From d4ee6684b7d6c8c8e5ff96f6998755c42465ec22 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Sat, 18 May 2024 13:24:42 +0300 Subject: Update content for html --- ...-04-01-KISS-high-availability-with-OpenBSD.html | 200 ++++++++++----------- 1 file changed, 100 insertions(+), 100 deletions(-) (limited to 'gemfeed/2024-04-01-KISS-high-availability-with-OpenBSD.html') diff --git a/gemfeed/2024-04-01-KISS-high-availability-with-OpenBSD.html b/gemfeed/2024-04-01-KISS-high-availability-with-OpenBSD.html index ffd80d59..c142a1a3 100644 --- a/gemfeed/2024-04-01-KISS-high-availability-with-OpenBSD.html +++ b/gemfeed/2024-04-01-KISS-high-availability-with-OpenBSD.html @@ -97,38 +97,38 @@ KISS high-availability with OpenBSD by Lorenzo Bettini http://www.lorenzobettini.it http://www.gnu.org/software/src-highlite --> -
#!/bin/ksh
+
#!/bin/ksh
 
-ZONES_DIR=/var/nsd/zones/master/
-DEFAULT_MASTER=fishfinger.buetow.org
-DEFAULT_STANDBY=blowfish.buetow.org
+ZONES_DIR=/var/nsd/zones/master/
+DEFAULT_MASTER=fishfinger.buetow.org
+DEFAULT_STANDBY=blowfish.buetow.org
 
-determine_master_and_standby () {
-    local master=$DEFAULT_MASTER
-    local standby=$DEFAULT_STANDBY
+determine_master_and_standby () {
+    local master=$DEFAULT_MASTER
+    local standby=$DEFAULT_STANDBY
 
-    .
-    .
-    .
-    
-    local -i health_ok=1
-    if ! ftp -4 -o - https://$master/index.txt | grep -q "Welcome to $master"; then
-        echo "https://$master/index.txt IPv4 health check failed"
-        health_ok=0
-    elif ! ftp -6 -o - https://$master/index.txt | grep -q "Welcome to $master"; then
-        echo "https://$master/index.txt IPv6 health check failed"
-        health_ok=0
-    fi
-    if [ $health_ok -eq 0 ]; then
-        local tmp=$master
-        master=$standby
-        standby=$tmp
-    fi
+    .
+    .
+    .
+    
+    local -i health_ok=1
+    if ! ftp -4 -o - https://$master/index.txt | grep -q "Welcome to $master"; then
+        echo "https://$master/index.txt IPv4 health check failed"
+        health_ok=0
+    elif ! ftp -6 -o - https://$master/index.txt | grep -q "Welcome to $master"; then
+        echo "https://$master/index.txt IPv6 health check failed"
+        health_ok=0
+    fi
+    if [ $health_ok -eq 0 ]; then
+        local tmp=$master
+        master=$standby
+        standby=$tmp
+    fi
 
-    .
-    .
-    .
-}
+    .
+    .
+    .
+}
 

 

 The failover scripts looks for the  ; Enable failover string in the DNS zone files and swaps the A and AAAA records of the DNS entries accordingly:

@@ -137,42 +137,42 @@ http://www.gnu.org/software/src-highlite -->
 by Lorenzo Bettini
 http://www.lorenzobettini.it
 http://www.gnu.org/software/src-highlite -->
-
fishfinger$ grep failover /var/nsd/zones/master/foo.zone.zone
-        300 IN A 46.23.94.99 ; Enable failover
-        300 IN AAAA 2a03:6000:6f67:624::99 ; Enable failover
-www     300 IN A 46.23.94.99 ; Enable failover
-www     300 IN AAAA 2a03:6000:6f67:624::99 ; Enable failover
-standby  300 IN A 23.88.35.144 ; Enable failover
-standby  300 IN AAAA 2a01:4f8:c17:20f1::42 ; Enable failover
+
fishfinger$ grep failover /var/nsd/zones/master/foo.zone.zone
+        300 IN A 46.23.94.99 ; Enable failover
+        300 IN AAAA 2a03:6000:6f67:624::99 ; Enable failover
+www     300 IN A 46.23.94.99 ; Enable failover
+www     300 IN AAAA 2a03:6000:6f67:624::99 ; Enable failover
+standby  300 IN A 23.88.35.144 ; Enable failover
+standby  300 IN AAAA 2a01:4f8:c17:20f1::42 ; Enable failover
 

 

 
-
transform () {
-  sed -E '
-	/IN A .*; Enable failover/ {
-	    /^standby/! {
-	        s/^(.*) 300 IN A (.*) ; (.*)/\1 300 IN A '$(cat /var/nsd/run/master_a)' ; \3/;
-	    }
-	    /^standby/ {
-	        s/^(.*) 300 IN A (.*) ; (.*)/\1 300 IN A '$(cat /var/nsd/run/standby_a)' ; \3/;
-	    }
-	}
-	/IN AAAA .*; Enable failover/ {
-	    /^standby/! {
-	        s/^(.*) 300 IN AAAA (.*) ; (.*)/\1 300 IN AAAA '$(cat /var/nsd/run/master_aaaa)' ; \3/;
-	    }
-	    /^standby/ {
-	        s/^(.*) 300 IN AAAA (.*) ; (.*)/\1 300 IN AAAA '$(cat /var/nsd/run/standby_aaaa)' ; \3/;
-	    }
-	}
-	/ ; serial/ {
-	    s/^( +) ([0-9]+) .*; (.*)/\1 '$(date +%s)' ; \3/;
-	}
-  '
-}
+
transform () {
+  sed -E '
+	/IN A .*; Enable failover/ {
+	    /^standby/! {
+	        s/^(.*) 300 IN A (.*) ; (.*)/\1 300 IN A '$(cat /var/nsd/run/master_a)' ; \3/;
+	    }
+	    /^standby/ {
+	        s/^(.*) 300 IN A (.*) ; (.*)/\1 300 IN A '$(cat /var/nsd/run/standby_a)' ; \3/;
+	    }
+	}
+	/IN AAAA .*; Enable failover/ {
+	    /^standby/! {
+	        s/^(.*) 300 IN AAAA (.*) ; (.*)/\1 300 IN AAAA '$(cat /var/nsd/run/master_aaaa)' ; \3/;
+	    }
+	    /^standby/ {
+	        s/^(.*) 300 IN AAAA (.*) ; (.*)/\1 300 IN AAAA '$(cat /var/nsd/run/standby_aaaa)' ; \3/;
+	    }
+	}
+	/ ; serial/ {
+	    s/^( +) ([0-9]+) .*; (.*)/\1 '$(date +%s)' ; \3/;
+	}
+  '
+}
 

 

 After the failover, the script reloads nsd and performs a sanity check to see if DNS still works. If not, a rollback will be performed:

@@ -181,48 +181,48 @@ http://www.gnu.org/software/src-highlite -->
 by Lorenzo Bettini
 http://www.lorenzobettini.it
 http://www.gnu.org/software/src-highlite -->
-
#! Race condition !#
-   
-if [ -f $zone_file.bak ]; then
-    mv $zone_file.bak $zone_file
-fi
+
#! Race condition !#
+   
+if [ -f $zone_file.bak ]; then
+    mv $zone_file.bak $zone_file
+fi
 
-cat $zone_file | transform > $zone_file.new.tmp 
+cat $zone_file | transform > $zone_file.new.tmp 
 
-grep -v ' ; serial' $zone_file.new.tmp > $zone_file.new.noserial.tmp
-grep -v ' ; serial' $zone_file > $zone_file.old.noserial.tmp
+grep -v ' ; serial' $zone_file.new.tmp > $zone_file.new.noserial.tmp
+grep -v ' ; serial' $zone_file > $zone_file.old.noserial.tmp
 
-echo "Has zone $zone_file changed?"
-if diff -u $zone_file.old.noserial.tmp $zone_file.new.noserial.tmp; then
-    echo "The zone $zone_file hasn't changed"
-    rm $zone_file.*.tmp
-    return 0
-fi
+echo "Has zone $zone_file changed?"
+if diff -u $zone_file.old.noserial.tmp $zone_file.new.noserial.tmp; then
+    echo "The zone $zone_file hasn't changed"
+    rm $zone_file.*.tmp
+    return 0
+fi
 
-cp $zone_file $zone_file.bak
-mv $zone_file.new.tmp $zone_file
-rm $zone_file.*.tmp
-echo "Reloading nsd"
-nsd-control reload
+cp $zone_file $zone_file.bak
+mv $zone_file.new.tmp $zone_file
+rm $zone_file.*.tmp
+echo "Reloading nsd"
+nsd-control reload
 
-if ! zone_is_ok $zone; then
-    echo "Rolling back $zone_file changes"
-    cp $zone_file $zone_file.invalid
-    mv $zone_file.bak $zone_file
-    echo "Reloading nsd"
-    nsd-control reload
-    zone_is_ok $zone
-    return 3
-fi
+if ! zone_is_ok $zone; then
+    echo "Rolling back $zone_file changes"
+    cp $zone_file $zone_file.invalid
+    mv $zone_file.bak $zone_file
+    echo "Reloading nsd"
+    nsd-control reload
+    zone_is_ok $zone
+    return 3
+fi
 
-for cleanup in invalid bak; do
-    if [ -f $zone_file.$cleanup ]; then
-        rm $zone_file.$cleanup
-    fi
-done
+for cleanup in invalid bak; do
+    if [ -f $zone_file.$cleanup ]; then
+        rm $zone_file.$cleanup
+    fi
+done
 
-echo "Failover of zone $zone to $MASTER completed"
-return 1
+echo "Failover of zone $zone to $MASTER completed"
+return 1
 

 

 A non-zero return code (here, 3 when a rollback and 1 when a DNS failover was performed) will cause CRON to send an E-Mail with the whole script output.

@@ -279,13 +279,13 @@ echo "Failover of zone $zone to $MASTER completed"
 by Lorenzo Bettini
 http://www.lorenzobettini.it
 http://www.gnu.org/software/src-highlite -->
-
# Weekly auto-failover for Let's Encrypt automation
-local -i -r week_of_the_year=$(date +%U)
-if [ $(( week_of_the_year % 2 )) -eq 0 ]; then
-    local tmp=$master
-    master=$standby
-    standby=$tmp
-fi
+
# Weekly auto-failover for Let's Encrypt automation
+local -i -r week_of_the_year=$(date +%U)
+if [ $(( week_of_the_year % 2 )) -eq 0 ]; then
+    local tmp=$master
+    master=$standby
+    standby=$tmp
+fi
 

 

 This way, a DNS failover is performed weekly so that the ACME automation can update the Let's Encrypt certificates (for master and standby) before they expire on each VM.

-- 
cgit v1.2.3