Instalasi klaster MariaDB 10.4 pada CentOS 8¶

#!/bin/bash
set -eux

USERNAME=deploy
ENCRYPTED_ROOT_PW="$(grep root /etc/shadow | cut --delimiter=: --fields=2)"
HOME_DIRECTORY="$(eval echo /home/${USERNAME})"
FONTS_DIRECTORY=${HOME_DIRECTORY}/.local/share/fonts

dnf update -y
dnf install -y epel-release
dnf install -y \
  fail2ban \
  git-core \
  htop \
  nano \
  screen \
  tree \
  unzip \
  wget \
  zsh

useradd --create-home --shell $(which zsh) --groups wheel "${USERNAME}"

echo "${USERNAME} ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers.d/${USERNAME}

if [ "${ENCRYPTED_ROOT_PW}" != "*" ]; then
    echo "${USERNAME}:${ENCRYPTED_ROOT_PW}" | chpasswd --encrypted
    passwd --lock root
else
    passwd --delete "${USERNAME}"
fi

chage --lastday 0 "${USERNAME}"

# Create SSH directory for sudo user
mkdir --parents "${HOME_DIRECTORY}/.ssh"

cp /root/.ssh/authorized_keys "${HOME_DIRECTORY}/.ssh"

# Adjust SSH configuration ownership and permissions
chmod 0700 "${HOME_DIRECTORY}/.ssh"
chmod 0600 "${HOME_DIRECTORY}/.ssh/authorized_keys"

# Bebersih
dnf clean all
dnf autoremove -y

# Disable root SSH login with password
sed --in-place 's/^PermitRootLogin.*/PermitRootLogin prohibit-password/g' /etc/ssh/sshd_config
if sshd -t -q; then
    systemctl restart sshd
fi

# Setel zona waktu ke Jakarta
timedatectl set-timezone Asia/Jakarta && timedatectl

# Pembaruan otomatis hanya untuk keamanan
# TODO

# oh-my-zsh on steroid
git clone https://github.com/ohmyzsh/ohmyzsh.git "${HOME_DIRECTORY}/.oh-my-zsh" && \
git clone https://github.com/zdharma/fast-syntax-highlighting.git  "${HOME_DIRECTORY}/.oh-my-zsh/custom/plugins/fast-syntax-highlighting" && \
git clone https://github.com/zsh-users/zsh-autosuggestions "${HOME_DIRECTORY}/.oh-my-zsh/custom/plugins/zsh-autosuggestions" && \
git clone https://github.com/zsh-users/zsh-completions "${HOME_DIRECTORY}/.oh-my-zsh/custom/plugins/zsh-completions" && \
git clone --depth=1 https://github.com/romkatv/powerlevel10k.git "${HOME_DIRECTORY}/.oh-my-zsh/custom/themes/powerlevel10k"
mkdir -p ${HOME_DIRECTORY}/.local/share/fonts && \
for mesloFonts in {'MesloLGS%20NF%20Regular','MesloLGS%20NF%20Bold','MesloLGS%20NF%20Italic','MesloLGS%20NF%20Bold%20Italic'}; do wget -P "$FONTS_DIRECTORY" https://github.com/romkatv/powerlevel10k-media/raw/master/$mesloFonts.ttf; done

cat << EOF > "${HOME_DIRECTORY}/.zshrc"
#
  export ZSH="${HOME_DIRECTORY}/.oh-my-zsh"
#
ZSH_THEME="powerlevel10k/powerlevel10k"
#
export LANGUAGE=en_US.UTF-8
export LANG=en_US.UTF-8
export LC_ALL=en_US.UTF-8
#
plugins=(
  colored-man-pages
  colorize
  command-not-found
  common-aliases
  dnf
  fast-syntax-highlighting
  git
  history
  sudo
  systemd
  yum
  zsh-autosuggestions
  zsh-completions
)

source \$ZSH/oh-my-zsh.sh
EOF

# HOME_DIRECTORY Permission
chown --recursive "${USERNAME}":"${USERNAME}" "${HOME_DIRECTORY}"

dnf remove do-agent
curl -sSL https://repos.insights.digitalocean.com/install.sh | bash

# eksekusi pada seluruh node
# https://mariadb.com/resources/blog/how-to-install-mariadb-on-rhel8-centos8/
wget https://downloads.mariadb.com/MariaDB/mariadb_repo_setup
chmod +x mariadb_repo_setup
./mariadb_repo_setup
#
yum install -y perl-DBI libaio libsepol lsof boost-program-options rsync policycoreutils-python-utils
yum install -y --repo="mariadb-main" MariaDB-server
#
systemctl enable --now mariadb.service
mysql_upgrade
# ubah sandi root
mysql_secure_installation

NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB
      SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!

In order to log into MariaDB to secure it, we'll need the current
password for the root user. If you've just installed MariaDB, and
haven't set the root password yet, you should just press enter here.

Enter current password for root (enter for none):
OK, successfully used password, moving on...

Setting the root password or using the unix_socket ensures that nobody
can log into the MariaDB root user without the proper authorisation.

You already have your root account protected, so you can safely answer 'n'.

Switch to unix_socket authentication [Y/n]
Enabled successfully!
Reloading privilege tables..
 ... Success!


You already have your root account protected, so you can safely answer 'n'.

Change the root password? [Y/n]
New password:
Re-enter new password:
Password updated successfully!
Reloading privilege tables..
 ... Success!


By default, a MariaDB installation has an anonymous user, allowing anyone
to log into MariaDB without having to have a user account created for
them.  This is intended only for testing, and to make the installation
go a bit smoother.  You should remove them before moving into a
production environment.

Remove anonymous users? [Y/n]
 ... Success!

Normally, root should only be allowed to connect from 'localhost'.  This
ensures that someone cannot guess at the root password from the network.

Disallow root login remotely? [Y/n]
 ... Success!

By default, MariaDB comes with a database named 'test' that anyone can
access.  This is also intended only for testing, and should be removed
before moving into a production environment.

Remove test database and access to it? [Y/n]
 - Dropping test database...
 ... Success!
 - Removing privileges on test database...
 ... Success!

Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.

Reload privilege tables now? [Y/n]
 ... Success!

Cleaning up...

All done!  If you've completed all of the above steps, your MariaDB
installation should now be secure.

Thanks for using MariaDB!

# variable
NAMA_KLASTER="db02-mariadb104"
IP_ADDRESS="10.20.30"
IP_NODE1="${IP_ADDRESS}.11"
IP_NODE2="${IP_ADDRESS}.12"
IP_NODE3="${IP_ADDRESS}.13"
NAMA_NODE1="${NAMA_KLASTER}-01"
NAMA_NODE2="${NAMA_KLASTER}-02"
NAMA_NODE3="${NAMA_KLASTER}-03"
#
cat << EOF > /etc/my.cnf.d/galera.cnf
[mysqld]
binlog_format=ROW
default-storage-engine=innodb
innodb_buffer_pool_size=128M
innodb_autoinc_lock_mode=2
bind-address=0.0.0.0
# Galera Provider Configuration
wsrep_on=ON
wsrep_provider=/usr/lib64/galera-4/libgalera_smm.so
wsrep_provider_options="gcache.size=128M; gcache.page_size=128M"
# Galera Cluster Configuration
wsrep_cluster_name="$NAMA_KLASTER"
wsrep_cluster_address="gcomm://$IP_NODE1,$IP_NODE2,$IP_NODE3"
# Galera Synchronization Configuration
wsrep_sst_method=rsync
# Galera node01 Configuration
wsrep_node_name="$NAMA_NODE3"
wsrep_node_address="$IP_NODE3"
EOF

# Galera node02 Configuration
wsrep_node_name="$NAMA_NODE2"
wsrep_node_address="$IP_NODE2"

# Galera node03 Configuration
wsrep_node_name="$NAMA_NODE3"
wsrep_node_address="$IP_NODE3"

## pada seluruh node
systemctl disable --now firewalld
semanage port -a -t mysqld_port_t -p tcp 4567
semanage port -a -t mysqld_port_t -p tcp 4568
semanage port -a -t mysqld_port_t -p tcp 4444
semanage port -a -t mysqld_port_t -p udp 4567
semanage permissive -a mysqld_t
systemctl stop mariadb

# pada node1
galera_new_cluster
# jalankan pada node1
mysql -u root -p -e 'CREATE DATABASE selinux;
CREATE TABLE selinux.selinux_policy (id INT NOT NULL AUTO_INCREMENT, PRIMARY KEY(id));
INSERT INTO selinux.selinux_policy VALUES ();'

# mulai kembali service mariadb pada node2 dan node3
systemctl start mariadb

# pada semua node, mulai dari node1 s/d node3, eksekusi masing-masing baris perintah di bawah secara bergantian, untuk membuat dan mengaktifkan SELinux policy
grep mysql /var/log/audit/audit.log | audit2allow -M Galera
semodule -i Galera.pp
semanage permissive -d mysqld_t

# node3,node2, terakhir node1
systemctl stop mariadb
# periksa pada node1
systemctl status mariadb

# eksekusi pada node1
galera_new_cluster
# kueri memeriksa ukuran klaster aktif
mysql -u root -p -e "SHOW STATUS LIKE 'wsrep_cluster_size'"

# eksekusi pada node2 dan node3 secara berurutan satu persatu
systemctl start mariadb
# kueri memeriksa ukuran klaster aktif
mysql -u root -p -e "SHOW STATUS LIKE 'wsrep_cluster_size'"

# eksekusi membuat dan mengisi pada data node1
mysql -u root -p -e 'CREATE DATABASE playground;
CREATE TABLE playground.equipment ( id INT NOT NULL AUTO_INCREMENT, type VARCHAR(50), quant INT, color VARCHAR(25), PRIMARY KEY(id));
INSERT INTO playground.equipment (type, quant, color) VALUES ("slide", 2, "blue");'

# eksekusi lihat isi tabel pada node2
mysql -u root -p -e 'SELECT * FROM playground.equipment;'
# eksekusi tambah data pada node2
mysql -u root -p -e 'INSERT INTO playground.equipment (type, quant, color) VALUES ("swing", 10, "yellow");'

# eksekusi lihat isi tabel pada node3
mysql -u root -p -e 'SELECT * FROM playground.equipment;'
# eksekusi tambah data pada node3
mysql -u root -p -e 'INSERT INTO playground.equipment (type, quant, color) VALUES ("seesaw", 3, "green");'

# eksekusi baca pada node1
mysql -u root -p -e 'SELECT * FROM playground.equipment;'