mirror of
https://github.com/OPCFoundation/UA-.NETStandard.git
synced 2026-10-26 04:19:53 +08:00
112 lines
3.9 KiB
YAML
112 lines
3.9 KiB
YAML
# Transparent redundancy: two replicas present ONE logical OPC UA server behind a
|
|
# single virtual endpoint.
|
|
#
|
|
# Both replicas share one ApplicationUri and one ApplicationInstanceCertificate
|
|
# (seeded into a shared PKI volume by server-a, then reused by server-b), and
|
|
# mirror address-space + session state by CRDT gossip (HA_MODE=aa,
|
|
# REDUNDANCY_MODE=transparent). An nginx TCP load balancer publishes the single
|
|
# virtual endpoint; each replica advertises that same endpoint URL (HA_HOST=lb)
|
|
# while binding to all interfaces in its own container, so discovery and
|
|
# CreateSession echo the one endpoint the client actually uses.
|
|
#
|
|
# When a replica fails, the load balancer routes the next connection to the
|
|
# survivor; because the session is mirrored, a token-reuse reconnect resumes it
|
|
# transparently on the survivor (full ActivateSession re-check still applies).
|
|
#
|
|
# The build context is the repository root. Run from the repo root:
|
|
# docker compose -f samples/RedundantServer/Transparent/docker-compose.yml up --build
|
|
#
|
|
# Single virtual OPC UA endpoint on the host: opc.tcp://localhost:62543/RedundantServer
|
|
#
|
|
# NOTE: this sample connects with SecurityMode None, so the per-replica cert race
|
|
# on first start is benign here. A SECURED transparent deployment must PRE-PROVISION
|
|
# the single shared ApplicationInstanceCertificate to every replica (for example a
|
|
# Kubernetes Secret / KMS), never let each replica self-generate one.
|
|
|
|
services:
|
|
server-a:
|
|
build:
|
|
context: ../../..
|
|
dockerfile: samples/RedundantServer/Dockerfile
|
|
image: opcua-redundant-server
|
|
hostname: server-a
|
|
environment:
|
|
# Advertise the shared virtual endpoint (the load balancer host). The host
|
|
# is a DNS name, so the listener binds to all interfaces in this container
|
|
# while returning opc.tcp://lb:62543/... to clients.
|
|
HA_HOST: lb
|
|
HA_NODE_ID: replica-a
|
|
HA_MODE: aa
|
|
REDUNDANCY_MODE: transparent
|
|
# Shared logical identity: every replica MUST use the same ApplicationUri
|
|
# (CreateSession validates the client-supplied serverUri against it) and the
|
|
# same certificate subject.
|
|
HA_APPLICATION_URI: urn:OPCFoundation:RedundantServer:transparent
|
|
HA_SUBJECT_NAME: "CN=RedundantServer, O=OPC Foundation, DC=lb"
|
|
HA_PKI_ROOT: /shared/pki
|
|
HA_GOSSIP_PORT: "4840"
|
|
HA_GOSSIP_PEERS: server-b:4840
|
|
command: ["--port", "62543"]
|
|
volumes:
|
|
- shared-pki:/shared/pki
|
|
# server-a seeds the shared certificate; report healthy once the PKI store is
|
|
# populated so server-b starts afterwards and reuses the same certificate.
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "test -n \"$(ls -A /shared/pki 2>/dev/null)\""]
|
|
interval: 3s
|
|
timeout: 2s
|
|
retries: 20
|
|
|
|
server-b:
|
|
build:
|
|
context: ../../..
|
|
dockerfile: samples/RedundantServer/Dockerfile
|
|
image: opcua-redundant-server
|
|
hostname: server-b
|
|
environment:
|
|
HA_HOST: lb
|
|
HA_NODE_ID: replica-b
|
|
HA_MODE: aa
|
|
REDUNDANCY_MODE: transparent
|
|
HA_APPLICATION_URI: urn:OPCFoundation:RedundantServer:transparent
|
|
HA_SUBJECT_NAME: "CN=RedundantServer, O=OPC Foundation, DC=lb"
|
|
HA_PKI_ROOT: /shared/pki
|
|
HA_GOSSIP_PORT: "4840"
|
|
HA_GOSSIP_PEERS: server-a:4840
|
|
command: ["--port", "62543"]
|
|
volumes:
|
|
- shared-pki:/shared/pki
|
|
depends_on:
|
|
server-a:
|
|
condition: service_healthy
|
|
|
|
lb:
|
|
image: nginx:1.27-alpine
|
|
hostname: lb
|
|
depends_on:
|
|
- server-a
|
|
- server-b
|
|
volumes:
|
|
- ./nginx.conf:/etc/nginx/nginx.conf:ro
|
|
ports:
|
|
# The single virtual OPC UA endpoint exposed to clients on the host.
|
|
- "62543:62543"
|
|
|
|
client:
|
|
build:
|
|
context: ../../..
|
|
dockerfile: samples/RedundantClient/Dockerfile
|
|
image: opcua-redundant-client
|
|
depends_on:
|
|
- lb
|
|
command:
|
|
- "--server"
|
|
- "opc.tcp://lb:62543/RedundantServer"
|
|
- "--autoaccept"
|
|
- "--nosecurity"
|
|
- "--duration"
|
|
- "00:10:00"
|
|
|
|
volumes:
|
|
shared-pki:
|