MeteorJS、Nginx、mongodb、iptables ...生産

 processManagement: fork: true pidFilePath: "/data/inmemory/mongod.pid" storage: dbPath: "/data/inmemory" journal: enabled: false #   # ..            indexBuildRetry: true wiredTiger: engineConfig: cacheSizeGB: 8 #   . # ,  ,  ,     , # ..  ,      #   ,        systemLog: destination: "file" path: "/var/log/mongodb/mongodb.log" #      . #     , #       #  ,     #    (,  ) logAppend: true quiet: false verbosity: 0 logRotate: "reopen" timeStampFormat: "iso8601-local" net: bindIp: 127.0.0.1 #        #  ,     —    port: 27000 # ,     , #           http: enabled: false #    http    JSONPEnabled: false RESTInterfaceEnabled: false ssl: # ssl        mode: disabled security: #       , #    ,    authorization: "enabled" keyFile: "/data/mongod-keyfile" #        javascriptEnabled: false #   JS  . replication: oplogSizeMB: 4096 #    oplog'. #         #          oplog'a. #     #     —     ? replSetName: "consulwar" enableMajorityReadConcern: false # ,      #        . operationProfiling: slowOpThresholdMs: 30 # ,     , #      #         mode: "slowOp" 

ほとんどの場合、設定が繰り返されますが、違いはほんの数箇所です。
しかし、便宜のために出発

 processManagement: fork: true pidFilePath: "/data/db/mongod.pid" storage: dbPath: "/data/db" journal: enabled: true #  ,     , #       indexBuildRetry: true wiredTiger: engineConfig: cacheSizeGB: 8 # ,    -  Primary , # secondary   ,     systemLog: destination: "file" path: "/var/log/mongodb/mongodb.log" logAppend: true quiet: false verbosity: 0 logRotate: "reopen" timeStampFormat: "iso8601-local" net: bindIp: 127.0.0.1 port: 27001 http: enabled: false JSONPEnabled: false RESTInterfaceEnabled: false ssl: mode: disabled security: authorization: "enabled" keyFile: "/data/mongod-keyfile" javascriptEnabled: false replication: oplogSizeMB: 4096 replSetName: "consulwar" enableMajorityReadConcern: false operationProfiling: slowOpThresholdMs: 30 mode: "slowOp" 

実際、違いはデータベースへの道だけで、使用するポートに依存します。

 processManagement: fork: true pidFilePath: "/secondary/data/db/mongod.pid" storage: dbPath: "/secondary/data/db" journal: enabled: true indexBuildRetry: true wiredTiger: engineConfig: cacheSizeGB: 8 systemLog: destination: "file" path: "/var/log/mongodb/mongodb.log" logAppend: true quiet: false verbosity: 0 logRotate: "reopen" timeStampFormat: "iso8601-local" net: bindIp: 127.0.0.1 port: 27002 http: enabled: false JSONPEnabled: false RESTInterfaceEnabled: false ssl: mode: disabled security: authorization: "enabled" keyFile: "/data/mongod-keyfile" javascriptEnabled: false replication: oplogSizeMB: 4096 replSetName: "consulwar" enableMajorityReadConcern: false operationProfiling: slowOpThresholdMs: 30 mode: "slowOp" 

サービス名の@は、パラメーターを使用して実行できることを意味します。
このスクリプトは、mongaを操作するために必要なすべてのOSパラメーターを設定します-便利です。

 [Unit] Description= Mongo Database on %i After=network.target [Service] Type=forking ExecStartPre=/bin/sh -c '/bin/echo never > /sys/kernel/mm/transparent_hugepage/enabled' ExecStartPre=/bin/sh -c '/bin/echo never > /sys/kernel/mm/transparent_hugepage/defrag' User=mongodb Group=mongodb PermissionsStartOnly=true ExecStart=/usr/bin/numactl --interleave=all /usr/bin/mongod --config /data/mongod-%i.conf LimitFSIZE=infinity LimitCPU=infinity LimitAS=infinity LimitNOFILE=64000 LimitNPROC=64000 TasksMax=infinity TasksAccounting=false [Install] WantedBy=multi-user.target 

外部サーバーに複製します（それ以外の場合、バックアップのポイントは何ですか？:-)）。
Mongaは同様の方法で外部サーバーにインストールする必要があります。
おおよその構成：

 processManagement: fork: true pidFilePath: "/data/db/mongod.pid" storage: dbPath: "/data/db" journal: enabled: true indexBuildRetry: false #    wiredTiger: engineConfig: cacheSizeGB: 0 #   systemLog: destination: "file" path: "/var/log/mongodb/mongodb.log" logAppend: true quiet: false verbosity: 0 logRotate: "reopen" timeStampFormat: "iso8601-local" net: bindIp: 222.222.222.222 #       port: 27000 http: enabled: false #    http,   JSONPEnabled: false RESTInterfaceEnabled: false ssl: mode: disabled security: authorization: "enabled" keyFile: "/data/mongod-keyfile" # mongod-keyfile     javascriptEnabled: false replication: oplogSizeMB: 0 replSetName: "consulwar" enableMajorityReadConcern: false operationProfiling: mode: "off" #       

バックアップサーバーのファイアウォールでは、アプリケーションサーバー/データベースのIPからのみ27000ポートへの接続を許可します。
同じこと-bindIpのアプリケーション/データベースサーバーでは、外部インターフェイス（外部サーバーのIP）を確認するように指示し、iptablesでは、バックアップ北IPからのみ27000-27002ポートへのアクセスを許可します。

レプリカを初期化/再初期化するとき、追加します

 { _id: 4, host: '222.222.222.222:27000', //  ,     arbiterOnly: false, buildIndexes: false, //       hidden: true, // !      priority: 0, //     slaveDelay: 0, //     , //   ,       " " votes: 0 //     } 

できた！ これで、データは外部バックアップにもリアルタイムで注入されます。これは非常に便利です。
アプリケーションが完全にクラッシュした場合、同じ方法でレプリカを初期化でき、バックアップから回復します。
私を信じて、これはmongodump / mongorestoreよりもはるかに高速です（個人的な推定によると、25〜100倍）。

 var settings = { ... }; //     settings.json   var instances = 10; //   ?    N-1 //  N —   var apps = []; for (var i = 0; i < instances; i++) { apps.push({ "script": "/home/consulwar/app/current/bundle/main.js", //    "exec_mode": "fork", // ..    Nginx,   "name": "consulwar", //      "env": { "ROOT_URL": "http://consulwar.ru/", //   "HTTP_FORWARDED_COUNT": 1, //      //    IP    "PORT": 3000 + i, //    3000 (3000, 3001, 3002...) "MONGO_URL": "mongodb://consulwar:37q4Re7m432dtDq@localhost:27000,localhost:27001,localhost:27002/consulwar?replicaSet=consulwar&readPreference=primary&authSource=consulwar", "MONGO_OPLOG_URL": "mongodb://consulwar:37q4Re7m432dtDq@localhost:27000,clocalhost:27001,localhost:27002/local?replicaSet=consulwar&authSource=consulwar", "METEOR_SETTINGS": settings } }); } module.exports = { apps : apps } 

 user www-data; # -   nginx worker_processes 6; #    worker_rlimit_nofile 65535; error_log /var/log/nginx/error.log warn; pid /var/run/nginx.pid; events { worker_connections 4000; # -    #       6 * 4000 = 24 000  #    } http { map $http_upgrade $connection_upgrade { #    - default upgrade; '' close; } include /etc/nginx/mime.types; default_type application/octet-stream; log_format main '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; access_log /var/log/nginx/access.log main; server_tokens off; sendfile on; #    tcp_nopush on; tcp_nodelay on; keepalive_timeout 65; gzip on; #  gzip gzip_comp_level 6; gzip_vary on; gzip_proxied any; gzip_buffers 16 8k; gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript; gzip_static on; #     .gz  . , main.js.gz     main.js gzip_http_version 1.1; gzip_disable "MSIE [1-6]\.(?!.*SV1)" proxy_connect_timeout 60; proxy_read_timeout 620; proxy_send_timeout 320; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; upstream backends { #ip_hash; # ,                least_conn; #  ,       #     #    10,   10  server 127.0.0.1:3000 weight=5 max_fails=3 fail_timeout=60; server 127.0.0.1:3001 weight=5 max_fails=3 fail_timeout=60; server 127.0.0.1:3002 weight=5 max_fails=3 fail_timeout=60; server 127.0.0.1:3003 weight=5 max_fails=3 fail_timeout=60; server 127.0.0.1:3004 weight=5 max_fails=3 fail_timeout=60; server 127.0.0.1:3005 weight=5 max_fails=3 fail_timeout=60; server 127.0.0.1:3006 weight=5 max_fails=3 fail_timeout=60; server 127.0.0.1:3007 weight=5 max_fails=3 fail_timeout=60; server 127.0.0.1:3008 weight=5 max_fails=3 fail_timeout=60; server 127.0.0.1:3009 weight=5 max_fails=3 fail_timeout=60; # ,        server 127.0.0.1:3100 backup; } #    ssl .      ssl_certificate /etc/letsencrypt/live/consulwar.ru/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/consulwar.ru/privkey.pem; ssl_dhparam /etc/ssl/certs/dhparam.pem; ssl_stapling on; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:DES-CBC3-SHA:!RC4:!aNULL:!eNULL:!MD5:!EXPORT:!EXP:!LOW:!SEED:!CAMELLIA:!IDEA:!PSK:!SRP:!SSLv:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA'; server { server_name consulwar.ru; #   80  443  listen 80; listen 443 ssl http2; #         location / { proxy_pass http://backends; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; proxy_set_header X-Forwarded-For $remote_addr; } #     nginx location ~* \.(jpg|jpeg|gif|ico|png)$ { root /home/consulwar/app/current/programs/web.browser/app; } #  css  js   ,    location ~* "^/[a-z0-9]{40}\.(css|js)$" { root /home/consulwar/app/current/programs/web.browser; } location ~ "^/packages" { root /home/consulwar/app/current/programs/web.browser; } #  ,        , #    . location /nginx_status { stub_status on; access_log off; allow 127.0.0.1; deny all; } #   SSL  location ~ "^/.well-known" { root /home/consulwar/app/current/programs/web.browser/app/.well-known; } } include /etc/nginx/conf.d/*.conf; client_max_body_size 128m; } 

 #!/bin/sh iptables-restore < /etc/firewall.conf ip6tables-restore < /etc/firewall6.conf 

 *filter :INPUT ACCEPT [193038:64086301] :FORWARD DROP [0:0] :OUTPUT ACCEPT [194475:60580083] -A INPUT -i lo -j ACCEPT #    -A INPUT -m state --state RELATED,ESTABLISHED -p all -j ACCEPT #    #  SSH -A INPUT -m state --state NEW -p tcp -m multiport --dport 355 -j ACCEPT #   Nginx -A INPUT -m state --state NEW -p tcp -m multiport --dport 80,443 -j ACCEPT #    ,    ,    -A INPUT -p tcp -m tcp -j TARPIT #    -A INPUT -p udp -j DROP COMMIT