Geekly Articles each Day
📜 ⬆️ ⬇️

"Perfect" cluster. Part 2.2: Highly available and scalable web server, the best technologies to guard your business



In continuation of the series of articles on the “Ideal” cluster, I want to share recipes for creating reliable, productive and easy-to-manage web-systems.



In order to ensure reliable and fast work of websites and web-systems, our company conducted an examination of the technical means available on the market. We were guided by a simple goal: to achieve scalability and at the same time high performance of our systems.
')
The cluster, in fact, was built from scratch. There was a frontend-backend architecture. The databases went to MariaDB Galera, all sites moved to unified web nodes.

In the course of long work, disputes and discussions, ready-made solutions were born, which Acronis is happy to share with you. We exist to help.



My other publications on the “Ideal” cluster


Now we will talk about several important aspects:




You may ask, how is this article different from hundreds of others?




Concept:



On all servers except app01.local, all unsolicited services, including ssh, have been removed, the interaction between them takes place through a gray private network. Only those ports that are necessary for the operation of our sites are open to the public network (80, 443, etc.)

Proxmox Known issues



Do not forget to include autoloading containers created



When you create a network for the bridge vmbr1 , Proxmox assigns it a virtual name eth0 , so you have to delete the created network and redo everything correctly



In order to enter the container, it is necessary to start it and in the terminal enter the vzctl enter command number_container

In the article about Proxmox (link to it at the very beginning), we said that we use a file where the firewall rules of our official public network are written, which ideally nobody should know about except us.

nano /etc/iptables.up.rules 


 *nat :PREROUTING ACCEPT [2164:136969] :POSTROUTING ACCEPT [58:3659] :OUTPUT ACCEPT [0:0] # Nat -A POSTROUTING -o vmbr0 -j MASQUERADE # ISPConfig Web Panel -A PREROUTING -d *.*.*182/32 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.8.3:8080 -A PREROUTING -d *.*.*.182/32 -p tcp -m tcp --dport 8081 -j DNAT --to-destination 192.168.8.3:8081 # app01. ssh server -A PREROUTING -d *.*.*.182/32 -p tcp -m tcp --dport 22 -j DNAT --to-destination 192.168.8.4:22 COMMIT


# Change the ssh port of our hypervisor to 2222

 nano /etc/ssh/sshd_config 


 Port 2222


General presets for all our containers



# Be sure to add to the hosts file, on all containers where the ISPConfig agents will be, these lines:

 nano /etc/hosts 


 192.168.8.1 gw.local 192.168.8.2 front01.local 192.168.8.3 isp.local 192.168.8.4 app01.local 192.168.8.5 db01.local


# Change the time zone to your

 ln -sf /usr/share/zoneinfo/Europe/Moscow /etc/localtime 


 yum install wget nano wget ntpdate -y


# These repositories should be, because here we will find a lot of packages that are not in the basic repositories.

 wget http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm wget http://rpms.famillecollet.com/enterprise/remi-release-6.rpm sudo rpm -Uvh remi-release-6*.rpm epel-release-6*.rpm rm *.rpm -f


# This repository is useful to us, but we will turn it off by default.
 rpm --import http://dag.wieers.com/rpm/packages/RPM-GPG-KEY.dag.txt cd /tmp wget http://dag.wieers.com/rpm/packages/rpmforge-release/rpmforge-release-0.3.6-1.el5.rf.x86_64.rpm && rpm -ivh rpmforge-release-0.3.6-1.el5.rf.x86_64.rpm


# Turn off, we will use through --enablerepo = rpmforge

 sed -i 's/enabled = 1/enabled = 0/g' /etc/yum.repos.d/rpmforge.repo


# And this is a gem for web systems and not only, there really is a lot of things that an administrator needs in his work. Musthave

 wget -q -O - http://www.atomicorp.com/installers/atomic | sh


# We put useful software

 yum install nano mc screen sudo nscd htop ntp zip unzip pigz iotop sysstat lsof strace atop multitail -y yum --enablerepo=rpmforge install htop -y


# Remove unwanted service for this container

 yum remove -y sendmail httpd sshd samba bind openssh -y


# Update the system

 yum update -y


# Remove mysql

 yum remove mysql* mysql-*


# Install mariadb for service purposes ISPConfig

 yum install mariadb-server mariadb-devel mariadb-client -y


# Install cron

 yum install -y cronie cronie-anacron crontabs sysstat -y


# Add cron to autoload and run

  /etc/init.d/crond start && chkconfig crond on


# Customize mariadb

 nano /etc/my.cnf 


 [mysqld] skip-name-resolve default_storage_engine=InnoDB innodb_file_per_table = 1 # network connect_timeout = 60 wait_timeout = 28800 max_connections = 200 max_allowed_packet = 512M max_connect_errors = 1000 # performance query_cache_size = 32M tmp_table_size = 32M max_heap_table_size = 32M thread_cache_size = 16 table_open_cache = 600 innodb_flush_log_at_trx_commit = 2 innodb_flush_method = O_DIRECT transaction-isolation = READ-COMMITTED log_error = /var/log/mysql/mysql-error.log #slow_query_log_file = /var/log/mysql/mysql-slow.log


# Add mariadb to autoload

 chkconfig --levels 235 mysqld on && /etc/init.d/mysqld start


Setting up the gw.local environment


You need to create an OpenVZ (New CT) container with the CentOS 64 environment. This virtual machine will serve our public and private network.

We will need the vmbr0 network interfaces named eth0 (our public network of the provider) and vmbr1 for the eth1 network (a private network for interacting with other containers).


This virtual machine will require no more than 128 MB of RAM.



We start to configure the network in the container gw.local

Network inside the container:

 vi /etc/sysconfig/network-scripts/ifcfg-eth0 


 DEVICE=eth0 BOOTPROTO=static ONBOOT=yes IPADDR=xxx237 NETMASK=255.255.255.0 GATEWAY=xxx1 


 vi /etc/sysconfig/network-scripts/ifcfg-eth1 


 DEVICE=eth1 BOOTPROTO=static ONBOOT=yes IPADDR=192.168.8.1 NETWORK=192.168.8.0


# Save current iptables rules

  /etc/init.d/iptables save


# Add rules to the * nat section for our external business address

 vi /etc/sysconfig/iptables 


 -A PREROUTING -d *.*.*.237/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.8.2:80 -A PREROUTING -d *.*.*.237/32 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.8.2:443 -A PREROUTING -d *.*.*.237/32 -p tcp -m tcp --dport 25 -j DNAT --to-destination 192.168.8.5:25 -A PREROUTING -d *.*.*.237/32 -p tcp -m tcp --dport 110 -j DNAT --to-destination 192.168.8.5:110 -A PREROUTING -d *.*.*.237/32 -p tcp -m tcp --dport 145 -j DNAT --to-destination 192.168.8.5:145 -A PREROUTING -d *.*.*.237/32 -p tcp -m tcp --dport 995 -j DNAT --to-destination 192.168.8.5:995 -A PREROUTING -d *.*.*.237/32 -p tcp -m tcp --dport 465 -j DNAT --to-destination 192.168.8.5:465 -A PREROUTING -d *.*.*.237/32 -p tcp -m tcp --dport 587 -j DNAT --to-destination 192.168.8.5:587 -A PREROUTING -d *.*.*.237/32 -p tcp -m tcp --dport 143 -j DNAT --to-destination 192.168.8.5:143 -A PREROUTING -d *.*.*.237/32 -p tcp -m tcp --dport 993 -j DNAT --to-destination 192.168.8.5:993 -A POSTROUTING -o eth0 -j MASQUERADE


# We allow traffic forwarding

 echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf sysctl -p


Setting up the front01.local environment



It is necessary to create an OpenVZ (New CT) container with the CentOS 64 environment. This virtual machine will serve ports 80 and 443, thrown from our gw.local. This container has nginx installed, which proxies all requests to our sites on app01.local
The nginx configuration procedure itself is well described in this article “Perfect” www cluster. Part 1. Frontend: NGINX + Keepalived (vrrp) on CentOS

This container will have an address in the private network ( vmbr1 ) 192.168.8.2 , for work, no more than 1024 MB of RAM will be required

This is how the network should look like in the container itself:

 vi /etc/sysconfig/network-scripts/ifcfg-eth1 


 DEVICE=eth1 BOOTPROTO=static ONBOOT=yes IPADDR=192.168.8.2 NETWORK=192.168.8.0 GATEWAY=192.168.8.1


Setting up the isp environment.


You need to create an OpenVZ (New CT) container with the CentOS 64 environment. This virtual machine will serve our ISPConfig control panel. At the beginning of the article we showed that the panel will be served by the service public address and will be available on ports 8080 and 8081.

This container will have an address in a private network ( vmbr1 ) 192.168.8.3 , and will need about 384 MB of RAM.



# Network settings for this container:

 /etc/sysconfig/network-scripts/ifcfg-eth1 


 DEVICE=eth1 BOOTPROTO=static ONBOOT=yes IPADDR=192.168.8.3 NETWORK=192.168.8.0 GATEWAY=192.168.8.100


# Install web server components for ISPConfig panel

 yum install php-mysql php nginx php-fpm postfix patch -y


# Remove configs with standard nginx greeting

 rm -f /etc/nginx/conf.d/default.conf rm -f /etc/nginx/conf.d/virtual.conf rm -f /etc/nginx/conf.d/ssl.conf


# Add nginx and php-fpm to autoload and run

 chkconfig --levels 235 php-fpm on && /etc/init.d/php-fpm start chkconfig --levels 235 nginx on && /etc/init.d/nginx start


# Allow ISPConfig agents to connect to the central isp.local database for their parameters

 mysql 


 CREATE USER 'root'@'192.168.8.%' IDENTIFIED BY 'c2HZqsMmiBKa'; GRANT ALL PRIVILEGES ON * . * TO 'root'@'192.168.8.%' IDENTIFIED BY 'c2HZqsMmiBKa' WITH GRANT OPTION; flush privileges;


# Install phpMyAdmin

 yum install phpmyadmin -y


# Create a phpMyAdmin simlink on phpmyadmin

 ln -s /usr/share/phpMyAdmin/ /usr/share/phpmyadmin 


 nano /etc/phpMyAdmin/config.inc.php 


 $cfg['blowfish_secret'] = '46a30e4ed1cf83.14522379'; /* YOU MUST FILL IN THIS FOR COOKIE AUTH! */ $cfg['Servers'][$i]['host'] = 'db01.local'; // MySQL hostname or IP address $cfg['Servers'][$i]['port'] = '3306'; // MySQL port - leave blank for default port $cfg['Servers'][$i]['auth_type'] = 'cookie'; // Authentication method (config, http or cookie based)?


# Install ISPConfig

 cd /usr/src/ wget http://www.ispconfig.org/downloads/ISPConfig-3-stable.tar.gz tar xfz ISPConfig-3-stable.tar.gz cd ispconfig3_install/install/ php -q install.php


# Answering the questions of the interactive installation wizard
>> Initial configuration

Operating System: Redhat or compatible, unknown version.

If so, be careful.
Default values ​​are in [brackets] and can be accepted with.
Tap in "quit" (without the quotes) to stop the installer.

Select language (en, de) [ en ]:

Installation mode (standard, expert) [standard]: expert

Full qualified hostname (FQDN) of the server, eg server1.domain.tld [ isp.local ]:

MySQL server hostname [ localhost ]:

MySQL root username [ root ]:

MySQL root password []:

MySQL database to create [ dbispconfig ]:

MySQL charset [ utf8 ]:

The next two questions are about the internal ISPConfig database user and password.
It is recommended to accept the defaults which are 'ispconfig' as username and random password.
If you use the password

ISPConfig mysql database username [ ispconfig ]:

ISPConfig mysql database password [ 1850fcffe2fc0b1ca2707c3e27c5eec4 ]:

Shall this server join an existing ISPConfig multiserver setup (y, n) [ n ]:

Apache and nginx detected. Select server to use for ISPConfig: (apache, nginx) [apache]: nginx

Adding ISPConfig server record to database.

Configure Mail (y, n) [y]: n

Configure Jailkit (y, n) [y]: n

Configure FTP Server (y, n) [y]: y

Configuring Pureftpd
Configure DNS Server (y, n) [y]: n

Hint: If this is the ISPConfig interface, select the 'y' in the 'Configure nginx Server' option.

Configure nginx Server (y, n) [y]: y

Configuring nginx
Configuring Apps vhost
Configure Firewall Server (y, n) [y]: y

Configuring Bastille Firewall
Install ISPConfig Web Interface (y, n) [y]: y

Installing ISPConfig
ISPConfig Port [ 8080 ]:

Enable SSL for the ISPConfig web interface (y, n) [y]: y

Generating RSA private key, 4096 bit long modulus
.................................................. .............. ++
.................................................. .................................................. ................... ++
e is 65537 (0x10001)
You are included
into your certificate request.
What is a Distinguished Name or a DN?
You can leave some blank
For some fields there will be a default value,
If you enter '.', The field will be left blank.
- Country Name (2 letter code) [XX]: Ru
State or Province Name (full name) []: Moscow
Locality Name (eg, city) [Default City]: Moscow
Organization Name (eg, company) [Default Company Ltd]: isp.local
Organizational Unit Name (eg, section) []: IT
Common Name (eg, your server or your server’s hostname) []: isp.local
Email Address []:

Please enter the following extra attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
writing RSA key
Configuring DBServer
Installing ISPConfig crontab
no crontab for root
Reloading php-fpm: [OK]
Reloading nginx: [OK]
Installation completed.



# Our ISPConfig panel is forwarded to port 8080 of the service public interface

 https://__ip:8080/




Default login and password: admin

# Check for known problems in the installed version of ISPConfig on this site. If there are patches with updates, apply them.

 cd /usr/local/ispconfig/server/scripts wget http://www.ispconfig.org/downloads/ispconfig_patch chmod 700 ispconfig_patch chown root:root ispconfig_patch ln -s /usr/local/ispconfig/server/scripts/ispconfig_patch /usr/local/bin/ispconfig_patch


# Here is a list of available, at the time of writing, patches
Patches for ISPConfig 3.0.5.3

Patch ID: 3053_langedit
Date: 2013-09-25
Description: This patch solves a UTF-8 encoding issue in the language file editor.

Patch ID: 3053_langimport
Description: This patch adds a language to the language file importer.

Patch ID: 3053_backupdownload
Description: This is a patch backups website.

Patch ID: 3053_apsdelete
Description: deletes APS instances.

Patch ID: 3053_ftpuser
Description: This patch fixes FS # 3089 - FTP User Options - ERROR You have no permission for this domain.

Patch ID: 3053_phpversion
Description for your website. Php select user interface is “default”.

Patch ID: 3053_sysini
Description: This patch fixes FS # 3086 - SQL query warning about sys_ini access in multiserver setups.

Patch ID: 3053_dashboard
Description: This patch fixes on the dashboard.


# Uncomment the section responsible for phpMyAdmin

 nano /etc/nginx/sites-enabled/000-ispconfig.vhost 


 location /phpmyadmin { root /usr/share/; index index.php index.html index.htm; location ~ ^/phpmyadmin/(.+\.php)$ { try_files $uri =404; root /usr/share/; include /etc/nginx/fastcgi_params; fastcgi_pass unix:/var/lib/php5-fpm/ispconfig.sock; fastcgi_param HTTPS on; fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME $request_filename; } location ~* ^/phpmyadmin/(.+\.(jpg|jpeg|gif|css|png|js|ico|html|xml|txt))$ { root /usr/share/; } } location /phpMyAdmin { rewrite ^/* /phpmyadmin last; } 


  /etc/init.d/nginx reload


Setting app01.local environment (apache2 + php-fpm)



You need to create an OpenVZ (New CT) container with the CentOS 64 environment. This virtual machine will serve our sites written in php. In general, apache2 is much slower than nginx gives static files (graphics, scripts, styles, etc.), and in combination with mod_php it also spends a lot of memory on serving incoming requests. This is due to the apache2 architecture itself. If the problem of memory consumption can be defeated using php-fpm, then with the slow static we can only accept and partially compensate for this with the cache on the nginx side in front.local.
It makes sense to use apache2 only when it is necessary to use .htaccess or modules specific only apache2.
For this virtual machine, the ssh port is forwarded from the service public address, port 80 is proxied from our front.local

This container will have an address in a private network ( vmbr1 ) 192.168.8.4 , saving on RAM for this virtual machine is not worth it, in general, I put from 4 to 20 GB.

# Network settings for this container:

 vi /etc/sysconfig/network-scripts/ifcfg-eth1 


 DEVICE=eth1 BOOTPROTO=static ONBOOT=yes IPADDR=192.168.8.4 NETWORK=192.168.8.0 GATEWAY=192.168.8.100


# Install the web server components

 yum install mod_rpaf memcached ntp httpd php php-mysql php-mbstring php-mcrypt rpm-build openssl-devel cyrus-sasl-devel pkgconfig zlib-devel pcre-devel openldap-devel postgresql-devel expect libtool-ltdl-devel openldap-servers libtool gdbm-devel pam-devel gamin-devel mod_ssl php-fpm php-cli php-gd php-imap php-ldap php-odbc php-pear php-xml php-xmlrpc php-pecl-apc php-magpierss php-snmp php-tidy spawn-fcgi openssl perl-TimeDate httpd-devel ruby ruby-devel webalizer perl-DateTime-Format-HTTP perl-DateTime-Format-Builder perl-TimeDate libevent-devel php-pecl-memcache mod_fcgid subversion git php-soap -y yum install --enablerepo=rpmforge mod_fastcgi mod_suphp -y


# Add services to autoload and run them

 chkconfig --levels 235 php-fpm on && /etc/init.d/php-fpm start chkconfig --levels 235 httpd on && /etc/init.d/httpd start chkconfig --levels 235 memcached on && /etc/init.d/memcached start


# To manually build php modules, install the developer components

 yum groupinstall 'Development Tools' -y


# Minimal changes in php.ini

 sed -i "s/^error_reporting =.*/error_reporting = E_ALL \& \~E_NOTICE/g" /etc/php.ini sed -i "s/^;cgi.fix_pathinfo =.*/cgi.fix_pathinfo = 1/g" /etc/php.ini sed -i "s/^;date.timezone =.*/date.timezone = Europe\/Moscow/g" /etc/php.ini sed -i "s/^max_execution_time =.*/max_execution_time = 600/g" /etc/php.ini sed -i "s/^max_input_time =.*/max_input_time = 600/g" /etc/php.ini sed -i "s/^memory_limit =.*/memory_limit = 512M/g" /etc/php.ini sed -i "s/^post_max_size =.*/post_max_size = 500M/g" /etc/php.ini sed -i "s/^upload_max_filesize =.*/upload_max_filesize = 2000M/g" /etc/php.ini sed -i "s/^max_file_uploads =.*/max_file_uploads = 200/g" /etc/php.ini sed -i "s/^short_open_tag =.*/short_open_tag = On/g" /etc/php.ini sed -i "s/^upload_max_filesize =.*/upload_max_filesize = 500M/g" /etc/php.ini sed -i "s/;realpath_cache_size =.*/realpath_cache_size = 4096k/g" /etc/php.ini


# Building the xdebug module (useful for debugging code and identifying problems)

 yum install php-devel php-pear pecl install Xdebug 


 nano /etc/php.d/xdebug.ini 


 [xdebug] zend_extension="/usr/lib64/php/modules/xdebug.so" xdebug.remote_enable = 1 


 php -v 


 No log handling enabled - turning on stderr logging Created directory: /var/lib/net-snmp/mib_indexes PHP 5.4.24 (cli) (built: Jan 13 2014 12:36:47) Copyright (c) 1997-2013 The PHP Group Zend Engine v2.4.0, Copyright (c) 1998-2013 Zend Technologies with Xdebug v2.2.3, Copyright (c) 2002-2013, by Derick Retha


# Install the php module - Zend Guard

 cd /usr/src/ && wget wget http://downloads.zend.com/guard/6.0.0/ZendGuardLoader-70429-PHP-5.4-linux-glibc23-x86_64.tar.gz tar xzvf ZendGuardLoader-7* -C /usr/local/ chmod -R 755 /usr/local/ZendGuardLoader-70429-PHP-5.4-linux-glibc23-x86_64/ mv /usr/local/ZendGuardLoader-70429-PHP-5.4-linux-glibc23-x86_64/ /usr/local/Zend 


 nano /etc/php.d/zend.ini 


 zend_extension=/usr/local/Zend/php-5.4.x/ZendGuardLoader.so 


 php -v 


 PHP 5.4.24 (cli) (built: Jan 13 2014 12:36:47) Copyright (c) 1997-2013 The PHP Group Zend Engine v2.4.0, Copyright (c) 1998-2013 Zend Technologies with Xdebug v2.2.3, Copyright (c) 2002-2013, by Derick Rethans with Zend Guard Loader v3.3, Copyright (c) 1998-2013, by Zend Technologies


# Enable the opcode caching module for php - apc

 sed -i "s/^apc.enabled=.*/apc.enabled=1/g" /etc/php.d/apc.ini sed -i "s/^apc.shm_size=.*/apc.shm_size=256M/g" /etc/php.d/apc.ini sed -i "s/;apc.num_files_hint=.*/apc.num_files_hint=20000/g" /etc/php.d/apc.ini sed -i "s/;apc.user_entries_hint=.*/apc.user_entries_hint=20000/g" /etc/php.d/apc.ini sed -i "s/;apc.ttl=.*/apc.ttl=86400/g" /etc/php.d/apc.ini sed -i "s/;apc.user_ttl=.*/apc.user_ttl=7200/g" /etc/php.d/apc.ini sed -i "s/;apc.gc_ttl=.*/apc.gc_ttl=86400/g" /etc/php.d/apc.ini sed -i "s/;apc.cache_by_default=.*/apc.cache_by_default=1/g" /etc/php.d/apc.ini sed -i "s/;apc.max_file_size=.*/apc.max_file_size=10M/g" /etc/php.d/apc.ini


# Configure the suphp module

 mkdir -p /root/backup/etc mv /etc/httpd/conf.d/suphp.conf /root/backup/ && nano /etc/httpd/conf.d/suphp.conf 


 LoadModule suphp_module modules/mod_suphp.so suPHP_Engine on suPHP_ConfigPath /etc/suphp.conf 


 mv /etc/suphp.conf /root/backup/etcsuphp.conf && nano /etc/suphp.conf 


 [global] ;Path to logfile logfile=/var/log/httpd/suphp.log ;Loglevel loglevel=info ;User Apache is running as webserver_user=apache ;Path all scripts have to be in docroot=/ ;Path to chroot() to before executing script ;chroot=/mychroot ; Security options allow_file_group_writeable=true allow_file_others_writeable=false allow_directory_group_writeable=true allow_directory_others_writeable=false ;Check wheter script is within DOCUMENT_ROOT check_vhost_docroot=true ;Send minor error messages to browser errors_to_browser=false ;PATH environment variable env_path=/bin:/usr/bin ;Umask to set, specify in octal notation umask=0077 ; Minimum UID min_uid=100 ; Minimum GID min_gid=100 [handlers] ;Handler for php-scripts x-httpd-suphp="php:/usr/bin/php-cgi" ;Handler for CGI-scripts x-suphp-cgi="execute:!self"


# Configure mod_rpaf, the third address is the public web address of our server

 nano /etc/httpd/conf.d/mod_rpaf.conf 


 <IfModule mod_rpaf.c> RPAF_Enable On RPAF_ProxyIPs 127.0.0.1 192.168.8.2 *.*.*.237 RPAF_Header X-Forwarded-For RPAF_SetHostName On RPAF_SetHTTPS On RPAF_SetPort On </IfModule>


# Turn off FastCgiWrapper

 nano /etc/httpd/conf.d/fastcgi.conf 


 sed -i "s/^FastCgiWrapper .*/FastCgiWrapper Off/g" /etc/httpd/conf.d/fastcgi.conf


# Install ISPConfig

 cd /usr/src/ wget http://www.ispconfig.org/downloads/ISPConfig-3-stable.tar.gz tar xfz ISPConfig-3-stable.tar.gz cd ispconfig3_install/install/ php -q install.php


# Answering the questions of the interactive installation wizard

>> Initial configuration

Operating System: Redhat or compatible, unknown version.

If so, be careful.
Default values ​​are in [brackets] and can be accepted with.
Tap in "quit" (without the quotes) to stop the installer.

Select language (en, de) [ en ]:

Installation mode (standard, expert) [standard]: expert

Full qualified hostname (FQDN) of the server, eg server1.domain.tld [ app01.local ]:

MySQL server hostname [ localhost ]:

MySQL root username [ root ]:

MySQL root password []:

MySQL database to create [ dbispconfig ]:

MySQL charset [ utf8 ]:

The next two questions are about the internal ISPConfig database user and password.
It is recommended to accept the defaults which are 'ispconfig' as username and random password.
If you use the password

ISPConfig mysql database username [ ispconfig ]:

ISPConfig mysql database password [ 8b8295ae2a50a39a1a00da65df0bee72 ]:

Shall this server join an existing ISPConfig multiserver setup (y, n) [n]: y

MySQL master server hostname []: isp.local

MySQL master server root username [ root ]:

MySQL master server root password []: c2HZqsMmiBKa

MySQL master server database name [ dbispconfig ]:

Adding ISPConfig server record to database.

Configure Mail (y, n) [y]: n

Configure Jailkit (y, n) [y]: n

Configure FTP Server (y, n) [y]: y

Configuring Pureftpd
Stopping pure-ftpd: [OK]
Starting pure-ftpd: [OK]
Configure DNS Server (y, n) [y]: n

Hint: If this is the ISPConfig interface, select the 'y' in the 'Configure Apache Server' option.

Configure Apache Server (y, n) [y]: y
Configuring apache
Configuring Vlogger
Configuring Apps vhost
Configure Firewall Server (y, n) [y]: y

Configuring Bastille Firewall
Install ISPConfig Web Interface (y, n) [n]: n

Configuring DBServer
Installing ISPConfig crontab
no crontab for root
Stopping httpd: [OK]
[Thu Jan 23 13:46:44 2014] [warn] NameVirtualHost *: 80 has no VirtualHosts
[Thu Jan 23 13:46:44 2014] [warn] NameVirtualHost *: 443 has no VirtualHosts
[Thu Jan 23 13:46:44 2014] [warn] NameVirtualHost *: 80 has no VirtualHosts
Starting httpd: [OK]
Installation completed.


Setting environment db01.



It is necessary to create an OpenVZ (New CT) container with the CentOS 64 environment. This vitrual machine will have mariadb for our sites.
I will only describe the addition of this node to the ISPConfig cluster. I’ll leave MySQL optimization questions for the following articles.

This container will have an address in a private network ( vmbr1 ) 192.168.8.5 , you should not save on the amount of RAM for the database server, in our case it will be 4 GB of RAM, but 20 GB will not be enough for serious tasks.

This is how the network should look like in the container itself:

 vi /etc/sysconfig/network-scripts/ifcfg-eth1 


 DEVICE=eth1 BOOTPROTO=static ONBOOT=yes IPADDR=192.168.8.5 NETWORK=192.168.8.0 GATEWAY=192.168.8.100


# Install php components for ISPConfig panel

 yum install php-mysql php -y


# Remove from startup and turn off apache2

 chkconfig httpd off && /etc/init.d/httpd stop


# Install ISPConfig

 cd /usr/src/ wget http://www.ispconfig.org/downloads/ISPConfig-3-stable.tar.gz tar xfz ISPConfig-3-stable.tar.gz cd ispconfig3_install/install/ php -q install.php


# Answering the questions of the interactive installation wizard

>> Initial configuration

Operating System: Redhat or compatible, unknown version.

If so, be careful.
Default values ​​are in [brackets] and can be accepted with.
Tap in "quit" (without the quotes) to stop the installer.

Select language (en, de) [en]: en

Installation mode (standard, expert) [standard]: expert

Full qualified hostname (FQDN) of the server, eg server1.domain.tld [ db01.local ]:

MySQL server hostname [ localhost ]:

MySQL root username [ root ]:

MySQL root password []:

MySQL database to create [ dbispconfig ]:

MySQL charset [ utf8 ]:

The next two questions are about the internal ISPConfig database user and password.
It is recommended to accept the defaults which are 'ispconfig' as username and random password.
If you use the password

ISPConfig mysql database username [ ispconfig ]:

ISPConfig mysql database password [ 06cd6c11370b50a83eb0a3d3907a3581 ]:

Shall this server join an existing ISPConfig multiserver setup (y, n) [n]: y

MySQL master server hostname []: isp.local

MySQL master server root username [ root ]:

MySQL master server root password []: c2HZqsMmiBKa

MySQL master server database name [ dbispconfig ]:

Adding ISPConfig server record to database.

Configure Mail (y, n) [y]: n

Configure Jailkit (y, n) [y]: n

Configure FTP Server (y, n) [y]: n

Configure DNS Server (y, n) [y]: n

Hint: If this is the ISPConfig interface, select the 'y' in the 'Configure Apache Server' option.

Configure Apache Server (y, n) [y]: n

Configure Firewall Server (y, n) [y]: y

Configuring Bastille Firewall
Install ISPConfig Web Interface (y, n) [n]: n

Configuring DBServer
Installing ISPConfig crontab
no crontab for root
Stopping httpd: [FAILED]
Starting httpd: [OK]
Installation completed.


Introduction to ISPConfig:


After logging in to the ISPConfig web panel, you are taken to the start page:



Tools - Password and Language , change the language and create a strong password to access the control panel.

System - Server services , remove extra roles for servers.
I want to draw your attention to the fact that ISPConfig can make a separate node a mirror of another. Those. You will have the same configuration of services and users on multiple servers simultaneously. You need to choose which of the nodes is a mirror in the Server Mirror

Server configuration - in each server in the server section we set Loglevel to Debug. Now we can view all the actions that ISPConfig performs on the nodes of our cluster

 tail -f -n 1000 /var/log/ispconfig/ispconfig.log

There is also a Web section in the Server Configuration, there are Permissions in it, if you have several web server mirrors on the same file storage (ceph, ocfs2, etc.), you need to check the Set folder permissions on update checkbox and Connect Linux userid to webid . This will avoid problems with the distinction of guid / uid and users and groups and their names / groups on different mirrors. If you want to change the folder structure of your users, then uncheck the Make web folders immutable (extended attributes) box. If you forget to do this, the chattr -i command will come to your rescue. The next important section: Rescue , enable the automatic launch of important services if they fail, but do not forget to disable the restart of those services that should not be restarted.

Let's create a test user: Client - Add Client , Address , Be sure to fill in the Contact Person , Login and Password (there is a convenient password generator right there). Next in Limits : select the default Web-server and allowed modes of the web-server:


We configured app01.local to support php-fpm and mod_php at the same time. We return to the list of clients and enter the newly created:


Sites - Add a new website


Specify the site name and the required php backend.

Note that ISPConfig in a cluster configuration takes time to propagate all changes.



As a means of accessing the files of our sites, we will use ssh , under windows it is convenient to use WinSCP . This method is much safer than traditional FTP.
To access, we need to create an SSH user, in the User Shell section.
You need to specify a username, password and, if necessary, a key. Please note that your account is prefixed with your account in your personal account of ISPConfig.

To work with MySQL, you need to create its user in the Database users section, your ID is added to the login in the ISPConfig system.



Create a database for one of our sites in the Database section, you must specify the name of the new database, do not forget to specify the site to which this database belongs, select the newly created user and put a tick Remote access (our database server is a remote server in relation to the application server). Do not forget that the prefix is ​​added to the name.



To access phpMyAdmin, you can click on the corresponding icon next to any database in the Database section .



and find ourselves in phpMyAdmin



The final


app01.local where our sites live are available in the public service network on port 22 . WinSCP , :



, web



index.html index.php

 <?php //   ,   INFO_ALL phpinfo(); //      . // phpinfo(8)    . phpinfo(INFO_MODULES); ?>


, php-fpm/mod_php





, :

Source: https://habr.com/ru/post/209934/

More articles:


All Articles