Server Cluster (6) Website Load Balancing

This article has been included in the column of this site
Server Cluster Series

1. Implementation principle

Excerpt from: aaPanel Forum
https://www.bt.cn/bbs/thread-58436-1-1.html

The simple principle of load balancing is roughly as follows:

Need to install the professional version of the plug-in: aaPanel Load Balancer,

If there is no genuine authorization, you can refer to the article:

Install aaPanel 7.7.0 Enterprise Edition
https://blog.tsinbei.com/archives/7/

Install aaPanel 7.9.0 Enterprise Edition
https://blog.tsinbei.com/archives/293/

If you have the ability, it is recommended to support the genuine version!

2. Add nodes

Here, three machines are used for load balancing configuration,

The load balancing service is deployed at 192.168.100.3, hereinafter referred to as Master Control.
Backend nodes 192.168.100.1, 192.168.100.2, hereinafter referred to as node.

Since our load balancing is built using Nginx, we must first install Nginx on the master machine, and then install the aaPanel Load Balancing plugin.

After installing the plugin, open the plugin,

Add load:

Parameter Description:

• Domain name: fill in the domain name of the website
• Load name: custom, it is recommended to fill in the domain name of the website, which is easy to distinguish
• Session follow: Generally, you can choose Cookie, if you have special needs, you can choose IP, for static websites, choose Close

Node configuration:

If you follow the tutorials in this series, fill in the IP address with the virtual IP of the previous network. Such as: 192.168.100.1

Networking reference tutorial:

Server cluster (2) WireGuard networking
https://blog.tsinbei.com/archives/621/

If the cloud provider has its own intranet interconnection, fill in the IP of the intranet VPC. Such as: 172.20.0.1

If none of the above, then fill in the public network IP, remember to open the firewall. Such as: 1.1.1.1

If you only need HTTP, use port 80 to add nodes, otherwise use port 443.

Note: If a non-standard port is used, it will be recognized as HTTP by default, causing the addition to fail.

Solution: On the node using non-standard ports, open the website configuration and edit the configuration file:

1
2

listen 8080;
listen 8443 ssl http2;

Turn off Mandatory SSL first, then replace with:

1
2

listen 8080;
listen 8443;

Note: After the main control terminal is added, you need to change it back.

Reason: aaPanel load balancing defaults to protocol follow, even if HTTPS is used to access the master control, the master control also uses HTTPS to return to the source node, so it is equivalent to using HTTPS protocol to access the HTTP site, and an error will naturally be reported.

3, advanced settings

3.1, Cookie settings

After the addition is complete, you can also click Modify to set the configuration again.

If you choose Cookie to follow in front, you will see:

It is recommended to change the cookie logo, only lowercase letters or underscores. Others can be customized.
If you need more security, it is recommended to enable Secure Protection.

3.2, node settings

There are three node types: participating, standby, and decommissioned.

spare:

Suppose I have 2 load balancing masters (M1, M2), 4 load balancing nodes (S1, S2, S3, S4),

Among them, M1, S1, and S2 are in the same area (for example: both are in China), M2, S3, and S4 are in the same area (for example: both are in the United States)

Then you can set it like this:

M1 sets S1, S2 as Participation, S3, S4 as Standby,
M2 sets S1, S2 is backup, S3, S4 is participation,

This not only ensures the speed of returning to the source, but also ensures high availability.

Disable:

If a node is being debugged, it can be temporarily disabled. If the back-to-source error rate is too high for a period of time, you can also disable the troubleshooting.

Other settings are weight and recovery time.

Weights:

The higher the weight, the more frequently the node is visited.

For example, the weight of S1 is 2, and the weight of S2 is 3, so if there are 5000 visits, 2000 times will be allocated to S1, and 3000 times will be allocated to S2.

If the node is local, you can use a non-standard port as described above (it is recommended to deploy in Docker), and set the node IP to 127.0.0.1.

Accessing local resources is naturally faster, so you can set a higher weight, such as 2 or 3.

Note: If a node returns 50x, if certain conditions are met, then before returning to the client, the master will query the next node and discard the content of the node;
If not 50x, the content of the node is returned;
If it is still 50x, then continue to query the next node. If the "participating" node is gone, query the "standby" node. If all queries are completed, use the content returned by the last node.

aaPanel load balancing calls this a "concurrency".

This can prevent a node problem from causing the client access to return 50x, but it will also cause the 50x error page to return slowly during debugging.

Therefore, it is recommended to disable all nodes when debugging, and only enable the fastest one, and then change it back after debugging.

Recovery Time:

After a node returns to 50x, it will be automatically deactivated and reactivated after a period of time. This period of time is called recovery time.

However, recovery is not directly enabled, and requests are sent to normal nodes and recovery nodes at the same time. If the recovery node still returns 50x, then disable the node again.

aaPanel load balancing also calls this a "concurrency".

Note: In the plugin, the concurrency and error numbers seem to be real-time, because sometimes I see 2, and it becomes 0 after a while.
It may also be marked as "read" after clicking on "log", in short, this number will be cleared.

4, usage scenarios

If there is only one master control and one node, it is recommended to use NGINX reverse proxy instead of this plug-in.

However, there may be a DNS problem: the master keeps requesting itself.

Therefore, it is recommended to use it with Dnsmasq or Tencent Cloud PrivateDNS private domain, refer to the article:

Server security (2) internal and external network defense
https://blog.tsinbei.com/archives/140/