# cat /etc/nginx/nginx.conf #user nobody; worker_processes 4; #error_log logs/error.log; #error_log logs/error.log notice; #error_log logs/error.log info; #pid logs/nginx.pid; events { worker_connections 40960; use epoll; } http { include mime.types; default_type application/octet-stream; #log_format main '$remote_addr - $remote_user [$time_local] "$request" ' # '$status $body_bytes_sent "$http_referer" ' # '"$http_user_agent" "$http_x_forwarded_for"'; #access_log logs/access.log main; access_log /dev/null; sendfile on; #tcp_nopush on; #keepalive_timeout 0; keepalive_timeout 65; #gzip on; upstream backend{ # server 172.16.0.6:80; server 10.0.0.68:80; server 10.0.0.69:80; } server { listen 80; server_name localhost; #charset koi8-r; #access_log logs/host.access.log main; # location / { # root html; # index index.html index.htm; # } access_log /dev/null; error_log /dev/null; location / { # proxy_pass $scheme://$host$request_uri; # proxy_set_header Host $http_host; # proxy_buffers 256 4k; # proxy_max_temp_file_size 0; # proxy_connect_timeout 30; # proxy_cache_valid 200 302 10m; # proxy_cache_valid 301 1h; # proxy_cache_valid any 1m; proxy_pass http://backend; proxy_redirect off; proxy_set_header Host $host; # proxy_set_header X-Real-IP $remote_addr; # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; client_max_body_size 10m; client_body_buffer_size 128k; proxy_connect_timeout 30; proxy_send_timeout 30; proxy_read_timeout 30; proxy_buffer_size 4k; proxy_buffers 256 4k; proxy_busy_buffers_size 64k; proxy_temp_file_write_size 64k; tcp_nodelay on; } #error_page 404 /404.html; # redirect server error pages to the static page /50x.html # error_page 500 502 503 504 /50x.html; location = /50x.html { root html; } } }
/etc/nginx/conf.d/
proxy_cache_path /www/cache keys_zone=www:128m; server { location / { proxy_pass http://example.net; proxy_cache www; proxy_cache_key $uri; proxy_cache_valid 200 302 60m; proxy_cache_valid 404 1m; } }
proxy_cache_valid 配置HTTP狀態碼與緩存時間
proxy_cache_valid any 1m; 任何內容緩存一分鐘 proxy_cache_valid 200 302 60m; 狀態200,302頁面緩存 60分鐘 proxy_cache_valid 404 1m; 狀態404頁面緩存1分鐘
http { proxy_cache_path /var/www/cache levels=1:2 keys_zone=my-cache:8m max_size=1000m inactive=600m; proxy_temp_path /var/www/cache/tmp; server { location / { proxy_pass http://example.net; proxy_cache mycache; proxy_cache_valid 200 302 60m; proxy_cache_valid 404 1m; } } }
location / { proxy_pass http://localhost; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_ignore_headers Set-Cookie; proxy_ignore_headers Cache-Control; proxy_cache_bypass $http_secret_header; add_header X-Cache-Status $upstream_cache_status; }
server { listen 80; server_name example.org; root /var/www; index index.html index.php; location ~* .+.(ico|jpg|gif|jpeg|css|js|flv|png|swf)$ { expires max; } location / { proxy_pass http://backend; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $http_host; proxy_cache cache; proxy_cache_key $host$request_uri; proxy_cache_valid 200 304 12h; proxy_cache_valid 302 301 12h; proxy_cache_valid any 1m; proxy_ignore_headers Cache-Control Expires; proxy_pass_header Set-Cookie; } }
proxy_cache_valid 200 302 10m; proxy_cache_valid 301 1h; proxy_cache_valid any 1m;
需求如下
http://www.example.com/images/logo.jpg => http://images.example.com/logo.jpg
如果直接 proxy_pass http://images.example.com; 的後果是http://images.example.com/images/logo.jpg,我們需要去掉images目錄,這裡使用rewrite /images/(.+)$ /$1 break;實現
location ^~ /images/ { rewrite /images/(.+)$ /$1 break; proxy_pass http://images.example.com; break; }
如果檔案不存在,那麼去指定的節點上尋找
location / { root /www; proxy_intercept_errors on; if (!-f $request_filename) { proxy_pass http://172.16.1.1; break; } } location / { root /www/images; proxy_intercept_errors on; if (!-f $request_filename) { proxy_pass http://172.16.1.2; break; } }
server { listen 80; server_name info.example.com; #charset koi8-r; access_log /var/log/nginx/info.example.com.access.log main; location / { root /www/example.com/info.example.com; index index.html index.htm; rewrite ^/$ http://www.example.com/; valid_referers none blocked *.example.com; if ($invalid_referer) { #rewrite ^(.*)$ http://www.example.com/cn/$1; return 403; } proxy_intercept_errors on; # proxy_set_header X-Real-IP $remote_addr; # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # proxy_set_header Host $host; # # proxy_cache one; # proxy_cache_valid 200 302 304 10m; # proxy_cache_valid 301 1h; # proxy_cache_valid any 1m; if ( $request_uri ~ "^/public/datas/(sge|cgse|futures|fx_price|gold_price|stock|bonds)\.xml$") { proxy_pass http://211.176.212.212$request_uri; break; } if (!-f $request_filename) { proxy_pass http://infoadmin.example.com; #proxy_pass http://backend; break; } } location ~ ^/index\.php$ { return 403; } location ~ ^/(config|include|crontab|/systemmanage)/ { deny all; break; } #error_page 404 /404.html; # redirect server error pages to the static page /50x.html # error_page 500 502 503 504 /50x.html; location = /50x.html { root /usr/share/nginx/html; } }
需求,在web目錄下索引靜態,如果不存在便進入proxy處理,通常proxy後面是tomcat等應用伺服器。
我們可以使用 try_files 與 proxy_pass 實現我們的需求
server { listen 80; server_name m.netkiller.cn; charset utf-8; access_log /var/log/nginx/m.netkiller.cn.access.log; location / { root /www/example.com/m.example.com; try_files $uri $uri/ @proxy; } location @proxy { proxy_pass http://127.0.0.1:8000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } #error_page 404 /404.html; # redirect server error pages to the static page /50x.html # error_page 500 502 503 504 /50x.html; location = /50x.html { root /usr/share/nginx/html; } # deny access to .htaccess files, if Apache's document root # concurs with nginx's one # #location ~ /\.ht { # deny all; #} location ~ ^/WEB-INF/ { deny all; } location ~ \.(html|js|css|jpg|png|gif|swf)$ { root /www/example.com/m.example.com; expires 1d; } location ~ \.(ico|fla|flv|mp3|mp4|wma|wmv|exe)$ { root /www/example.com/m.example.com; expires 7d; } location ~ \.flv { flv; } location ~ \.mp4$ { mp4; } location /module { root /www/example.com/m.example.com; } }
背景:nginx + tomcat 模式,nginx 開啟 SSI , Tomcat 動態頁面中輸出 SSI 標籤
# cat /etc/nginx/conf.d/www.netkiller.cn.conf server { listen 80; server_name www.netkiller.cn; charset utf-8; access_log /var/log/nginx/www.netkiller.cn.access.log; location / { #index index.html index.htm; proxy_pass http://127.0.0.1:8080; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } #error_page 404 /404.html; # redirect server error pages to the static page /50x.html # error_page 500 502 503 504 /50x.html; location = /50x.html { root /usr/share/nginx/html; } }
test.jsp 檔案
<%@ page language="java" import="java.util.*,java.text.SimpleDateFormat" pageEncoding="UTF-8"%> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <title>show time</title> </head> <body> <% Date date=new Date(); SimpleDateFormat ss=new SimpleDateFormat("yyyy-MM-dd HH:mm:ss"); String lgtime=ss.format(date); %> <center> <h1><%=lgtime%></h1> </center> <!--# set var="test" value="Hello netkiller!" --> <!--# echo var="test" --> </body> </html>
測試並查看源碼,你會看到SSI標籤
<!--# set var="test" value="Hello netkiller!" --> <!--# echo var="test" -->
解決方案
location / { ssi on; proxy_set_header Accept-Encoding ""; proxy_pass http://127.0.0.1:8080; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; }
再次測試,你將看不到SSI標籤,只能看到文本輸出Hello netkiller!
Proxy 通過IP地址訪問目的主機,如果目的主機是虛擬主機,你就需要告訴目的主機是那個域名。
proxy_set_header Host www.example.com;
proxy_set_header Host $server_name;
server { listen 80; server_name www.example.com; charset utf-8; access_log /var/log/nginx/www.example.com.access.log main; proxy_set_header Host $server_name; location / { proxy_pass http://154.21.16.57; } #error_page 404 /404.html; # redirect server error pages to the static page /50x.html # error_page 500 502 503 504 /50x.html; location = /50x.html { root /usr/share/nginx/html; } }
location / { root /var/www; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $http_host; proxy_redirect false; if ($request_uri ~* "\.(ico|css|js|gif|jpe?g|png)\?[0-9]+$") { expires max; break; } if (-f $request_filename) { break; } if (-f $request_filename/index.html) { rewrite (.*) $1/index.html break; } if (-f $request_filename.html) { rewrite (.*) $1.html break; } proxy_pass http://backend; }
proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header User-Agent "Mozilla/5.0 (compatible; MSIE 10.6; Windows NT 6.1; Trident/5.0; InfoPath.2; SLCC1; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 2.0.50727) 3gpp-gba UNTRUSTED/1.0"; proxy_set_header X-Forwarded-URI $request_uri;
有時用戶會設置自定義的 HTTP 頭信息,這些不符合 HTTP 的頭信息如果需要會被 proxy_pass 過濾並丟棄。
proxy_pass_request_headers off;
預設系統是開啟的
proxy_pass_request_headers on;
proxy_connect_timeout: 連結超時設置,後端伺服器連接的超時時間,發起握手等候響應超時時間。
proxy_read_timeout: 連接成功後,等候後端伺服器響應時間,其實已經進入後端的排隊之中等候處理,也可以說是後端伺服器處理請求的時間。
proxy_send_timeout: 後端伺服器數據回傳時間,就是在規定時間之內後端伺服器必須傳完所有的數據。
location / { proxy_pass http://127.0.0.1:8000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_connect_timeout 60s; proxy_read_timeout 300s; proxy_send_timeout 300s; }
/api/ 走代理,其他頁面走 Nginx
server { listen 443 ssl http2; server_name www.netkiller.cn netkiller.cn; ssl_certificate ssl/netkiller.cn.crt; ssl_certificate_key ssl/netkiller.cn.key; ssl_session_cache shared:SSL:20m; ssl_session_timeout 60m; charset utf-8; #access_log /var/log/nginx/host.access.log main; location / { root /opt/netkiller.cn/www.netkiller.cn; index index.html; } location ^~ /api/ { proxy_pass http://127.0.0.1:8080; proxy_http_version 1.1; proxy_set_header Host $host; break; } #error_page 404 /404.html; # redirect server error pages to the static page /50x.html # error_page 500 502 503 504 /50x.html; location = /50x.html { root /usr/share/nginx/html; } # deny access to .htaccess files, if Apache's document root # concurs with nginx's one # location ~ /\.ht { deny all; } }
127.0.0.1 api.example.com 172.16.0.10 api1.example.com 172.16.0.11 api2.example.com
upstream api.example.com { least_conn; server api1.example.com; server api2.example.com; } server { listen 80; server_name api.example.com; charset utf-8; access_log /var/log/nginx/api.example.com.access.log; location / { proxy_pass http://api.example.com; proxy_set_header X-Real-IP $remote_addr; #proxy_set_header Host $host; proxy_set_header Host api.example.com; } #error_page 404 /404.html; # redirect server error pages to the static page /50x.html # error_page 500 502 503 504 /50x.html; location = /50x.html { root /usr/share/nginx/html; } # proxy the PHP scripts to Apache listening on 127.0.0.1:80 # #location ~ \.php$ { # proxy_pass http://127.0.0.1; #} }
server { listen 80; server_name m.netkiller.cn; charset utf-8; access_log /var/log/nginx/m.netkiller.cn.access.log; location / { root /www/example.com/m.example.com; rewrite ^(.*)\;jsessionid=(.*)$ $1 break; try_files $uri $uri/ @proxy; } location @proxy { proxy_pass http://127.0.0.1:8000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } #error_page 404 /404.html; # redirect server error pages to the static page /50x.html # error_page 500 502 503 504 /50x.html; location = /50x.html { root /usr/share/nginx/html; } # deny access to .htaccess files, if Apache's document root # concurs with nginx's one # #location ~ /\.ht { # deny all; #} location ~ ^/WEB-INF/ { deny all; } location ~ \.(html|js|css|jpg|png|gif|swf)$ { root /www/example.com/m.example.com; expires 1d; } location ~ \.(ico|fla|flv|mp3|mp4|wma|wmv|exe)$ { root /www/example.com/m.example.com; expires 7d; } location ~ \.flv { flv; } location ~ \.mp4$ { mp4; } location /module { root /www/example.com/m.example.com; } }
上面的jsessionid處理方式
背景各種原因需要再Nginx前面再增加一層Nginx雖然需求很變態,本着學習的目的試了試。
這裡還使用了 http2 加速 nginx ssl http2 -> nginx ssl http2 -> Tomcat 8080
server { listen 443 ssl http2; server_name www.netkiller.cn; ssl_certificate ssl/netkiller.cn.crt; ssl_certificate_key ssl/netkiller.cn.key; # ssl_session_cache shared:SSL:1m; # ssl_session_timeout 5m; # ssl_ciphers HIGH:!aNULL:!MD5; # ssl_prefer_server_ciphers on; location / { proxy_buffers 16 4k; proxy_buffer_size 2k; proxy_pass https://www.netkiller.cn; proxy_pass_header Set-Cookie; add_header From www.netkiller.cn; proxy_set_header Cookie $http_cookie; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_cookie_domain www.netkiller.cn netkiller.cn; #proxy_cookie_path / "/; secure; HttpOnly"; proxy_set_header Accept-Encoding ""; proxy_ignore_client_abort on; } }
有幾點需要注意:
如果是443你需要掛在證書,需要透傳cookie給目的主機,否則你將無法支持Session,應用程序需要從 X-Forwarded-For 獲取IP地址。
下面是一個通過 proxy_pass 代理live800的案例,我們需要處理幾個地方:
Host頭處理,Cookie傳遞,替換原因頁面中的域名,替換檔案有html,css,xml,css,js
location ~ ^/k800 { #rewrite ^/live800/(.*) /$1 break; proxy_pass http://118.23.24.15; proxy_pass_header Set-Cookie; proxy_set_header Accept-Encoding ""; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host www.example.com; proxy_set_header Cookie $http_cookie; sub_filter_types text/html text/css text/xml text/css text/javascript; sub_filter 'www.example.com' '$host'; sub_filter_once off; }
server { listen 80; listen 443 ssl http2; server_name api.netkiller.cn; ssl_certificate ssl/netkiller.cn.crt; ssl_certificate_key ssl/netkiller.cn.key; ssl_session_cache shared:SSL:20m; ssl_session_timeout 60m; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; charset utf-8; access_log /var/log/nginx/api.netkiller.cn.access.log main; location / { proxy_pass http://127.0.0.1:7000; } location ^~ /api { add_header Access-Control-Allow-Origin *; add_header Access-Control-Allow-Headers Content-Type,Origin; add_header Access-Control-Allow-Methods GET,OPTIONS; proxy_pass http://other.example.com/api/; } }
通過 proxy 漢化 restful 介面返回的 json 字元串。
背景,有這樣一個需求,前端HTML5通過ajax與restful交互,ajax會顯示介面返回json數據,由於js做了混淆無法修改與restful交互的邏輯,但是json反饋結果需要漢化。
漢化前介面如下,返回message為 "message":"Full authentication is required to access this resource"
neo@netkiller ~/workspace/Developer/Python % curl http://api.netkiller.cn/restful/member/get/1.json {"timestamp":1505206067543,"status":401,"error":"Unauthorized","message":"Full authentication is required to access this resource","path":"/restful/member/get/1.json"}
建立一個代理伺服器,代理介於用戶和介面之間,ajax 訪問介面需要經過這個代理伺服器中轉。
增加 /etc/nginx/conf.d/api.netkiller.cn.conf 配置檔案
server { listen 80; server_name api.netkiller.cn; charset utf-8; location / { proxy_pass http://localhost:8443; proxy_http_version 1.1; proxy_set_header Host $host; sub_filter_types application/json; sub_filter 'Full authentication is required to access this resource' '用戶驗證錯誤'; sub_filter_once off; } }
所謂漢化就是字元串替換,使用nginx sub_filter 模組。
重新啟動 nginx 然後測試漢化效果
neo@netkiller ~/workspace/Developer/Python % curl http://api.netkiller.cn/restful/member/get/1.json {"timestamp":1505208931927,"status":401,"error":"Unauthorized","message":"用戶驗證錯誤","path":"/restful/member/get/1.json"}
現在我們看到效果是 "message":"用戶驗證錯誤"
server { listen 80; listen 443 ssl http2; server_name www.netkiller.cn netkiller.cn; ssl_certificate ssl/netkiller.cn.crt; ssl_certificate_key ssl/netkiller.cn.key; ssl_session_cache shared:SSL:20m; ssl_session_timeout 60m; charset utf-8; #access_log /var/log/nginx/host.access.log main; error_page 497 https://$host$uri?$args; if ($scheme = http) { return 301 https://$server_name$request_uri; } location ^~ /member/ { proxy_pass https://47.75.176.32:443; proxy_set_header Host www.netkiller.cn; break; } location / { root /opt/www.netkiller.cn; index index.html index.php; } #error_page 404 /404.html; # redirect server error pages to the static page /50x.html # error_page 500 502 503 504 /50x.html; location = /50x.html { root /usr/share/nginx/html; } # proxy the PHP scripts to Apache listening on 127.0.0.1:80 # #location ~ \.php$ { # proxy_pass http://127.0.0.1; #} # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000 # location ~ \.php$ { root html; fastcgi_pass 127.0.0.1:9000; fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME /opt/www.netkiller.cn$fastcgi_script_name; include fastcgi_params; } # deny access to .htaccess files, if Apache's document root # concurs with nginx's one # location ~ /\.ht { deny all; } }