dovecot - Mar 2021 - dovecot director and keepalived

On 15/3/2021 9:11 ?.?., Aki Tuomi wrote:
>> On 15/03/2021 20:54 Paterakis E. Ioannis <jpat at uoc.gr> wrote:
>>
>>   
>> On 15/3/2021 6:09 ?.?., Steven Varco wrote:
>>> Hi John
>>>
>>> Thanks for you input.
>>>
>>> So you basically state that (?physically?) separating the director
servers from keepalive/haproxy servers is the only option?
>>> I would like to avoid setting up two additional machines for that
whenever possible, as any node more in the chain potentially is another point of
failure? ;)
>> Nope, it's not the only option. You can always have all three
daemons
>> (keepalived/haproxy/director) on each machine. Keepalived will handle
>> the floating ip job, haproxies will have no problems with the floating
>> ip, the directors will always be binded to the static ips of the
>> machines and have their setup in the haproxies. That's all.
>>
>> But, if you plan to make a Highly available environment, u have to
>> consider splitting your services to different VMs, and them to
different
>> hypervisors in order to be as Highly available as you can....
>>
>> John
> The point of dovecot director is that it acts as a proxy that always routes
users to same backend. You can use keepalived, if it supports external commands,
to maybe tell director which backends are up / down.
It's not keepalived's work to tell the directors which backend is 
up/down. You can use poolmon for that. keepalived will make sure the 
floating ip will always be assigned on an alive haproxy. Then it's 
haproxies' work to check the aliveness of directors. Then It's Directors
job to assign the users to the same dovecot backend all the time, and so 
on....

Don't mix things.

J

On 03/15/2021 8:43 PM, Paterakis E. Ioannis wrote:
> It's not keepalived's work to tell the directors which backend is 
> up/down. You can use poolmon for that. keepalived will make sure the 
> floating ip will always be assigned on an alive haproxy. Then it's 
> haproxies' work to check the aliveness of directors. Then It's
Directors
> job to assign the users to the same dovecot backend all the time, and so 
> on....
What is the purpose of HAProxy in this director setup? It seems like an 
unecessary extra layer of proxying in your example.

We run a setup with keepalived directors, and a bunch of dovecot IMAP 
servers, and this works well.

The directors have two IPs each, one static and one floating 
(keepalived). The IPs listed in the "director_servers" setting are the
static IPs. The floating IPs are listed in DNS.

If you simply configure dovecot to bind to all interfaces, and instead 
use iptables to limit IMAP/POP/director connections to the interfaces 
you want, there is no need to set `net.ipv4.ip_nonlocal_bind=1`.

With all that said, I do agree that there should be a way to explicitly 
set the director's announce/listen address, instead of using the 
net_try_bind() method.

If you need this feature, I doubt it would be very hard to patch by 
adding a new configuration option, and then modifying this code to check 
said option value, and use it (if present) instead of trying to 
determine the IP:

https://github.com/dovecot/core/blob/fb6aa64435e0ffd66b81cd4895127187f28fa20b/src/director/director.c#L86

- Eirik