Nginx : Use Stream module2024/11/08

Configure Nginx to use Stream module.
It's possible to proxy TCP, UDP (1.9.13 or later), UNIX-domain sockets requests.

This example is based on the environment like follows to proxy MariaDB requests to backend servers.

-----------+---------------------------+-----
           |                           |
           |10.0.0.31                  |
+----------+-----------+               |
|   [ www.srv.world ]  |               |
|        Nginx         |               |
+----------------------+               |
                                       |
------------+--------------------------+-----------
            |                          |           
            |10.0.0.51                 |10.0.0.52  
+-----------+----------+   +-----------+----------+
| [ node01.srv.world ] |   | [ node02.srv.world ] |
|       Mariadb#1      |   |       Mariadb#2      |
+----------------------+   +----------------------+

[1]	Configure Nginx.

[root@www ~]#

dnf -y install nginx-mod-stream

[root@www ~]#

vi /etc/nginx/nginx.conf

# add to last line
# [weight=*] means balancing weight

stream {
    upstream mariadb-backend {
        server 10.0.0.51:3306 weight=2;
        server 10.0.0.52:3306;
    }
    server {
        listen 3306;
        proxy_pass mariadb-backend;
    }
}

[root@www ~]#

systemctl reload nginx

[2]	If SELinux is enabled, change policy.

[root@www ~]#

setsebool -P httpd_can_network_connect on

[root@www ~]#

setsebool -P httpd_can_network_connect_db on

[root@www ~]#

vi nginx-stream.te

# create new

module nginx-stream 1.0;

require {
        type mysqld_port_t;
        type httpd_t;
        class tcp_socket name_bind;
}

#============= httpd_t ==============
allow httpd_t mysqld_port_t:tcp_socket name_bind;

[root@www ~]#

checkmodule -m -M -o nginx-stream.mod nginx-stream.te

[root@www ~]#

semodule_package --outfile nginx-stream.pp --module nginx-stream.mod

[root@www ~]#

semodule -i nginx-stream.pp

[3]	Verify it works fine to access to frontend Nginx server from any client computer.

[fedora@client ~]$ mysql -u serverworld -ppassword -h www.srv.world -e "show variables like 'hostname';"
+---------------+------------------+
| Variable_name | Value            |
+---------------+------------------+
| hostname      | node01.srv.world |
+---------------+------------------+
[fedora@client ~]$ mysql -u serverworld -ppassword -h www.srv.world -e "show variables like 'hostname';"
+---------------+------------------+
| Variable_name | Value            |
+---------------+------------------+
| hostname      | node01.srv.world |
+---------------+------------------+
[fedora@client ~]$ mysql -u serverworld -ppassword -h www.srv.world -e "show variables like 'hostname';"
+---------------+------------------+
| Variable_name | Value            |
+---------------+------------------+
| hostname      | node02.srv.world |
+---------------+------------------+
[fedora@client ~]$ mysql -u serverworld -ppassword -h www.srv.world -e "show variables like 'hostname';"
+---------------+------------------+
| Variable_name | Value            |
+---------------+------------------+
| hostname      | node01.srv.world |
+---------------+------------------+

Matched Content