nixops — настраиваем кластер mariadb galera

Thank you for reading this post, don't forget to subscribe!

Установка удаленных систем

Устанавливаем на 3 удаленных системах OC NixOS с такой конфигурацией

{ config, pkgs, ... }:
{
  imports = [
    ./hardware-configuration.nix
  ];

  boot.loader.grub.enable = true;
  boot.loader.grub.version = 2;
  boot.loader.grub.device = "/dev/vda";

  networking.hostName = "basic-nixops";

  environment.systemPackages = with pkgs; [
    wget vim mkpasswd
  ];

  services.openssh = {
    enable = true;
    passwordAuthentication = false;
    permitRootLogin = "yes";
  };

  users = {
    mutableUsers = false;
    users.root = {
      openssh.authorizedKeys.keys = [
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII5rqPqf/eFAyAEPZhwX/Hg7sNLZj4LWEexxsnv6izMW rebrain@NixOS-example"
      ];
      hashedPassword = null;
    };
    users.rebrain = {
      isNormalUser = true;
      uid = 51011;
      group = "rebrain";
      extraGroups = [ "wheel" "users" ];
      hashedPassword = "$6$zejLDpVGQfekr$no6c35WweI7j59W8diZ2pZwA2xadi5NxJNacLkBBoOmyt/4Lqt/pDX2pO3vUw157eb59XUZ71GZcMXQs2FqKL/";
    };
    groups.rebrain = {
     gid = 51011;
    };
  };

  system.stateVersion = "20.09";
}

{ config, pkgs, ... }:

{

imports = [

./hardware-configuration.nix

];

boot.loader.grub.enable = true;

boot.loader.grub.version = 2;

boot.loader.grub.device = "/dev/vda";

networking.hostName = "basic-nixops";

environment.systemPackages = with pkgs; [

wget vim mkpasswd

];

services.openssh = {

enable = true;

passwordAuthentication = false;

permitRootLogin = "yes";

};

users = {

mutableUsers = false;

users.root = {

openssh.authorizedKeys.keys = [

"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII5rqPqf/eFAyAEPZhwX/Hg7sNLZj4LWEexxsnv6izMW rebrain@NixOS-example"

];

hashedPassword = null;

};

users.rebrain = {

isNormalUser = true;

uid = 51011;

group = "rebrain";

extraGroups = [ "wheel" "users" ];

hashedPassword = "$6$zejLDpVGQfekr$no6c35WweI7j59W8diZ2pZwA2xadi5NxJNacLkBBoOmyt/4Lqt/pDX2pO3vUw157eb59XUZ71GZcMXQs2FqKL/";

};

groups.rebrain = {

gid = 51011;

};

system.stateVersion = "20.09";

}

Значения hashedPassword и openssh.authorizedKeys.keys у вас будут отличаться.

Подготовим структуру для деплоя:

mkdir -p ~/works/nixops/deploy/labs-galera/{galera1,galera2,galera3}

Создадим конфигурационные файлы:

nano ~/works/nixops/deploy/labs-galera.nix

{
  network.description = "labs galera servers";
  network.enableRollback = true;

  galera1 = { config, lib, pkgs, ... }: {
    require = [ ./labs-galera/galera1/configuration.nix ];

    deployment.targetEnv = "none";
    deployment.targetHost = "192.168.0.231";
    deployment.targetPort = 22;
  };

  galera2 = { config, lib, pkgs, ... }: {
    require = [ ./labs-galera/galera2/configuration.nix ];

    deployment.targetEnv = "none";
    deployment.targetHost = "192.168.0.232";
    deployment.targetPort = 22;
  };

  galera3 = { config, lib, pkgs, ... }: {
    require = [ ./labs-galera/galera3/configuration.nix ];

    deployment.targetEnv = "none";
    deployment.targetHost = "192.168.0.233";
    deployment.targetPort = 22;
  };
}

{

network.description = "labs galera servers";

network.enableRollback = true;

galera1 = { config, lib, pkgs, ... }: {

require = [ ./labs-galera/galera1/configuration.nix ];

deployment.targetEnv = "none";

deployment.targetHost = "192.168.0.231";

deployment.targetPort = 22;

};

galera2 = { config, lib, pkgs, ... }: {

require = [ ./labs-galera/galera2/configuration.nix ];

deployment.targetEnv = "none";

deployment.targetHost = "192.168.0.232";

deployment.targetPort = 22;

};

galera3 = { config, lib, pkgs, ... }: {

require = [ ./labs-galera/galera3/configuration.nix ];

deployment.targetEnv = "none";

deployment.targetHost = "192.168.0.233";

deployment.targetPort = 22;

};

}

В поле deployment.targetHost = «192.168.0.231»; указываем IP-адрес, который назначен нашей установленной удаленной системе. В вашем случае IP-адрес будет отличаться.

nano ~/works/nixops/deploy/labs-galera/galera1/configuration.nix

{
  imports =[
    ./../../../config-defs/core.nix
    ./hardware-configuration.nix
    ./users.nix
  ];

  boot = {
    loader.grub.device = "/dev/vda";
    kernelParams = [ "lockdown=confidentiality" ];
  };

  networking.hostName = "vm11-galera1";
}

{

imports =[

./../../../config-defs/core.nix

./hardware-configuration.nix

./users.nix

];

boot = {

loader.grub.device = "/dev/vda";

kernelParams = [ "lockdown=confidentiality" ];

};

networking.hostName = "vm11-galera1";

}

nano ~/works/nixops/deploy/labs-galera/galera2/configuration.nix

{
  imports =[
    ./../../../config-defs/core.nix
    ./hardware-configuration.nix
    ./users.nix
  ];

  boot = {
    loader.grub.device = "/dev/vda";
    kernelParams = [ "lockdown=confidentiality" ];
  };

  networking.hostName = "vm12-galera2";
}

{

imports =[

./../../../config-defs/core.nix

./hardware-configuration.nix

./users.nix

];

boot = {

loader.grub.device = "/dev/vda";

kernelParams = [ "lockdown=confidentiality" ];

};

networking.hostName = "vm12-galera2";

}

nano ~/works/nixops/deploy/labs-galera/galera3/configuration.nix

{
  imports =[
    ./../../../config-defs/core.nix
    ./hardware-configuration.nix
    ./users.nix
  ];

  boot = {
    loader.grub.device = "/dev/vda";
    kernelParams = [ "lockdown=confidentiality" ];
  };

  networking.hostName = "vm13-galera3";
}

{

imports =[

./../../../config-defs/core.nix

./hardware-configuration.nix

./users.nix

];

boot = {

loader.grub.device = "/dev/vda";

kernelParams = [ "lockdown=confidentiality" ];

};

networking.hostName = "vm13-galera3";

}

Не забываем скопировать с удаленных систем конфигурацию hardware-configuration.nix:

scp root@192.168.0.231:/etc/nixos/hardware-configuration.nix ~/works/nixops/deploy/labs-galera/galera1/hardware-configuration.nix
scp root@192.168.0.232:/etc/nixos/hardware-configuration.nix ~/works/nixops/deploy/labs-galera/galera2/hardware-configuration.nix
scp root@192.168.0.233:/etc/nixos/hardware-configuration.nix ~/works/nixops/deploy/labs-galera/galera3/hardware-configuration.nix

scp root@192.168.0.231:/etc/nixos/hardware-configuration.nix ~/works/nixops/deploy/labs-galera/galera1/hardware-configuration.nix

scp root@192.168.0.232:/etc/nixos/hardware-configuration.nix ~/works/nixops/deploy/labs-galera/galera2/hardware-configuration.nix

scp root@192.168.0.233:/etc/nixos/hardware-configuration.nix ~/works/nixops/deploy/labs-galera/galera3/hardware-configuration.nix

The authenticity of host '192.168.0.231 (192.168.0.231)' can't be established.
ED25519 key fingerprint is SHA256:qSFWEYnxgK/9mSbRDvE1PfBOJC/zSO6ySzHk038Tfj8.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.0.231' (ED25519) to the list of known hosts.
Enter passphrase for key '/home/rebrain/.ssh/id_ed25519':
hardware-configuration.nix                                                                                                    100%  735     1.3MB/s   00:00
The authenticity of host '192.168.0.232 (192.168.0.232)' can't be established.
ED25519 key fingerprint is SHA256:8eljNfpuyksXiFialZfQV31wuLv/RvLGmI5t26aPKsw.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.0.232' (ED25519) to the list of known hosts.
Enter passphrase for key '/home/rebrain/.ssh/id_ed25519':
hardware-configuration.nix                                                                                                    100%  735     1.2MB/s   00:00
The authenticity of host '192.168.0.233 (192.168.0.233)' can't be established.
ED25519 key fingerprint is SHA256:U2tQCYIr2tNT+DdGkZCAQ6XSu/ZzGk/D6c8QQqp96Lw.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.0.233' (ED25519) to the list of known hosts.
Enter passphrase for key '/home/rebrain/.ssh/id_ed25519':
hardware-configuration.nix                                                                                                    100%  735     1.2MB/s   00:00

The authenticity of host '192.168.0.231 (192.168.0.231)' can't be established.

ED25519 key fingerprint is SHA256:qSFWEYnxgK/9mSbRDvE1PfBOJC/zSO6ySzHk038Tfj8.

Are you sure you want to continue connecting (yes/no/[fingerprint])? yes

Warning: Permanently added '192.168.0.231' (ED25519) to the list of known hosts.

Enter passphrase for key '/home/rebrain/.ssh/id_ed25519':

hardware-configuration.nix 100% 735 1.3MB/s 00:00

The authenticity of host '192.168.0.232 (192.168.0.232)' can't be established.

ED25519 key fingerprint is SHA256:8eljNfpuyksXiFialZfQV31wuLv/RvLGmI5t26aPKsw.

Are you sure you want to continue connecting (yes/no/[fingerprint])? yes

Warning: Permanently added '192.168.0.232' (ED25519) to the list of known hosts.

Enter passphrase for key '/home/rebrain/.ssh/id_ed25519':

hardware-configuration.nix 100% 735 1.2MB/s 00:00

The authenticity of host '192.168.0.233 (192.168.0.233)' can't be established.

ED25519 key fingerprint is SHA256:U2tQCYIr2tNT+DdGkZCAQ6XSu/ZzGk/D6c8QQqp96Lw.

Are you sure you want to continue connecting (yes/no/[fingerprint])? yes

Warning: Permanently added '192.168.0.233' (ED25519) to the list of known hosts.

Enter passphrase for key '/home/rebrain/.ssh/id_ed25519':

hardware-configuration.nix 100% 735 1.2MB/s 00:00

В файле users.nix в разделе users.root.openssh.authorizedKeys.keys прописываем ssh-ключ, который сгенерировали выше. В разделе users.rebrain.openssh.authorizedKeys.keys уже прописан ключ, который мы сгенерировали при первом знакомстве с NixOS.

nano ~/works/nixops/deploy/labs-galera/galera1/users.nix

{ config, ... }:
let
  ssh-keys = import ./../../../config-defs/generic/security/ssh-keys.nix;

in {
  users = with ssh-keys; {
    users.root = {
      openssh.authorizedKeys.keys = [
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII5rqPqf/eFAyAEPZhwX/Hg7sNLZj4LWEexxsnv6izMW rebrain@NixOS-example"
      ];
      hashedPassword = null;
    };
    users.rebrain = {
      isNormalUser = true;
      uid = config.uid-gid.rebrain;
      group = "rebrain";
      extraGroups = [ "wheel" "users" ];
      openssh.authorizedKeys.keys = [
        work.rebrain_example
      ];
      hashedPassword = "$6$zejLDpVGQfekr$no6c35WweI7j59W8diZ2pZwA2xadi5NxJNacLkBBoOmyt/4Lqt/pDX2pO3vUw157eb59XUZ71GZcMXQs2FqKL/";
    };
    groups.rebrain = {
      gid = config.uid-gid.rebrain;
    };
    groups.ssh-users = {
      members = [ "root" "rebrain" ];
    };
  };
}

{ config, ... }:

let

ssh-keys = import ./../../../config-defs/generic/security/ssh-keys.nix;

in {

users = with ssh-keys; {

users.root = {

openssh.authorizedKeys.keys = [

"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII5rqPqf/eFAyAEPZhwX/Hg7sNLZj4LWEexxsnv6izMW rebrain@NixOS-example"

];

hashedPassword = null;

};

users.rebrain = {

isNormalUser = true;

uid = config.uid-gid.rebrain;

group = "rebrain";

extraGroups = [ "wheel" "users" ];

openssh.authorizedKeys.keys = [

work.rebrain_example

];

hashedPassword = "$6$zejLDpVGQfekr$no6c35WweI7j59W8diZ2pZwA2xadi5NxJNacLkBBoOmyt/4Lqt/pDX2pO3vUw157eb59XUZ71GZcMXQs2FqKL/";

};

groups.rebrain = {

gid = config.uid-gid.rebrain;

};

groups.ssh-users = {

members = [ "root" "rebrain" ];

};

}

Копируем файл users.nix на остальные удаленные системы:

cp ~/works/nixops/deploy/labs-galera/galera1/users.nix ~/works/nixops/deploy/labs-galera/galera2/users.nix

cp ~/works/nixops/deploy/labs-galera/galera1/users.nix ~/works/nixops/deploy/labs-galera/galera3/users.nix

Создаем деплой labs-galera:

nixops create -d labs-galera ~/works/nixops/deploy/labs-galera.nix

created deployment ‘b37dab82-e16e-11ea-be56-525400c283bd’

b37dab82-e16e-11ea-be56-525400c283bd

Просмотрим информацию о нашем деплое:

nixops info -d labs-galera

Network name: labs-galera
Network UUID: b37dab82-e16e-11ea-be56-525400c283bd
Network description: labs galera servers
Nix expressions: /home/rebrain/works/nixops/deploy/labs-galera.nix
Nix profile: /nix/var/nix/profiles/per-user/rebrain/nixops/b37dab82-e16e-11ea-be56-525400c283bd

+---------+---------+------+-------------+------------+
| Name    |  Status | Type | Resource Id | IP address |
+---------+---------+------+-------------+------------+
| galera1 | Missing | none |             |            |
| galera2 | Missing | none |             |            |
| galera3 | Missing | none |             |            |
+---------+---------+------+-------------+------------+

Network name: labs-galera

Network UUID: b37dab82-e16e-11ea-be56-525400c283bd

Network description: labs galera servers

Nix expressions: /home/rebrain/works/nixops/deploy/labs-galera.nix

Nix profile: /nix/var/nix/profiles/per-user/rebrain/nixops/b37dab82-e16e-11ea-be56-525400c283bd

+---------+---------+------+-------------+------------+

+---------+---------+------+-------------+------------+

+---------+---------+------+-------------+------------+

Если вы создали, как в прошлой статье, SSH-ключ с паролем, то, чтобы каждый раз не вводить пароль, предварительно загрузим его командой ssh-add:

ssh-add ~/.ssh/id_ed25519

Enter passphrase for /home/rebrain/.ssh/id_ed25519:

Identity added: /home/rebrain/.ssh/id_ed25519 (rebrain@NixOS-example)

Разворачиваем нашу конфигурацию:

nixops deploy -d labs-galera

Просмотрим еще раз информацию о нашем деплое:

nixops info -d labs-galera

Network name: labs-galera Network UUID: b37dab82-e16e-11ea-be56-525400c283bd Network description: labs galera servers Nix expressions: /home/rebrain/works/nixops/deploy/labs-galera.nix Nix profile: /nix/var/nix/profiles/per-user/rebrain/nixops/b37dab82-e16e-11ea-be56-525400c283bd

+---------+---------------+------+-----------------------------------------------------+------------+
| Name    |     Status    | Type | Resource Id                                         | IP address |
+---------+---------------+------+-----------------------------------------------------+------------+
| galera1 | Up / Outdated | none | nixops-b37dab82-e16e-11ea-be56-525400c283bd-galera1 |            |
| galera2 | Up / Outdated | none | nixops-b37dab82-e16e-11ea-be56-525400c283bd-galera2 |            |
| galera3 | Up / Outdated | none | nixops-b37dab82-e16e-11ea-be56-525400c283bd-galera3 |            |
+---------+---------------+------+-----------------------------------------------------+------------+
Time: 0h:00m:03s

Network name: labs-galera Network UUID: b37dab82-e16e-11ea-be56-525400c283bd Network description: labs galera servers Nix expressions: /home/rebrain/works/nixops/deploy/labs-galera.nix Nix profile: /nix/var/nix/profiles/per-user/rebrain/nixops/b37dab82-e16e-11ea-be56-525400c283bd

+---------+---------------+------+-----------------------------------------------------+------------+

+---------+---------------+------+-----------------------------------------------------+------------+

+---------+---------------+------+-----------------------------------------------------+------------+

Time: 0h:00m:03s

Начальная настройка закончена, сохраним коммит в git:

cd ~/works/nixops/deploy

git add -A

git commit -m "add labs-galera"

[master 98392fd] add labs-galera
 10 files changed, 221 insertions(+)
 create mode 100644 labs-galera.nix
 create mode 100644 labs-galera/galera1/configuration.nix
 create mode 100644 labs-galera/galera1/hardware-configuration.nix
 create mode 100644 labs-galera/galera1/users.nix
 create mode 100644 labs-galera/galera2/configuration.nix
 create mode 100644 labs-galera/galera2/hardware-configuration.nix
 create mode 100644 labs-galera/galera2/users.nix
 create mode 100644 labs-galera/galera3/configuration.nix
 create mode 100644 labs-galera/galera3/hardware-configuration.nix
 create mode 100644 labs-galera/galera3/users.nix

[master 98392fd] add labs-galera

10 files changed, 221 insertions(+)

create mode 100644 labs-galera.nix

create mode 100644 labs-galera/galera1/configuration.nix

create mode 100644 labs-galera/galera1/hardware-configuration.nix

create mode 100644 labs-galera/galera1/users.nix

create mode 100644 labs-galera/galera2/configuration.nix

create mode 100644 labs-galera/galera2/hardware-configuration.nix

create mode 100644 labs-galera/galera2/users.nix

create mode 100644 labs-galera/galera3/configuration.nix

create mode 100644 labs-galera/galera3/hardware-configuration.nix

create mode 100644 labs-galera/galera3/users.nix

Мы сделали начальную настройку удаленных систем. Теперь добавим основные службы — фаервол, fail2ban и мониторинг netdata:

cp -r /etc/nixos/nix-config/servers/example/services ~/works/nixops/deploy/labs-galera/galera1

cp -r /etc/nixos/nix-config/servers/example/services ~/works/nixops/deploy/labs-galera/galera2

cp -r /etc/nixos/nix-config/servers/example/services ~/works/nixops/deploy/labs-galera/galera3

В файлы configuration.nix добавляем новые сервисы:

nano ~/works/nixops/deploy/labs-galera/galera2/configuration.nix

nano ~/works/nixops/deploy/labs-galera/galera3/configuration.nix

...
  imports =[
    ./../../../config-defs/core.nix
    ./services/fail2ban.nix
    ./services/firefall-nft.nix
    ./services/netdata.nix
    ./hardware-configuration.nix
...

...

imports =[

./../../../config-defs/core.nix

./services/fail2ban.nix

./services/firefall-nft.nix

./services/netdata.nix

./hardware-configuration.nix

...

Должно получиться так:

git diff

diff --git a/labs-galera/galera1/configuration.nix b/labs-galera/galera1/configuration.nix
index 7ae5cbd..058e56c 100644
--- a/labs-galera/galera1/configuration.nix
+++ b/labs-galera/galera1/configuration.nix
@@ -1,6 +1,9 @@
 {
   imports =[
     ./../../../config-defs/core.nix
+    ./services/fail2ban.nix
+    ./services/firefall-nft.nix
+    ./services/netdata.nix
     ./hardware-configuration.nix
     ./users.nix
   ];
diff --git a/labs-galera/galera2/configuration.nix b/labs-galera/galera2/configuration.nix
index 360ed9b..27987e7 100644
--- a/labs-galera/galera2/configuration.nix
+++ b/labs-galera/galera2/configuration.nix
@@ -1,6 +1,9 @@
 {
   imports =[
     ./../../../config-defs/core.nix
+    ./services/fail2ban.nix
+    ./services/firefall-nft.nix
+    ./services/netdata.nix
     ./hardware-configuration.nix
     ./users.nix
   ];
diff --git a/labs-galera/galera3/configuration.nix b/labs-galera/galera3/configuration.nix
index 4290170..93abbcd 100644
--- a/labs-galera/galera3/configuration.nix
+++ b/labs-galera/galera3/configuration.nix
@@ -1,6 +1,9 @@
 {
   imports =[
     ./../../../config-defs/core.nix
+    ./services/fail2ban.nix
+    ./services/firefall-nft.nix
+    ./services/netdata.nix
     ./hardware-configuration.nix
     ./users.nix
   ];

diff --git a/labs-galera/galera1/configuration.nix b/labs-galera/galera1/configuration.nix

index 7ae5cbd..058e56c 100644

--- a/labs-galera/galera1/configuration.nix

+++ b/labs-galera/galera1/configuration.nix

@@ -1,6 +1,9 @@

{

imports =[

./../../../config-defs/core.nix

+ ./services/fail2ban.nix

+ ./services/firefall-nft.nix

+ ./services/netdata.nix

./hardware-configuration.nix

./users.nix

];

diff --git a/labs-galera/galera2/configuration.nix b/labs-galera/galera2/configuration.nix

index 360ed9b..27987e7 100644

--- a/labs-galera/galera2/configuration.nix

+++ b/labs-galera/galera2/configuration.nix

@@ -1,6 +1,9 @@

{

imports =[

./../../../config-defs/core.nix

+ ./services/fail2ban.nix

+ ./services/firefall-nft.nix

+ ./services/netdata.nix

./hardware-configuration.nix

./users.nix

];

diff --git a/labs-galera/galera3/configuration.nix b/labs-galera/galera3/configuration.nix

index 4290170..93abbcd 100644

--- a/labs-galera/galera3/configuration.nix

+++ b/labs-galera/galera3/configuration.nix

@@ -1,6 +1,9 @@

{

imports =[

./../../../config-defs/core.nix

+ ./services/fail2ban.nix

+ ./services/firefall-nft.nix

+ ./services/netdata.nix

./hardware-configuration.nix

./users.nix

];

Добавляем изменения в git:

git commit -m "labs-galera: add default services"

[master 42ee147] labs-galera: add default services
 12 files changed, 153 insertions(+)
 create mode 100644 labs-galera/galera1/services/fail2ban.nix
 create mode 100644 labs-galera/galera1/services/firefall-nft.nix
 create mode 100644 labs-galera/galera1/services/netdata.nix
 create mode 100644 labs-galera/galera2/services/fail2ban.nix
 create mode 100644 labs-galera/galera2/services/firefall-nft.nix
 create mode 100644 labs-galera/galera2/services/netdata.nix
 create mode 100644 labs-galera/galera3/services/fail2ban.nix
 create mode 100644 labs-galera/galera3/services/firefall-nft.nix
 create mode 100644 labs-galera/galera3/services/netdata.nix

[master 42ee147] labs-galera: add default services

12 files changed, 153 insertions(+)

create mode 100644 labs-galera/galera1/services/fail2ban.nix

create mode 100644 labs-galera/galera1/services/firefall-nft.nix

create mode 100644 labs-galera/galera1/services/netdata.nix

create mode 100644 labs-galera/galera2/services/fail2ban.nix

create mode 100644 labs-galera/galera2/services/firefall-nft.nix

create mode 100644 labs-galera/galera2/services/netdata.nix

create mode 100644 labs-galera/galera3/services/fail2ban.nix

create mode 100644 labs-galera/galera3/services/firefall-nft.nix

create mode 100644 labs-galera/galera3/services/netdata.nix

бновляем удаленные системы:

nixops deploy -d labs-galera

Перезагружаем наши удаленные системы:

nixops reboot -d labs-galera

Переходим к MariaDB Galera

Теперь приступим к настройке MariaDB Galera. Минимальная конфигурация кластера выглядит так:

nano ~/works/nixops/deploy/labs-galera/galera1/services/mysql.nix

{ pkgs, ... }:
{
  networking = {
    extraHosts = ''
      192.168.0.231 galera_01
      192.168.0.232 galera_02
      192.168.0.233 galera_03
    '';
  };
  systemd.services.mysql = with pkgs; {
    path = [ bash gawk gnutar inetutils which gzip iproute netcat procps pv socat ];
  };
  services.mysql = {
    enable = true;
    package = pkgs.mariadb;
    initialScript = pkgs.writeText "mariadb-init.sql" ''
      GRANT RELOAD, PROCESS, LOCK TABLES, REPLICATION CLIENT ON *.* TO 'repl_user'@'localhost' IDENTIFIED BY 'repl_pass';
      GRANT USAGE ON *.* TO <code data-enlighter-language="generic" class="EnlighterJSRAW">netdata</code>@<code data-enlighter-language="generic" class="EnlighterJSRAW">localhost</code> IDENTIFIED BY 'netdata_pass';
      FLUSH PRIVILEGES;
    '';
    settings = {
      mysqld = {
        bind_address = "0.0.0.0";
      };
      galera = {
        wsrep_on = "ON";
        wsrep_debug = "NONE";
        wsrep_retry_autocommit = "3";
        wsrep_provider = "${pkgs.mariadb-galera}/lib/galera/libgalera_smm.so";
        wsrep_cluster_address = "gcomm://";
        wsrep_cluster_name = "galera";
        wsrep_node_address = "galera_01";
        wsrep_node_name = "galera_01";
        wsrep_sst_method = "mariabackup";
        wsrep_sst_auth = "repl_user:repl_pass";
        binlog_format = "ROW";
        enforce_storage_engine = "InnoDB";
        innodb_autoinc_lock_mode = "2";
      };
    };
  };
}

{ pkgs, ... }:

{

networking = {

extraHosts = ''

192.168.0.231 galera_01

192.168.0.232 galera_02

192.168.0.233 galera_03

'';

};

systemd.services.mysql = with pkgs; {

path = [ bash gawk gnutar inetutils which gzip iproute netcat procps pv socat ];

};

services.mysql = {

enable = true;

package = pkgs.mariadb;

initialScript = pkgs.writeText "mariadb-init.sql" ''

GRANT RELOAD, PROCESS, LOCK TABLES, REPLICATION CLIENT ON *.* TO 'repl_user'@'localhost' IDENTIFIED BY 'repl_pass';

GRANT USAGE ON *.* TO <code data-enlighter-language="generic" class="EnlighterJSRAW">netdata</code>@<code data-enlighter-language="generic" class="EnlighterJSRAW">localhost</code> IDENTIFIED BY 'netdata_pass';

FLUSH PRIVILEGES;

'';

settings = {

mysqld = {

bind_address = "0.0.0.0";

};

galera = {

wsrep_on = "ON";

wsrep_debug = "NONE";

wsrep_retry_autocommit = "3";

wsrep_provider = "${pkgs.mariadb-galera}/lib/galera/libgalera_smm.so";

wsrep_cluster_address = "gcomm://";

wsrep_cluster_name = "galera";

wsrep_node_address = "galera_01";

wsrep_node_name = "galera_01";

wsrep_sst_method = "mariabackup";

wsrep_sst_auth = "repl_user:repl_pass";

binlog_format = "ROW";

enforce_storage_engine = "InnoDB";

innodb_autoinc_lock_mode = "2";

};

}

Где:

networking = { extraHosts — прописывает имена хостов для наших удаленных серверов, которые будут использоваться сервисом MariaDB Galera.
services.mysql.package = pkgs.mariadb; — указываем использовать пакет MariaDB.
initialScript = pkgs.writeText «mariadb-init.sql» — SQL-скрипт, который выполняется при первоначальной инициализации базы данных MariaDB. Здесь добавляем 2 пользователей: repl_user для репликации баз данных и netdata для мониторинга.
services.mysql.settings.mysqld.bind_address = 0.0.0.0″; — указываем слушать все интерфейсы.
services.mysql.settings.mysqld.galera.wsrep_on = «ON»; — активируем MariaDB Galera кластер.
services.mysql.settings.mysqld.galera.wsrep_debug = «NONE»; — отключаем DEBUG режим.
services.mysql.settings.mysqld.galera.wsrep_retry_autocommit = «3»; — указываем количество повторных попыток выполненных запросов из-за конфликтов внутри кластера перед возвратом ошибки клиенту.
services.mysql.settings.mysqld.galera.wsrep_provider = «${pkgs.mariadb-galera}/lib/galera/libgalera_smm.so»; — указываем путь к библиотеке MariaDB Galera.
services.mysql.settings.mysqld.galera.wsrep_cluster_address = «gcomm://»; — здесь перечисляем все ноды MariaDB Galera. Обратите внимание, при первом запуске кластера на первой ноде указываем пустое значение gcomm://.
services.mysql.settings.mysqld.galera.wsrep_cluster_name = «galera»; — указываем название кластера.
services.mysql.settings.mysqld.galera.wsrep_node_address = «galera_01»; — указываем адрес ноды, совпадает с именем в хост-файле.
services.mysql.settings.mysqld.galera.wsrep_node_name = «galera_01»; — указываем имя ноды.
services.mysql.settings.mysqld.galera.wsrep_sst_method = «mariabackup»; — указываем метод SST репликации.
services.mysql.settings.mysqld.galera.wsrep_sst_auth = «repl_user:repl_pass»; — указываем логин и пароль mysql пользователя для репликации.
services.mysql.settings.mysqld.galera.binlog_format = «ROW»; — указываем использовать ROW формат бин-логов.
services.mysql.settings.mysqld.galera.enforce_storage_engine = «InnoDB»; — запрещаем использовать все форматы базы данных, кроме InnoDB.
services.mysql.settings.mysqld.galera.innodb_autoinc_lock_mode = «2»; — указываем использовать interleaved режим блокировки.

nano ~/works/nixops/deploy/labs-galera/galera2/services/mysql.nix

{ pkgs, ... }:
{
  networking = {
    extraHosts = ''
      192.168.0.231 galera_01
      192.168.0.232 galera_02
      192.168.0.233 galera_03
    '';
  };
  systemd.services.mysql = with pkgs; {
    path = [ bash gawk gnutar inetutils which gzip iproute netcat procps pv socat ];
  };
  services.mysql = {
    enable = true;
    package = pkgs.mariadb;
    initialScript = pkgs.writeText "mariadb-init.sql" ''
      GRANT RELOAD, PROCESS, LOCK TABLES, REPLICATION CLIENT ON *.* TO 'repl_user'@'localhost' IDENTIFIED BY 'repl_pass';
      GRANT USAGE ON *.* TO <code data-enlighter-language="generic" class="EnlighterJSRAW">netdata</code>@<code data-enlighter-language="generic" class="EnlighterJSRAW">localhost</code> IDENTIFIED BY 'netdata_pass';
      FLUSH PRIVILEGES;
    '';
    settings = {
      mysqld = {
        bind_address = "0.0.0.0";
      };
      galera = {
        wsrep_on = "ON";
        wsrep_debug = "NONE";
        wsrep_retry_autocommit = "3";
        wsrep_provider = "${pkgs.mariadb-galera}/lib/galera/libgalera_smm.so";
        wsrep_cluster_address = "gcomm://galera_01,galera_02,galera_03";
        wsrep_cluster_name = "galera";
        wsrep_node_address = "galera_02";
        wsrep_node_name = "galera_02";
        wsrep_sst_method = "mariabackup";
        wsrep_sst_auth = "repl_user:repl_pass";
        binlog_format = "ROW";
        enforce_storage_engine = "InnoDB";
        innodb_autoinc_lock_mode = "2";
      };
    };
  };
}

{ pkgs, ... }:

{

networking = {

extraHosts = ''

192.168.0.231 galera_01

192.168.0.232 galera_02

192.168.0.233 galera_03

'';

};

systemd.services.mysql = with pkgs; {

path = [ bash gawk gnutar inetutils which gzip iproute netcat procps pv socat ];

};

services.mysql = {

enable = true;

package = pkgs.mariadb;

initialScript = pkgs.writeText "mariadb-init.sql" ''

GRANT RELOAD, PROCESS, LOCK TABLES, REPLICATION CLIENT ON *.* TO 'repl_user'@'localhost' IDENTIFIED BY 'repl_pass';

FLUSH PRIVILEGES;

'';

settings = {

mysqld = {

bind_address = "0.0.0.0";

};

galera = {

wsrep_on = "ON";

wsrep_debug = "NONE";

wsrep_retry_autocommit = "3";

wsrep_provider = "${pkgs.mariadb-galera}/lib/galera/libgalera_smm.so";

wsrep_cluster_address = "gcomm://galera_01,galera_02,galera_03";

wsrep_cluster_name = "galera";

wsrep_node_address = "galera_02";

wsrep_node_name = "galera_02";

wsrep_sst_method = "mariabackup";

wsrep_sst_auth = "repl_user:repl_pass";

binlog_format = "ROW";

enforce_storage_engine = "InnoDB";

innodb_autoinc_lock_mode = "2";

};

}

nano ~/works/nixops/deploy/labs-galera/galera3/services/mysql.nix

{ pkgs, ... }:
{
  networking = {
    extraHosts = ''
      192.168.0.231 galera_01
      192.168.0.232 galera_02
      192.168.0.233 galera_03
    '';
  };
  systemd.services.mysql = with pkgs; {
    path = [ bash gawk gnutar inetutils which gzip iproute netcat procps pv socat ];
  };
  services.mysql = {
    enable = true;
    package = pkgs.mariadb;
    initialScript = pkgs.writeText "mariadb-init.sql" ''
      GRANT RELOAD, PROCESS, LOCK TABLES, REPLICATION CLIENT ON *.* TO 'repl_user'@'localhost' IDENTIFIED BY 'repl_pass';
      GRANT USAGE ON *.* TO <code data-enlighter-language="generic" class="EnlighterJSRAW">netdata</code>@<code data-enlighter-language="generic" class="EnlighterJSRAW">localhost</code> IDENTIFIED BY 'netdata_pass';
      FLUSH PRIVILEGES;
    '';
    settings = {
      mysqld = {
        bind_address = "0.0.0.0";
      };
      galera = {
        wsrep_on = "ON";
        wsrep_debug = "NONE";
        wsrep_retry_autocommit = "3";
        wsrep_provider = "${pkgs.mariadb-galera}/lib/galera/libgalera_smm.so";
        wsrep_cluster_address = "gcomm://galera_01,galera_02,galera_03";
        wsrep_cluster_name = "galera";
        wsrep_node_address = "galera_03";
        wsrep_node_name = "galera_03";
        wsrep_sst_method = "mariabackup";
        wsrep_sst_auth = "repl_user:repl_pass";
        binlog_format = "ROW";
        enforce_storage_engine = "InnoDB";
        innodb_autoinc_lock_mode = "2";
      };
    };
  };
}

{ pkgs, ... }:

{

networking = {

extraHosts = ''

192.168.0.231 galera_01

192.168.0.232 galera_02

192.168.0.233 galera_03

'';

};

systemd.services.mysql = with pkgs; {

path = [ bash gawk gnutar inetutils which gzip iproute netcat procps pv socat ];

};

services.mysql = {

enable = true;

package = pkgs.mariadb;

initialScript = pkgs.writeText "mariadb-init.sql" ''

GRANT RELOAD, PROCESS, LOCK TABLES, REPLICATION CLIENT ON *.* TO 'repl_user'@'localhost' IDENTIFIED BY 'repl_pass';

FLUSH PRIVILEGES;

'';

settings = {

mysqld = {

bind_address = "0.0.0.0";

};

galera = {

wsrep_on = "ON";

wsrep_debug = "NONE";

wsrep_retry_autocommit = "3";

wsrep_provider = "${pkgs.mariadb-galera}/lib/galera/libgalera_smm.so";

wsrep_cluster_address = "gcomm://galera_01,galera_02,galera_03";

wsrep_cluster_name = "galera";

wsrep_node_address = "galera_03";

wsrep_node_name = "galera_03";

wsrep_sst_method = "mariabackup";

wsrep_sst_auth = "repl_user:repl_pass";

binlog_format = "ROW";

enforce_storage_engine = "InnoDB";

innodb_autoinc_lock_mode = "2";

};

}

Добавляем файл mysql.nix в конфигурацию configuration.nix:

nano ~/works/nixops/deploy/labs-galera/galera1/configuration.nix

nano ~/works/nixops/deploy/labs-galera/galera2/configuration.nix

nano ~/works/nixops/deploy/labs-galera/galera3/configuration.nix

…

./services/mysql.nix

./services/netdata.nix

./hardware-configuration.nix

…

git diff

diff --git a/labs-galera/galera1/configuration.nix b/labs-galera/galera1/configuration.nix
index 058e56c..f585a71 100644
--- a/labs-galera/galera1/configuration.nix
+++ b/labs-galera/galera1/configuration.nix
@@ -3,6 +3,7 @@
     ./../../../config-defs/core.nix
     ./services/fail2ban.nix
     ./services/firefall-nft.nix
+    ./services/mysql.nix
     ./services/netdata.nix
     ./hardware-configuration.nix
     ./users.nix
diff --git a/labs-galera/galera2/configuration.nix b/labs-galera/galera2/configuration.nix
index 27987e7..89827f3 100644
--- a/labs-galera/galera2/configuration.nix
+++ b/labs-galera/galera2/configuration.nix
@@ -3,6 +3,7 @@
     ./../../../config-defs/core.nix
     ./services/fail2ban.nix
     ./services/firefall-nft.nix
+    ./services/mysql.nix
     ./services/netdata.nix
     ./hardware-configuration.nix
     ./users.nix
diff --git a/labs-galera/galera3/configuration.nix b/labs-galera/galera3/configuration.nix
index 93abbcd..7b3a248 100644
--- a/labs-galera/galera3/configuration.nix
+++ b/labs-galera/galera3/configuration.nix
@@ -3,6 +3,7 @@
     ./../../../config-defs/core.nix
     ./services/fail2ban.nix
     ./services/firefall-nft.nix
+    ./services/mysql.nix
     ./services/netdata.nix
     ./hardware-configuration.nix
     ./users.nix

diff --git a/labs-galera/galera1/configuration.nix b/labs-galera/galera1/configuration.nix

index 058e56c..f585a71 100644

--- a/labs-galera/galera1/configuration.nix

+++ b/labs-galera/galera1/configuration.nix

@@ -3,6 +3,7 @@

./../../../config-defs/core.nix

./services/fail2ban.nix

./services/firefall-nft.nix

+ ./services/mysql.nix

./services/netdata.nix

./hardware-configuration.nix

./users.nix

diff --git a/labs-galera/galera2/configuration.nix b/labs-galera/galera2/configuration.nix

index 27987e7..89827f3 100644

--- a/labs-galera/galera2/configuration.nix

+++ b/labs-galera/galera2/configuration.nix

@@ -3,6 +3,7 @@

./../../../config-defs/core.nix

./services/fail2ban.nix

./services/firefall-nft.nix

+ ./services/mysql.nix

./services/netdata.nix

./hardware-configuration.nix

./users.nix

diff --git a/labs-galera/galera3/configuration.nix b/labs-galera/galera3/configuration.nix

index 93abbcd..7b3a248 100644

--- a/labs-galera/galera3/configuration.nix

+++ b/labs-galera/galera3/configuration.nix

@@ -3,6 +3,7 @@

./../../../config-defs/core.nix

./services/fail2ban.nix

./services/firefall-nft.nix

+ ./services/mysql.nix

./services/netdata.nix

./hardware-configuration.nix

./users.nix

Добавляем изменения в git, но пока не сохраняем:

git add -A

Так как у нас установлен фаервол nftables, необходимо открыть порты для корректной работы кластера:

nano ~/works/nixops/deploy/labs-galera/galera1/services/firefall-nft.nix

nano ~/works/nixops/deploy/labs-galera/galera2/services/firefall-nft.nix

nano ~/works/nixops/deploy/labs-galera/galera3/services/firefall-nft.nix

...
          ct state invalid drop
          ct state {established, related} accept
        }
        set allow-mysql {
          type ipv4_addr
          flags interval
          elements = { 192.168.0.0/24 }
        }
        set mariadb-galera {
          type ipv4_addr
          elements = { galera_01, galera_02, galera_03 }
        }
...
          tcp dport { 22 } ct state new accept
          tcp dport { 19999 } ct state new accept
          tcp dport { 3306  } ip saddr @allow-mysql ct state new accept
          tcp dport { 3306  } ip saddr @mariadb-galera ct state new accept
          tcp dport { 4444, 4567, 4568 } ip saddr @mariadb-galera ct state new accept
          udp dport { 4567 } ip saddr @mariadb-galera ct state new accept
        }

...

ct state invalid drop

ct state {established, related} accept

}

set allow-mysql {

type ipv4_addr

flags interval

elements = { 192.168.0.0/24 }

}

set mariadb-galera {

type ipv4_addr

elements = { galera_01, galera_02, galera_03 }

}

...

tcp dport { 22 } ct state new accept

tcp dport { 19999 } ct state new accept

tcp dport { 3306 } ip saddr @allow-mysql ct state new accept

tcp dport { 3306 } ip saddr @mariadb-galera ct state new accept

tcp dport { 4444, 4567, 4568 } ip saddr @mariadb-galera ct state new accept

udp dport { 4567 } ip saddr @mariadb-galera ct state new accept

}

Где:

set allow-mysql { — указываем, с каких IP-адресов разрешен доступ к mysql серверу.
set mariadb-galera — здесь перечислены хосты нашего кластера.
tcp dport { 4444, 4567, 4568 } и udp dport { 4567 } — открываем порты, которые используются для репликации кластером MariaDB Galera.

Текущие изменения в фаерволе:

git diff

Снова добавляем изменения в git, но не сохраняем:

git add -A

Теперь применим изменения на наших удаленных системах. Для того чтобы при обновлении не развалить кластер MariaDB Galera во время перезапуска службы mysql, рекомендую обновлять удаленные системы по одной за раз. Для этого в утилите ‘nixops’ есть опция —include, которая позволяет указать, с какой удаленной системой нам работать:

nixops deploy -d labs-galera --include galera1

building all machine configurations...
unpacking 'https://github.com/nix-community/NUR/archive/master.tar.gz'...
these derivations will be built:
  /nix/store/30dj3jh5i4y1pj2lrl0fvg3kwqwfp4v4-unit-script-mysql-pre-start.drv
  /nix/store/ny0pm6p1x5vimilmf7z6m9kp8369abja-extra-hosts.drv
  /nix/store/73mcyq5yxa2c1vwxm3yvpyavfi7xa17w-hosts.drv
  /nix/store/75sfizzpb58k0hq96zh7qnq537h8mpyk-users-groups.json.drv
...
building '/nix/store/gvifdl0gli22fajm2xb4khp6x71qb796-nixos-system-vm11-galera1-20.09pre238361.33548111764.drv'...
building '/nix/store/xrixzd6b7app56hxybss42wxdxa2m1zk-nixops-machines.drv'...
galera1> copying closure...
galera1> copying path '/nix/store/ppip01szl98s4cvqvy13pg2i4x0ba9wv-mariadb-server-10.4.13-man' from 'https://cache.nixos.org'...
galera1> copying path '/nix/store/al4qgq2gv0nl98ln7wdn79hmlxbk0drb-perl5.30.3-Capture-Tiny-0.48' from 'https://cache.nixos.org'...
galera1> copying path '/nix/store/g518g1sja3mr3zya4ngr2bh25kmkvdgm-check-0.15.0' from 'https://cache.nixos.org'...
...
galera1> reloading user units for rebrain...
galera1>           ::::.    ':::::     ::::'           rebrain@vm11-galera1
galera1>           ':::::    ':::::.  ::::'            OS: NixOS 20.09pre238361.33548111764 (Nightingale)
galera1>             :::::     '::::.:::::             Kernel: x86_64 Linux 5.7.15-hardened
galera1>       .......:::::..... ::::::::              Uptime: 58m
galera1>      ::::::::::::::::::. ::::::    ::::.      Packages: 1214
galera1>     ::::::::::::::::::::: :::::.  .::::'      Shell: sh
galera1>            .....           ::::' :::::'       Disk: 3,1G / 16G (21%)
galera1>           :::::            '::' :::::'        CPU: Intel Core (Haswell, no TSX, IBRS) @ 2x 2.195GHz
galera1>  ........:::::               ' :::::::::::.   GPU: Red Hat, Inc. QXL paravirtual graphic card (rev 05)
galera1> :::::::::::::                 :::::::::::::   RAM: 441MiB / 1993MiB
galera1>  ::::::::::: ..              :::::
galera1>      .::::: .:::            :::::
galera1>     .:::::  :::::          '''''    .....
galera1>     :::::   ':::::.  ......:::::::::::::'
galera1>      :::     ::::::. ':::::::::::::::::'
galera1>             .:::::::: '::::::::::
galera1>            .::::''::::.     '::::.
galera1>           .::::'   ::::.     '::::.
galera1>          .::::      ::::      '::::.
galera1> setting up tmpfiles
galera1> reloading the following units: dbus.service, nftables.service
galera1> starting the following units: nscd.service
galera1> the following new units were started: mysql.service
galera1> activation finished successfully
labs-galera> deployment finished successfully
Time: 0h:00m:58s

building all machine configurations...

unpacking 'https://github.com/nix-community/NUR/archive/master.tar.gz'...

these derivations will be built:

/nix/store/30dj3jh5i4y1pj2lrl0fvg3kwqwfp4v4-unit-script-mysql-pre-start.drv

/nix/store/ny0pm6p1x5vimilmf7z6m9kp8369abja-extra-hosts.drv

/nix/store/73mcyq5yxa2c1vwxm3yvpyavfi7xa17w-hosts.drv

/nix/store/75sfizzpb58k0hq96zh7qnq537h8mpyk-users-groups.json.drv

...

building '/nix/store/gvifdl0gli22fajm2xb4khp6x71qb796-nixos-system-vm11-galera1-20.09pre238361.33548111764.drv'...

building '/nix/store/xrixzd6b7app56hxybss42wxdxa2m1zk-nixops-machines.drv'...

galera1> copying closure...

galera1> copying path '/nix/store/ppip01szl98s4cvqvy13pg2i4x0ba9wv-mariadb-server-10.4.13-man' from 'https://cache.nixos.org'...

galera1> copying path '/nix/store/al4qgq2gv0nl98ln7wdn79hmlxbk0drb-perl5.30.3-Capture-Tiny-0.48' from 'https://cache.nixos.org'...

galera1> copying path '/nix/store/g518g1sja3mr3zya4ngr2bh25kmkvdgm-check-0.15.0' from 'https://cache.nixos.org'...

...

galera1> reloading user units for rebrain...

galera1> ::::. '::::: ::::' rebrain@vm11-galera1

galera1> '::::: ':::::. ::::' OS: NixOS 20.09pre238361.33548111764 (Nightingale)

galera1> ::::: '::::.::::: Kernel: x86_64 Linux 5.7.15-hardened

galera1> .......:::::.…. :::::::: Uptime: 58m

galera1> ::::::::::::::::::. :::::: ::::. Packages: 1214

galera1> ::::::::::::::::::::: :::::. .::::' Shell: sh

galera1> ..... ::::' :::::' Disk: 3,1G / 16G (21%)

galera1> ::::: '::' :::::' CPU: Intel Core (Haswell, no TSX, IBRS) @ 2x 2.195GHz

galera1> ........::::: ' :::::::::::. GPU: Red Hat, Inc. QXL paravirtual graphic card (rev 05)

galera1> ::::::::::::: ::::::::::::: RAM: 441MiB / 1993MiB

galera1> ::::::::::: .. :::::

galera1> .::::: .::: :::::

galera1> .::::: ::::: ''''' .….

galera1> ::::: ':::::. .…..:::::::::::::'

galera1> ::: ::::::. ':::::::::::::::::'

galera1> .:::::::: '::::::::::

galera1> .::::''::::. '::::.

galera1> .::::' ::::. '::::.

galera1> .:::: :::: '::::.

galera1> setting up tmpfiles

galera1> reloading the following units: dbus.service, nftables.service

galera1> starting the following units: nscd.service

galera1> the following new units were started: mysql.service

galera1> activation finished successfully

labs-galera> deployment finished successfully

Time: 0h:00m:58s

Первая удаленная система готова, настраиваем остальные по порядку:

nixops deploy -d labs-galera --include galera2

nixops deploy -d labs-galera --include galera3

Проверим состояние кластера MariaDB Galera:

nixops ssh-for-each -d labs-galera --include galera1 -- "mysql -N -e \"show status where variable_name in ('wsrep_cluster_size','wsrep_local_state_comment');\""

galera1> wsrep_local_state_comment Synced

galera1> wsrep_cluster_size 3

Как мы видим, кластер поднялся и синхронизировался. Теперь на первом хосте прописываем полный адрес кластера gcomm://galera_01,galera_02,galera_03:

nano ~/works/nixops/deploy/labs-galera/galera1/services/mysql.nix

git diff

index 1ea886f..2f613fc 100644
--- a/labs-galera/galera1/services/mysql.nix
+++ b/labs-galera/galera1/services/mysql.nix
@@ -27,7 +27,7 @@
         wsrep_debug = "NONE";
         wsrep_retry_autocommit = "3";
         wsrep_provider = "${pkgs.mariadb-galera}/lib/galera/libgalera_smm.so";
-        wsrep_cluster_address = "gcomm://";
+        wsrep_cluster_address = "gcomm://galera_01,galera_02,galera_03";
         wsrep_cluster_name = "galera";
         wsrep_node_address = "galera_01";
         wsrep_node_name = "galera_01";

index 1ea886f..2f613fc 100644

--- a/labs-galera/galera1/services/mysql.nix

+++ b/labs-galera/galera1/services/mysql.nix

@@ -27,7 +27,7 @@

wsrep_debug = "NONE";

wsrep_retry_autocommit = "3";

wsrep_provider = "${pkgs.mariadb-galera}/lib/galera/libgalera_smm.so";

- wsrep_cluster_address = "gcomm://";

+ wsrep_cluster_address = "gcomm://galera_01,galera_02,galera_03";

wsrep_cluster_name = "galera";

wsrep_node_address = "galera_01";

wsrep_node_name = "galera_01";

Применяем изменение на удаленной машине:

nixops deploy -d labs-galera --include galera1

Добавляем изменения в git и делаем коммит:

git add -A

git commit -m "labs-galera: init mariadb galera cluster"

[master 3106ccd] labs-galera: init mariadb galera cluster
 9 files changed, 168 insertions(+)
 create mode 100644 labs-galera/galera1/services/mysql.nix
 create mode 100644 labs-galera/galera2/services/mysql.nix
 create mode 100644 labs-galera/galera3/services/mysql.nix

[master 3106ccd] labs-galera: init mariadb galera cluster

9 files changed, 168 insertions(+)

create mode 100644 labs-galera/galera1/services/mysql.nix

create mode 100644 labs-galera/galera2/services/mysql.nix

create mode 100644 labs-galera/galera3/services/mysql.nix

ще мы можем добавить мониторинг нашего кластера с помощью утилиты netdata. Для этого приводим содержимое файла netdata.nix к такому виду:

nano ~/works/nixops/deploy/labs-galera/galera1/services/netdata.nix

{
  services.netdata = {
    enable = true;
    python = {
      enable = true;
      extraPackages = ps: [
        ps.mysqlclient
      ];
    };
  };

  environment.etc."netdata/python.d/mysql.conf".text = ''
    update_every: 1
    local:
      user    : 'netdata'
      pass    : 'netdata_pass'
      socket  : '/run/mysqld/mysqld.sock'
  '';
}

{

services.netdata = {

enable = true;

python = {

enable = true;

extraPackages = ps: [

ps.mysqlclient

];

};

environment.etc."netdata/python.d/mysql.conf".text = ''

update_every: 1

local:

user : 'netdata'

pass : 'netdata_pass'

socket : '/run/mysqld/mysqld.sock'

'';

}

Где:

services.netdata.python.enable — активирует плагины на основе python.
services.netdata.python.extraPackages = ps: [ ps.mysqlclient ]; — добавляет утилиту ps.mysqlclient, которая выполняет мониторинг mysql.
environment.etc.»netdata/python.d/mysql.conf».text — создает файл /etc/netdata/python.d/mysql.conf с конфигурацией mysql плагина netdata.

Копируем измененный файл на другие системы:

cp -f ~/works/nixops/deploy/labs-galera/galera1/services/netdata.nix ~/works/nixops/deploy/labs-galera/galera2/services/netdata.nix

cp -f ~/works/nixops/deploy/labs-galera/galera1/services/netdata.nix ~/works/nixops/deploy/labs-galera/galera3/services/netdata.nix

Применим изменения на удаленных системах поочередно:

nixops deploy -d labs-galera --include galera1

nixops deploy -d labs-galera --include galera2

nixops deploy -d labs-galera --include galera3

Добавляем изменения в git и делаем коммит:

git add -A

git commit -m "netdata: add mysql monitoring"

[master 61fa857] netdata: add mysql monitoring

3 files changed, 42 insertions(+)

В итоге мы настроили кластер MariaDB Galera с помощью утилиты nixops.

Centos

nixops — настраиваем кластер mariadb galera

Установка удаленных систем

Переходим к MariaDB Galera

https://github.com/midnight47/

Апрель 2024
Пн	Вт	Ср	Чт	Пт	Сб	Вс
1	2	3	4	5	6	7
8	9	10	11	12	13	14
15	16	17	18	19	20	21
22	23	24	25	26	27	28
29	30