How to Build a High-Availability (HA) Cluster on Bare Metal

 

When deploying mission-critical applications, a Single Point of Failure (SPOF) is a disaster waiting to happen. High Availability (HA) is one of the key architectural requirements for achieving uptime targets such as 99.99%, provided that the surrounding infrastructure is also redundant.

In this guide, we will architect a production-grade, 7-node High-Availability cluster from scratch using bare-metal servers connected via a Private VLAN.

Phase 1: Architecture Explanation (Visualizing the Setup)

Before touching the command line, you need a clear mental model of the topology. We are distributing our services across three isolated tiers:

• Floating IP (VIP): The single public IP address (203.0.113.100) that users hit.

• Tier 1 (Load Balancers): Running HAProxy and Keepalived in an Active/Passive setup.

• Tier 2 (Web Servers): Running Nginx and your application code.

• Tier 3 (Database Cluster): Running a MariaDB Galera Cluster for certification-based replication.

IP Addressing Scheme

Hostname	Role	Public IP	Private IP (VLAN)
VIP	Floating IP	203.0.113.100	-
LB-01	Load Balancer 1	203.0.113.101	10.0.0.10
LB-02	Load Balancer 2	203.0.113.102	10.0.0.11
WEB-01	Web Node 1	-	10.0.0.20
WEB-02	Web Node 2	-	10.0.0.21
DB-01	DB Node 1	-	10.0.0.30
DB-02	DB Node 2	-	10.0.0.31
DB-03	DB Node 3	-	10.0.0.32

Phase 2: OS & Network Preparation

Security and kernel tuning are critical for internal communication. On all Web and DB nodes, configure Uncomplicated Firewall (ufw) to allow traffic only from your Private VLAN (10.0.0.0/24):

Bash

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh

# Allow internal Web Traffic
sudo ufw allow from 10.0.0.0/24 to any port 80
sudo ufw allow from 10.0.0.0/24 to any port 443

# Allow internal Galera & MySQL Traffic
sudo ufw allow from 10.0.0.0/24 to any port 3306
sudo ufw allow from 10.0.0.0/24 to any port 4444
sudo ufw allow from 10.0.0.0/24 to any port 4567
sudo ufw allow from 10.0.0.0/24 to any port 4568

sudo ufw enable

To handle high network traffic, apply sysctl tuning:

Bash

cat <<EOF | sudo tee /etc/sysctl.d/99-ha-cluster.conf
# Allow HAProxy to bind to the floating IP
net.ipv4.ip_nonlocal_bind = 1
net.core.somaxconn = 65535
net.ipv4.tcp_max_syn_backlog = 65535
EOF

sudo sysctl --system

Phase 3: Setting Up the Database Cluster

We will set up a MariaDB Galera Cluster. It requires at least 3 nodes to maintain quorum. Install the required packages on all DB nodes:

Bash

sudo apt update
sudo apt install mariadb-server mariadb-client galera-4 mariadb-backup -y
sudo systemctl stop mariadb

Note: mariadb-backup is required for State Snapshot Transfers (SST) when new nodes join.

(For the complete database configuration, Nginx setup, and HAProxy/Keepalived Load Balancer auto-failover scripts, read the full tutorial below!)

🔗 Read the full step-by-step tutorial here: How to Build a High-Availability (HA) Cluster on Bare Metal with HAProxy, Keepalived & MariaDB Galera