mirror of
https://github.com/YunoHost/yunohost_demo.git
synced 2024-09-03 19:56:44 +02:00
Corrections switch et upgrade
This commit is contained in:
Maniack Crudelis
parent
6df2e24cfb
commit
e30a575227
7 changed files with 170 additions and 91 deletions
73
Config HAProxy actuelle
Normal file
73
Config HAProxy actuelle
Normal file
|
|
@ -0,0 +1,73 @@
|
|||
# this config needs haproxy-1.1.28 or haproxy-1.2.1
|
||||
|
||||
global
|
||||
log 127.0.0.1 local0 info
|
||||
maxconn 4096
|
||||
user haproxy
|
||||
group haproxy
|
||||
daemon
|
||||
|
||||
defaults
|
||||
log global
|
||||
mode http
|
||||
option dontlognull
|
||||
retries 3
|
||||
option redispatch
|
||||
maxconn 2000
|
||||
contimeout 5000
|
||||
clitimeout 50000
|
||||
srvtimeout 50000
|
||||
|
||||
# --- Frontends ---
|
||||
|
||||
frontend http_frontend
|
||||
bind *:80
|
||||
mode http
|
||||
|
||||
option httplog
|
||||
option httpclose
|
||||
option forwardfor
|
||||
#option httpchk GET /status
|
||||
|
||||
default_backend http_server
|
||||
|
||||
# Let's Encrypt
|
||||
acl letsencrypt-request path_beg -i /.well-known/acme-challenge/
|
||||
use_backend letsencrypt if letsencrypt-request
|
||||
|
||||
frontend https_frontend
|
||||
bind *:443
|
||||
mode tcp
|
||||
|
||||
default_backend https_server
|
||||
|
||||
# --- Backends ---
|
||||
|
||||
# Local backend for Let's Encrypt
|
||||
backend letsencrypt
|
||||
mode http
|
||||
server letsencrypt 127.0.0.1:8010
|
||||
|
||||
# YunoHost HTTP backend
|
||||
backend http_server
|
||||
mode http
|
||||
|
||||
balance roundrobin
|
||||
|
||||
server yunohost_demo1 10.1.5.3:80 check
|
||||
server yunohost_demo2 10.1.5.4:80 check
|
||||
|
||||
# YunoHost HTTPS backend
|
||||
backend https_server
|
||||
mode tcp
|
||||
|
||||
balance source
|
||||
#balance roundrobin
|
||||
#stick-table type ip size 200k expire 30m
|
||||
#stick on src
|
||||
|
||||
option ssl-hello-chk
|
||||
option httpchk GET /status
|
||||
|
||||
server yunohost_demo1 10.1.5.3:443 check
|
||||
server yunohost_demo2 10.1.5.4:443 check
|
||||
|
|
@ -16,7 +16,8 @@ DOMAIN=demotest1.tld
|
|||
YUNO_PWD=admin
|
||||
LXC_NAME1=yunohost_demo1
|
||||
LXC_NAME2=yunohost_demo2
|
||||
TIME_TO_SWITCH=30 # En minutes
|
||||
TIME_TO_SWITCH=30
|
||||
# En minutes
|
||||
|
||||
USER_DEMO=demo
|
||||
PASSWORD_DEMO=demo
|
||||
|
|
@ -105,7 +106,7 @@ sudo sudo lxc-clone -o $LXC_NAME1 -n $LXC_NAME2 >> "$LOG_BUILD_LXC" 2>&1
|
|||
echo "> Modification de l'ip du clone" | tee -a "$LOG_BUILD_LXC"
|
||||
sudo sed -i "s@address $IP_LXC1@address $IP_LXC2@" /var/lib/lxc/$LXC_NAME2/rootfs/etc/network/interfaces >> "$LOG_BUILD_LXC" 2>&1
|
||||
echo "> Et le nom du veth" | tee -a "$LOG_BUILD_LXC"
|
||||
sudo sed -i "s@^lxc.network.veth.pair = $LXC_NAME1$@lxc.network.veth.pair = $LXC_NAME2@" /var/lib/lxc/$LXC_NAME2/config >> "$LOG_BUILD_LXC" 2>&1
|
||||
sudo sed -i "s@^lxc.network.veth.pair = $LXC_NAME1@lxc.network.veth.pair = $LXC_NAME2@" /var/lib/lxc/$LXC_NAME2/config >> "$LOG_BUILD_LXC" 2>&1
|
||||
|
||||
# Mise en place du cron de switch
|
||||
echo | sudo tee /etc/cron.d/demo_switch <<EOF
|
||||
|
|
@ -114,15 +115,14 @@ echo | sudo tee /etc/cron.d/demo_switch <<EOF
|
|||
EOF
|
||||
# Et du cron d'upgrade
|
||||
echo | sudo tee /etc/cron.d/demo_upgrade <<EOF
|
||||
# Vérifie les mises à jour des conteneurs de demo, lorsqu'ils ne sont pas utilisés, à partir de 3h chaque nuit.
|
||||
0 3 * * * root $script_dir/demo_switch.sh >> "$script_dir/demo_upgrade.log" 2>&1
|
||||
# Vérifie les mises à jour des conteneurs de demo, lorsqu'ils ne sont pas utilisés, à partir de 3h2minutes chaque nuit. Attention à rester sur un multiple du temps de switch.
|
||||
2 3 * * * root $script_dir/demo_switch.sh >> "$script_dir/demo_upgrade.log" 2>&1
|
||||
EOF
|
||||
|
||||
# Démarrage de la démo
|
||||
"$script_dir/demo_start.sh"
|
||||
|
||||
# Après le démarrage du premier conteneur, fait un snapshot du deuxième.
|
||||
|
||||
echo "> Création d'un snapshot pour le 2e conteneur" | tee -a "$LOG_BUILD_LXC"
|
||||
sudo lxc-snapshot -n $LXC_NAME2 >> "$LOG_BUILD_LXC" 2>&1
|
||||
# Il sera nommé snap0 et stocké dans /var/lib/lxcsnaps/$LXC_NAME2/snap0/
|
||||
|
|
|
|||
|
|
@ -60,53 +60,53 @@ IdentityFile $HOME/.ssh/$LXC_NAME1
|
|||
# End ssh $LXC_NAME1
|
||||
EOF
|
||||
|
||||
echo "> Mise en place du reverse proxy" | tee -a "$LOG_BUILD_LXC"
|
||||
echo | sudo tee /etc/nginx/conf.d/$DOMAIN.conf <<EOF
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name $DOMAIN;
|
||||
|
||||
if (\$scheme = http) {
|
||||
rewrite ^ https://\$server_name\$request_uri? permanent;
|
||||
}
|
||||
|
||||
access_log /var/log/nginx/$DOMAIN-access.log;
|
||||
error_log /var/log/nginx/$DOMAIN-error.log;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
listen [::]:443 ssl;
|
||||
server_name $DOMAIN;
|
||||
|
||||
location / {
|
||||
proxy_pass https://$IP_LXC1;
|
||||
proxy_redirect off;
|
||||
proxy_set_header Host \$host;
|
||||
proxy_set_header X-Real-IP \$remote_addr;
|
||||
proxy_set_header X-Forwarded-Proto \$scheme;
|
||||
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Host \$server_name;
|
||||
}
|
||||
|
||||
access_log /var/log/nginx/$DOMAIN-access.log;
|
||||
error_log /var/log/nginx/$DOMAIN-error.log;
|
||||
}
|
||||
EOF
|
||||
|
||||
sudo service nginx reload
|
||||
## Pas de reverse proxy nécessaire sur le serveur de démo actuel.
|
||||
# echo "> Mise en place du reverse proxy" | tee -a "$LOG_BUILD_LXC"
|
||||
# echo | sudo tee /etc/nginx/conf.d/$DOMAIN.conf <<EOF
|
||||
# server {
|
||||
# listen 80;
|
||||
# listen [::]:80;
|
||||
# server_name $DOMAIN;
|
||||
#
|
||||
# if (\$scheme = http) {
|
||||
# rewrite ^ https://\$server_name\$request_uri? permanent;
|
||||
# }
|
||||
#
|
||||
# access_log /var/log/nginx/$DOMAIN-access.log;
|
||||
# error_log /var/log/nginx/$DOMAIN-error.log;
|
||||
# }
|
||||
#
|
||||
# server {
|
||||
# listen 443 ssl;
|
||||
# listen [::]:443 ssl;
|
||||
# server_name $DOMAIN;
|
||||
#
|
||||
# location / {
|
||||
# proxy_pass https://$IP_LXC1;
|
||||
# proxy_redirect off;
|
||||
# proxy_set_header Host \$host;
|
||||
# proxy_set_header X-Real-IP \$remote_addr;
|
||||
# proxy_set_header X-Forwarded-Proto \$scheme;
|
||||
# proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||||
# proxy_set_header X-Forwarded-Host \$server_name;
|
||||
# }
|
||||
#
|
||||
# access_log /var/log/nginx/$DOMAIN-access.log;
|
||||
# error_log /var/log/nginx/$DOMAIN-error.log;
|
||||
# }
|
||||
# EOF
|
||||
#
|
||||
# sudo service nginx reload
|
||||
|
||||
# Mise en place de HAProxy
|
||||
# [...]
|
||||
# La config de base est à pleurer... Elle est quasi vide...
|
||||
# Et la doc du site officiel est une encyclopédie en 500 tomes...
|
||||
# Modify
|
||||
# timeout connect 5s
|
||||
# timeout client 30s
|
||||
# timeout server 10s
|
||||
# Add
|
||||
# maxconn 500
|
||||
# server yunohost_demo1 10.1.5.3:80 check
|
||||
# server yunohost_demo2 10.1.5.4:80 check
|
||||
#
|
||||
# server yunohost_demo1 10.1.5.3:443 check
|
||||
# server yunohost_demo2 10.1.5.4:443 check
|
||||
# On garde la config actuelle
|
||||
# Et manuellement, on commente les lignes des conteneurs dockers et on ajoutes les lignes des ip ci-dessus pour mettre à la place les conteneurs LXC.
|
||||
|
||||
echo "\nLe serveur est prêt à déployer les conteneurs de demo."
|
||||
echo "Exécutez le script demo_lxc_build.sh pour créer les conteneurs et mettre en place la demo."
|
||||
|
|
|
|||
|
|
@ -8,6 +8,7 @@
|
|||
if [ "${0:0:1}" == "/" ]; then script_dir="$(dirname "$0")"; else script_dir="$PWD/$(dirname "$0" | cut -d '.' -f2)"; fi
|
||||
|
||||
LXC_NAME1=$(cat "$script_dir/demo_lxc_build.sh" | grep LXC_NAME1= | cut -d '=' -f2)
|
||||
DOMAIN=$(cat "$script_dir/demo_lxc_build.sh" | grep DOMAIN= | cut -d '=' -f2)
|
||||
|
||||
"$script_dir/demo_lxc_destroy.sh"
|
||||
|
||||
|
|
@ -18,13 +19,21 @@ sudo sysctl -p
|
|||
echo "> Supprime le brige réseau"
|
||||
sudo rm /etc/network/interfaces.d/lxc_demo
|
||||
|
||||
echo "> Remove lxc lxctl"
|
||||
sudo apt-get remove lxc lxctl
|
||||
# LXC était déjà installé sur le serveur de demo actuel. On ne l'enlève pas.
|
||||
# echo "> Remove lxc lxctl"
|
||||
# sudo apt-get remove lxc lxctl
|
||||
|
||||
echo "> Suppression des lignes de pchecker_lxc dans .ssh/config"
|
||||
BEGIN_LINE=$(cat $HOME/.ssh/config | grep -n "^# ssh $LXC_NAME1$" | cut -d':' -f 1)
|
||||
sed -i "$BEGIN_LINE,/^# End ssh $LXC_NAME1$/d" $HOME/.ssh/config
|
||||
echo "> Suppression de la clé SSH"
|
||||
rm -f $HOME/.ssh/$LXC_NAME1 $HOME/.ssh/$LXC_NAME1.pub
|
||||
echo "> Et de sa config spécifique dans $HOME/.ssh/config"
|
||||
BEGIN_LINE=$(cat $HOME/.ssh/config | grep -n "^# ssh $LXC_NAME1" | cut -d':' -f 1)
|
||||
sed -i "$BEGIN_LINE,/^# End ssh $LXC_NAME1/d" $HOME/.ssh/config
|
||||
|
||||
## Pas de reverse proxy nécessaire sur le serveur de démo actuel.
|
||||
# Suppression du reverse proxy
|
||||
# sudo rm /etc/nginx/conf.d/$DOMAIN.conf
|
||||
# sudo service nginx reload
|
||||
|
||||
# Suppression de la clé SSH...
|
||||
# Suppression du reverse proxy ?
|
||||
# Suppression de la config haproxy
|
||||
# La config haproxy est modifiée manuellement.
|
||||
# On peut commenter les lignes des serveurs LXC. Et éventuellement relancer les conteneurs dockers.
|
||||
|
|
|
|||
|
|
@ -21,7 +21,7 @@ if [ $(sudo lxc-info --name $LXC_NAME2 | grep -c "STOPPED") -eq 0 ]; then
|
|||
fi
|
||||
|
||||
echo "> Suppression des règles de parefeu"
|
||||
if sudo iptables -D FORWARD -i lxc_demo -o eth0 -j ACCEPT 2> /dev/null; then
|
||||
if sudo iptables -C FORWARD -i lxc_demo -o eth0 -j ACCEPT 2> /dev/null; then
|
||||
sudo iptables -D FORWARD -i lxc_demo -o eth0 -j ACCEPT
|
||||
fi
|
||||
if sudo iptables -C FORWARD -i eth0 -o lxc_demo -j ACCEPT 2> /dev/null; then
|
||||
|
|
|
|||
|
|
@ -10,11 +10,9 @@ PLAGE_IP=$(cat "$script_dir/demo_lxc_build.sh" | grep PLAGE_IP= | cut -d '=' -f2
|
|||
LXC_NAME1=$(cat "$script_dir/demo_lxc_build.sh" | grep LXC_NAME1= | cut -d '=' -f2)
|
||||
LXC_NAME2=$(cat "$script_dir/demo_lxc_build.sh" | grep LXC_NAME2= | cut -d '=' -f2)
|
||||
|
||||
echo "LXC_NAME1=$LXC_NAME1"
|
||||
echo "LXC_NAME2=$LXC_NAME2"
|
||||
|
||||
# Vérifie l'état des machines.
|
||||
if [ $(sudo lxc-info --name $LXC_NAME1 | grep -c "STOPPED") -eq 0 ]; then # Si la machine 1 est démarrée.
|
||||
if [ "$(sudo lxc-info --name $LXC_NAME1 | grep -c "RUNNING")" -eq "1" ]
|
||||
then # Si la machine 1 est démarrée.
|
||||
LXC_A=$LXC_NAME1
|
||||
LXC_B=$LXC_NAME2
|
||||
else # Sinon, on suppose que c'est la machine 2 qui est en cours.
|
||||
|
|
@ -23,22 +21,21 @@ else # Sinon, on suppose que c'est la machine 2 qui est en cours.
|
|||
# Si aucune machine ne tourne, la première démarrera.
|
||||
fi
|
||||
|
||||
echo "LXC_A=$LXC_A"
|
||||
echo "LXC_B=$LXC_B"
|
||||
|
||||
# Démarre le conteneur B et arrête le conteneur A.
|
||||
sudo lxc-start -n $LXC_B -o "$script_dir/demo_switch.log" -d > /dev/null # Démarre l'autre machine
|
||||
sleep 10 # Attend 10 seconde pour s'assurer du démarrage de la machine.
|
||||
if [ $(sudo lxc-info --name $LXC_B | grep -c "STOPPED") -ne 0 ]; then
|
||||
if [ "$(sudo lxc-info --name $LXC_B | grep -c "STOPPED")" -eq "1" ]
|
||||
then
|
||||
# Le conteneur n'a pas réussi à démarrer. On devrait avertir un responsable par mail...
|
||||
# [...]
|
||||
exit 1
|
||||
else
|
||||
# Bascule sur le conteneur B avec HAProxy...
|
||||
# [...]
|
||||
# Automatique par HAProxy lorsque la machine A sera éteinte.
|
||||
# Arrêt du conteneur A. Il est remplacé par le B
|
||||
sudo touch /var/lib/lxc/$LXC_A/lock_file # Met en place un fichier pour indiquer que la machine n'est pas encore dispo.
|
||||
sudo lxc-stop -n $LXC_A
|
||||
# Restaure le snapshot de la machine A avant sa prochaine exécution
|
||||
# sudo rsync -aEAX --delete -i /var/lib/lxcsnaps/$LXC_A/snap0/rootfs/ /var/lib/lxc/$LXC_A/rootfs/
|
||||
sudo lxc-snapshot -r snap0 $LXC_A
|
||||
sudo lxc-snapshot -r snap0 -n $LXC_A
|
||||
sudo rm /var/lib/lxc/$LXC_A/lock_file # Libère le lock
|
||||
fi
|
||||
|
|
|
|||
|
|
@ -6,28 +6,41 @@
|
|||
# Récupère le dossier du script
|
||||
if [ "${0:0:1}" == "/" ]; then script_dir="$(dirname "$0")"; else script_dir="$PWD/$(dirname "$0" | cut -d '.' -f2)"; fi
|
||||
|
||||
PLAGE_IP=$(cat "$script_dir/demo_lxc_build.sh" | grep PLAGE_IP= | cut -d '=' -f2)
|
||||
LXC_NAME1=$(cat "$script_dir/demo_lxc_build.sh" | grep LXC_NAME1= | cut -d '=' -f2)
|
||||
LXC_NAME2=$(cat "$script_dir/demo_lxc_build.sh" | grep LXC_NAME2= | cut -d '=' -f2)
|
||||
IP_LXC1=$(cat "$script_dir/demo_lxc_build.sh" | grep IP_LXC1= | cut -d '=' -f2)
|
||||
IP_LXC2=$(cat "$script_dir/demo_lxc_build.sh" | grep IP_LXC2= | cut -d '=' -f2)
|
||||
PLAGE_IP=$(cat "$script_dir/demo_lxc_build.sh" | grep PLAGE_IP= | cut -d '=' -f2)
|
||||
TIME_TO_SWITCH=$(cat "$script_dir/demo_lxc_build.sh" | grep TIME_TO_SWITCH= | cut -d '=' -f2)
|
||||
|
||||
IP_UPGRADE=$PLAGE_IP.150
|
||||
|
||||
UPGRADE_DEMO_CONTAINER () { # Démarrage, upgrade et snapshot
|
||||
MACHINE=$1
|
||||
IP_MACHINE=$2
|
||||
# Attend que la machine soit éteinte.
|
||||
TIME_OUT=$(($TIME_TO_SWITCH * 60 + 300)) # Timeout à $TIME_TO_SWITCH +5 minutes, en seconde
|
||||
# Timeout à $TIME_TO_SWITCH +5 minutes, en seconde
|
||||
TIME_OUT=$(($TIME_TO_SWITCH * 60 + 300))
|
||||
sudo lxc-wait -n $MACHINE -s 'STOPPED' -t $TIME_OUT
|
||||
|
||||
while sudo test -e /var/lib/lxc/$MACHINE/lock_file; do
|
||||
sleep 1 # Attend que le conteneur soit libéré par le script switch.
|
||||
done
|
||||
|
||||
# Restaure le snapshot
|
||||
sudo lxc-snapshot -r snap0 $MACHINE
|
||||
sudo lxc-snapshot -r snap0 -n $MACHINE
|
||||
|
||||
# Change l'ip du conteneur le temps de l'upgrade. Pour empêcher HAProxy de basculer sur le conteneur.
|
||||
sudo sed -i "s@address $IP_MACHINE@address $IP_UPGRADE@" /var/lib/lxc/$MACHINE/rootfs/etc/network/interfaces
|
||||
|
||||
# Démarre le conteneur
|
||||
sudo lxc-start -n $MACHINE -d > /dev/null
|
||||
sleep 10
|
||||
|
||||
# Update
|
||||
update_apt=0
|
||||
sudo lxc-attach -n $MACHINE -- apt-get update
|
||||
sudo lxc-attach -n $MACHINE -- apt-get dist-upgrade --dry-run | grep -q "^Inst " # Vérifie si il y aura des mises à jour.
|
||||
update_apt=0
|
||||
if [ "$?" -eq 0 ]; then
|
||||
update_apt=1
|
||||
fi
|
||||
|
|
@ -40,7 +53,10 @@ UPGRADE_DEMO_CONTAINER () { # Démarrage, upgrade et snapshot
|
|||
# Arrêt de la machine virtualisée
|
||||
sudo lxc-stop -n $MACHINE
|
||||
|
||||
if [ "$update_apt" -eq 1 ]
|
||||
# Restaure l'ip d'origine du conteneur.
|
||||
sudo sed -i "s@address $IP_UPGRADE@address $IP_MACHINE@" /var/lib/lxc/$MACHINE/rootfs/etc/network/interfaces
|
||||
|
||||
if [ "$update_apt" -eq "1" ]
|
||||
then
|
||||
# Archivage du snapshot
|
||||
sudo tar -cz --acls --xattrs -f /var/lib/lxcsnaps/$MACHINE/snap0.tar.gz /var/lib/lxcsnaps/$MACHINE/snap0
|
||||
|
|
@ -50,21 +66,5 @@ UPGRADE_DEMO_CONTAINER () { # Démarrage, upgrade et snapshot
|
|||
fi
|
||||
}
|
||||
|
||||
# Initialisation du réseau pour le conteneur.
|
||||
if ! sudo ifquery lxc_demo --state > /dev/null; then
|
||||
sudo ifup lxc_demo --interfaces=/etc/network/interfaces.d/lxc_demo
|
||||
fi
|
||||
|
||||
# Activation des règles iptables
|
||||
if ! sudo iptables -D FORWARD -i lxc_demo -o eth0 -j ACCEPT 2> /dev/null; then
|
||||
sudo iptables -A FORWARD -i lxc_demo -o eth0 -j ACCEPT
|
||||
fi
|
||||
if ! sudo iptables -C FORWARD -i eth0 -o lxc_demo -j ACCEPT 2> /dev/null; then
|
||||
sudo iptables -A FORWARD -i eth0 -o lxc_demo -j ACCEPT
|
||||
fi
|
||||
if ! sudo iptables -t nat -C POSTROUTING -s $PLAGE_IP.0/24 -j MASQUERADE 2> /dev/null; then
|
||||
sudo iptables -t nat -A POSTROUTING -s $PLAGE_IP.0/24 -j MASQUERADE
|
||||
fi
|
||||
|
||||
UPGRADE_DEMO_CONTAINER $LXC_NAME1
|
||||
UPGRADE_DEMO_CONTAINER $LXC_NAME2
|
||||
UPGRADE_DEMO_CONTAINER $LXC_NAME1 $IP_LXC1
|
||||
UPGRADE_DEMO_CONTAINER $LXC_NAME2 $IP_LXC2
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue