Squid - Cluster

1. Description

• Mise en place d'un cluster pour assurer la haute disponibilité

             [Clients]
                |
           Virtual IP (ex: 192.168.38.16)
                |
     ----------------------------
     |                          |
[Squid1] (Master)        [Squid2] (Backup)
     |                          |
        ↘       Internet      ↙

1.1. squid2.home.lab

Caractéristiques
RAM	2 Go
CPU	2 coeurs
Disque	10 Go
IP admin	192.168.38.15	squid2.home.lab
VIP	192.168.38.16	squid.home.lab
Brique	BC3b

2. Installation

2.1. Cloner la VM squid1.home.lab

• Cloner la VM squid1.home.lab
• Configurer la nouvelle adresse IP : 192.168.38.15
• Vérifier le fonctionnement du proxy

3. Haute disponibillité avec Keepalived

3.1. Installer keepalived

$ sudo yum install keepalived

• J'ai eu pas mal de problème pour trouver les bonnes priorités pour le MASTER et le BACKUP afin que la bascule s'effectue correctement entre les 2 noeuds du cluster de haute disponibilité
  • Master squid OK : priority = 100 + 0 = 100
  • Master squid KO : priority = 100 - 20 = 80
  • Backup squid OK : priority = 90 + 0 = 90
  • Backup squid KO : priority = 90 - 20 = 70

3.2. Configurer keepalived sur squid1

• Modifier le fichier /etc/keepalived/keepalived.conf

global_defs {
	router_id SQUID1
	enable_script_security
	script_user squid
}

vrrp_script chk_squid {
    script "/opt/keepalived_check_squid.sh"
    interval 5
    weight -20
    fall 3
    rise 2
}

vrrp_instance VI_SQUID {
    state MASTER
    interface eth0
    virtual_router_id 16
    priority 100
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass secret123
    }
    virtual_ipaddress {
        192.168.38.16/24 dev eth0
    }
    track_script {
        chk_squid
    }
}

3.3. Configurer keepalived sur squid2

global_defs {
	router_id SQUID2
	enable_script_security
	script_user squid
}

vrrp_script chk_squid {
    script "/opt/keepalived_check_squid.sh"
    interval 5
    weight -20
    fall 3
    rise 2
}

vrrp_instance VI_SQUID {
    state BACKUP
    interface eth0
    virtual_router_id 16
    priority 90
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass secret123
    }
    virtual_ipaddress {
        192.168.38.16/24 dev eth0
    }
    track_script {
        chk_squid
    }
}

3.4. Créer le script check_squid.sh

• Sur les deux serveurs, créer le script /opt/keepalived_check_squid.sh

/opt/keepalived_check_squid.sh

#!/bin/bash

# Configuration
SQUID_PORT=3128
TEST_URL="http://www.google.com"
TIMEOUT=5
LOG_FILE="/var/log/squid/keepalived.log"

# Fonction de log
log_message() {
  echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" >> $LOG_FILE
}

# Test 1: Vérifier si le processus Squid est actif
if ! pgrep -x "squid" > /dev/null; then
  log_message "CRITICAL: Processus Squid non trouvé"
  exit 1
fi

# Test 5: Vérifier l'espace disque du cache
CACHE_USAGE=$(df /var/spool/squid | awk 'NR==2 {print $5}' | sed 's/%//')
if [ "$CACHE_USAGE" -gt 90 ]; then
  log_message "WARNING: Espace cache faible: ${CACHE_USAGE}%"
fi

log_message "INFO: Tous les tests passés avec succès"
exit 0

• Changer les permissions du script

$ sudo chmod a+x /opt/keepalived_check_squid.sh
$ sudo chown squid:root /opt/keepalived_check_squid

• Activer keepalived

$ sudo systemctl enable --now keepalived

3.5. Configurer les règles de firewall

$ sudo firewall-cmd --permanent --add-rich-rule='rule protocol value="ah" accept'
$ sudo firewall-cmd --reload

3.6. Configurer la rotation des logs

• Créer le fichier /etc/logrotate.d/keepalived_squid

/var/log/squid/keepalived.log {
    weekly
    missingok
    rotate 4
    copytruncate
    minsize 1M
}

4. Test de l'installation

• Pinguer l'adresse IP virtuelle : 192.168.38.16

$ ping 192.168.38.16

• Stopper squid sur le le serveur squid1

$ sudo systemctl stop squid

• L'adresse IP virtuelle devrait basculer sur le serveur squid2

5. Monitoring avec Prometheus+Grafana

• Créer le script /opt/metrics_keepalived_squid.sh

/opt/metrics_keepalived_squid.sh

#!/bin/bash
OUTFILE="/var/lib/node_exporter/cluster.prom"
mkdir -p "$(dirname "$OUTFILE")"

# Squid
if systemctl is-active --quiet squid; then
  echo 'squid_status 1' > "$OUTFILE"
else
  echo 'squid_status 0' > "$OUTFILE"
fi

# Keepalived
if systemctl is-active --quiet keepalived; then
  echo 'keepalived_status 1' >> "$OUTFILE"
else
  echo 'keepalived_status 0' >> "$OUTFILE"
fi

# VIP presence
if ip addr | grep -q "192.168.1.100"; then
  echo 'vip_present 1' >> "$OUTFILE"
else
  echo 'vip_present 0' >> "$OUTFILE"
fi

• Changer les permissions du script

$ sudo chmod a+x /opt/metrics_keepalived_squid.sh

• Ajouter le script dans la crontab

* * * * * root /opt/metrics_keepalived_squid.sh