certificate /etc/nginx/ssl/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    
    location / {
        proxy_pass http://backend_pool;
        proxy_set_header X-Forwarded-Proto https;
    }
}

Nginx负载均衡配合Keepalived构建的高可用集群，通过VIP自动漂移实现秒级故障切换，结合被动与主动健康检查机制保障后端服务可用性。该架构在IDC数据中心环境中广泛验证，适用于中小规模Web应用的流量分发场景。