From c49dcafc34679d173e7f00f64d15a8569805d6cd Mon Sep 17 00:00:00 2001 From: William Mantly Date: Thu, 8 Aug 2024 14:30:22 -0400 Subject: [PATCH] Fixed nginx conf issue --- ops/nginx_conf/nginx.conf | 51 ++++------- ops/nginx_conf/proxy.conf | 183 +++++++++++++++++--------------------- 2 files changed, 98 insertions(+), 136 deletions(-) diff --git a/ops/nginx_conf/nginx.conf b/ops/nginx_conf/nginx.conf index 0768169..a05fbd5 100644 --- a/ops/nginx_conf/nginx.conf +++ b/ops/nginx_conf/nginx.conf @@ -1,5 +1,5 @@ #user nobody; -worker_processes 8; +worker_processes 4; #error_log logs/error.log; #error_log logs/error.log notice; @@ -12,6 +12,7 @@ events { worker_connections 1024; } + http { client_max_body_size 4g; @@ -23,22 +24,10 @@ http { init_by_lua_block { auto_ssl = (require "resty.auto-ssl").new() - auto_ssl:set("storage_adapter", "resty.auto-ssl.storage_adapters.redis") + auto_ssl:set("storage_adapter", "resty.auto-ssl.storage_adapters.redis") auto_ssl:set("allow_domain", function(domain) - ngx.log(ngx.ERR, "!!!!!!!! nginx.conf allow_domain !!!!!!!!!! ", domain, ngx.ctx.toAllow) - return ngx.ctx.toAllow - end) - - auto_ssl:set("request_domain", function(ssl, ssl_options) - local json = require "cjson" - local redis = require "resty.redis" local socket = assert(require "socket.unix"()) - - local domain, err = ssl.server_name() - - ngx.log(ngx.ERR, "!!!!!! nginx.conf request_domain !!!!!!!", domain) - local function connect(path) assert(socket:settimeout(.1)) local status,err = pcall(function() assert(socket:connect(path)) end) @@ -47,21 +36,23 @@ http { end if not domain then - ngx.log(ngx.ERR, "no host header found") - ngx.exit(499) - return false + ngx.log(ngx.ERR, "no host header found") + ngx.exit(499) + return false end + local redis = require "resty.redis" local red = redis:new() + red:set_timeout(1000) -- 1 second local ok, err = red:connect("127.0.0.1", 6379) if not ok then - ngx.log(ngx.ERR, "failed to connect to redis: ", err) - return ngx.exit(598) + ngx.log(ngx.ERR, "failed to connect to redis: ", err) + return ngx.exit(598) end - local res, err = red:hgetall("proxy_Host_"..domain) + local res, err = red:hgetall("proxy_host_"..domain) local res = red:array_to_hash(res) if not res["ip"] then @@ -79,21 +70,13 @@ http { end if not res["ip"] then - ngx.say('The domain is not allowed on this server.') - ngx.exit(406) - return false + ngx.log(ngx.ERR, "no host found for key ", domain) + -- ngx.exit(406) + return false end - ngx.ctx.targetInfo = res - ngx.ctx.toAllow = true; - - if res['wildcard_parent'] then - return res['wildcard_parent'], err - end - - return domain, err + return true end) - auto_ssl:init() } @@ -135,7 +118,7 @@ http { #keepalive_timeout 0; keepalive_timeout 65; - gzip on; + #gzip on; include sites-enabled/*; -} +} \ No newline at end of file diff --git a/ops/nginx_conf/proxy.conf b/ops/nginx_conf/proxy.conf index 1d6c947..3d8cf2c 100644 --- a/ops/nginx_conf/proxy.conf +++ b/ops/nginx_conf/proxy.conf @@ -14,124 +14,103 @@ server { location / { - set $target ''; - set $target_scheme 'http'; - set $target_port ''; - set $header_host $host; + set $target ''; + set $target_scheme 'http'; + set $target_port ''; + set $header_host $host; - access_by_lua { + access_by_lua ' + local host = ngx.var.host + local uri = ngx.var.uri + local scheme = ngx.var.scheme - function getTargetInfo(domain, targetInfo) - if targetInfo then - ngx.log(ngx.ERR, "!!!!!!! getTargetInfo targetFound") + local json = require "cjson" + local socket = assert(require "socket.unix"()) + local function connect(path) + assert(socket:settimeout(.1)) + local status,err = pcall(function() assert(socket:connect(path)) end) + if status then return true end + return false + end - return targetInfo - end + if not host then + ngx.log(ngx.ERR, "no host header found") + return ngx.exit(499) + end - local json = require "cjson" - local redis = require "resty.redis" - local socket = assert(require "socket.unix"()) + local redis = require "resty.redis" + local red = redis:new() - local domain, err = ssl.server_name() + red:set_timeout(1000) -- 1 second - ngx.log(ngx.ERR, "!!!!!! nginx.conf request_domain !!!!!!!", domain) - - local function connect(path) - assert(socket:settimeout(.1)) - local status,err = pcall(function() assert(socket:connect(path)) end) - if status then return true end - return false - end + local ok, err = red:connect("127.0.0.1", 6379) + if not ok then + ngx.log(ngx.ERR, "failed to connect to redis: ", err) + return ngx.exit(598) + end - if not domain then - ngx.log(ngx.ERR, "no host header found") - ngx.exit(499) - return false - end + local res, err = red:hgetall("proxy_host_"..host) + local res = red:array_to_hash(res) - local red = redis:new() - red:set_timeout(1000) -- 1 second + if not res["ip"] then + if connect("/var/run/proxy_lookup.socket") then + assert(socket:send(json.encode({domain = host}))) + while 1 do + local s, status, partial = socket:receive() + if partial then + res = json.decode(partial) + socket:close() + break + end + end + end + end - local ok, err = red:connect("127.0.0.1", 6379) - if not ok then - ngx.log(ngx.ERR, "failed to connect to redis: ", err) - return ngx.exit(598) - end + if not res["ip"] then + ngx.log(ngx.ERR, "no host found for key ", host) + return ngx.exit(406) + end - local res, err = red:hgetall("proxy_Host_"..domain) - local res = red:array_to_hash(res) + if scheme == "http" then + if res["forcessl"] == "true" then + return ngx.redirect("https://"..host..uri, 301) + end + end - if not res["ip"] then - if connect("/var/run/proxy_lookup.socket") then - assert(socket:send(json.encode({domain = domain}))) - while 1 do - local s, status, partial = socket:receive() - if partial then - res = json.decode(partial) - socket:close() - break - end - end - end - end + if res["targetssl"] == "true" then + ngx.var.target_scheme = "https" + end - if not res["ip"] then - ngx.say('The domain is not allowed on this server.') - ngx.exit(406) - return false - end - - ngx.ctx.targetInfo = res - ngx.ctx.toAllow = true; - end + if res["host-pass-though"] == "false" then + ngx.var.header_host = res["ip"] + end + + ngx.var.target = res["ip"] + ngx.var.target_port = res["targetPort"] + '; - local host = ngx.var.host - local uri = ngx.var.uri - local scheme = ngx.var.scheme - local res = getTargetInfo(host, ngx.ctx.targetInfo) + resolver 192.168.1.1 ipv6=off; #8.8.4.4; # use Google's open DNS server + proxy_http_version 1.1; + proxy_pass_request_headers on; + proxy_pass $target_scheme://$target:$target_port; - if scheme == "http" then - if res["forcessl"] == "true" then - return ngx.redirect("https://"..host..uri, 301) - end - end + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + proxy_ssl_session_reuse on; + proxy_intercept_errors off; - if res["targetssl"] == "true" then - ngx.var.target_scheme = "https" - end + proxy_set_header Host $header_host; + add_header X-Target-Host $target; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $target_scheme; + proxy_set_header Referer $target_scheme://$header_host; + proxy_set_header Accept-Language $http_accept_language; + proxy_set_header User-Agent $http_user_agent; - if res["host-pass-though"] == "false" then - ngx.var.header_host = res["ip"] - end - - ngx.var.target = res["ip"] - ngx.var.target_port = res["targetPort"] - } - - - resolver 192.168.1.1 ipv6=off; #8.8.4.4; # use Google's open DNS server - - proxy_http_version 1.1; - proxy_pass_request_headers on; - proxy_pass $target_scheme://$target:$target_port; - - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection $connection_upgrade; - proxy_ssl_session_reuse on; - proxy_intercept_errors off; - - proxy_set_header Host $header_host; - add_header X-Target-Host $target; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $target_scheme; - proxy_set_header Referer $target_scheme://$header_host; - proxy_set_header Accept-Language $http_accept_language; - proxy_set_header User-Agent $http_user_agent; - - sub_filter $target $host; - sub_filter_once off; + sub_filter $target $host; + sub_filter_once off; } -} +} \ No newline at end of file