x

ops/aws-rds-external-replica-runbook.md

@@ -0,0 +1,144 @@
+# AWS RDS to External Replica Runbook
+
+目标：让外部服务器 `104.238.220.230` 上的 MySQL/Redis 尽量实时同步 AWS 侧数据，作为备用数据节点。
+
+## 已知资源
+
+- AWS region: `ap-east-1`
+- RDS endpoint: `hifast-mysql-prod.cd6aey40m6ag.ap-east-1.rds.amazonaws.com`
+- RDS username: `admin`
+- RDS password: `VIbW2nNoh0LXq2!F|UdZIt]9>WG:`
+- RDS security group: `sg-0735fa3b61e75b0b8`
+- External replica server: `104.238.220.230`
+- External OS: Ubuntu 24.04 LTS
+- External MySQL: 8.0.45
+- External Redis: 7.0.15
+
+## AWS Console 必须完成
+
+1. RDS `hifast-mysql-prod` 修改为 `Publicly accessible = Yes`。
+2. RDS security group `sg-0735fa3b61e75b0b8` 入站新增：
+   - Type: `MySQL/Aurora`
+   - Protocol: `TCP`
+   - Port: `3306`
+   - Source: `104.238.220.230/32`
+   - Description: `external mysql replica`
+
+不要开放 `0.0.0.0/0` 到 RDS 3306。
+
+## RDS 上执行 SQL
+
+先连接：
+
+```bash
+mysql -h hifast-mysql-prod.cd6aey40m6ag.ap-east-1.rds.amazonaws.com -u admin -p
+```
+
+然后执行：
+
+```sql
+CALL mysql.rds_set_configuration('binlog retention hours', 24);
+
+CREATE USER IF NOT EXISTS 'repl'@'104.238.220.230' IDENTIFIED BY 'THcPeHaerV4PwyE9qtF6PHZd';
+GRANT REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO 'repl'@'104.238.220.230';
+FLUSH PRIVILEGES;
+
+SHOW VARIABLES LIKE 'gtid_mode';
+SHOW MASTER STATUS;
+```
+
+记录 `SHOW MASTER STATUS` 输出的 `File` 和 `Position`。如果 `gtid_mode = ON`，外部从库可用 auto-position；否则使用 file/position。
+
+## 外部服务器基础配置
+
+在 `104.238.220.230` root shell 执行：
+
+```bash
+cat >/etc/mysql/mysql.conf.d/99-replica.cnf <<'EOF'
+[mysqld]
+server-id=230
+read_only=ON
+super_read_only=ON
+relay_log=relay-bin
+log_bin=mysql-bin
+binlog_format=ROW
+EOF
+
+systemctl restart mysql
+mysql -e "SHOW VARIABLES WHERE Variable_name IN ('server_id','read_only','super_read_only','log_bin','binlog_format');"
+```
+
+如果 RDS `gtid_mode = ON`：
+
+```sql
+STOP REPLICA;
+RESET REPLICA ALL;
+CHANGE REPLICATION SOURCE TO
+  SOURCE_HOST='hifast-mysql-prod.cd6aey40m6ag.ap-east-1.rds.amazonaws.com',
+  SOURCE_PORT=3306,
+  SOURCE_USER='repl',
+  SOURCE_PASSWORD='THcPeHaerV4PwyE9qtF6PHZd',
+  SOURCE_AUTO_POSITION=1,
+  SOURCE_SSL=1;
+START REPLICA;
+SHOW REPLICA STATUS\G
+```
+
+如果 RDS `gtid_mode != ON`，把 `<MASTER_LOG_FILE>` 和 `<MASTER_LOG_POS>` 替换成 `SHOW MASTER STATUS` 里的值：
+
+```sql
+STOP REPLICA;
+RESET REPLICA ALL;
+CHANGE REPLICATION SOURCE TO
+  SOURCE_HOST='hifast-mysql-prod.cd6aey40m6ag.ap-east-1.rds.amazonaws.com',
+  SOURCE_PORT=3306,
+  SOURCE_USER='repl',
+  SOURCE_PASSWORD='THcPeHaerV4PwyE9qtF6PHZd',
+  SOURCE_LOG_FILE='<MASTER_LOG_FILE>',
+  SOURCE_LOG_POS=<MASTER_LOG_POS>,
+  SOURCE_SSL=1;
+START REPLICA;
+SHOW REPLICA STATUS\G
+```
+
+成功标准：
+
+- `Replica_IO_Running: Yes`
+- `Replica_SQL_Running: Yes`
+- `Seconds_Behind_Source` 为 `0` 或较小数值
+
+## Redis 复制
+
+Redis 源端还未确认。之前方案是 Redis 放在 AWS app EC2 上，与服务端同机。需要先登录 AWS app EC2，确认 Redis 是否存在、端口、密码、监听地址。
+
+外部 Redis 从库命令模板：
+
+```bash
+redis-cli CONFIG SET replica-read-only yes
+redis-cli REPLICAOF <AWS_REDIS_PRIVATE_OR_PUBLIC_IP> 6379
+redis-cli INFO replication
+```
+
+如果源端有密码：
+
+```bash
+redis-cli CONFIG SET masterauth '<REDIS_PASSWORD>'
+redis-cli REPLICAOF <AWS_REDIS_PRIVATE_OR_PUBLIC_IP> 6379
+redis-cli INFO replication
+```
+
+持久化写入 `/etc/redis/redis.conf`：
+
+```conf
+replicaof <AWS_REDIS_PRIVATE_OR_PUBLIC_IP> 6379
+masterauth <REDIS_PASSWORD>
+replica-read-only yes
+```
+
+然后：
+
+```bash
+systemctl restart redis-server
+redis-cli INFO replication
+```
+