Nginx反向代理+负载均衡简单实现(https方式)

技术教程 风为裳 来源:散尽浮华 5浏览 0评论 繁體

简介

代理服务器,客户机在发送请求时,不会直接发送给目的主机,而是先发送给代理服务器,代理服务接受客户机请求之后,再向主机发出,并接收目的主机返回的数据,存放在代理服务器的硬盘中,再发送给客户机。

背景
A服务器(192.168.1.8)作为nginx代理服务器
B服务器(192.168.1.150)作为后端真实服务器

现在需要访问https://testwww.huanqiu.com请求时从A服务器上反向代理到B服务器上

这就涉及到nginx反向代理https请求的配置了~~~

A服务器(192.168.1.8)上的操作流程

1)编译安装nginx

[[email protected] ~]# yum install -y pcre pcre-devel openssl openssl-devel gcc
[[email protected] ~]# cd /usr/loca/src
[[email protected] ~]# wget http://nginx.org/download/nginx-1.8.0.tar.gz
[[email protected] ~]# tar -zxvf nginx-1.8.0.tar.gz
[[email protected] ~]# cd nginx-1.8.0
#添加www用户,其中-M参数表示不添加用户家目录,-s参数表示指定shell类型
 
[[email protected] ~]#useradd www -M -s /sbin/nologin
[[email protected] ~]##vim auto/cc/gcc
#将这句注释掉 取消Debug编译模式 大概在179行
#CFLAGS="$CFLAGS -g"
 
#我们再配置下nginx编译参数,编译时一定要添加--with-http_ssl_module,以便让nginx支持ssl功能!
[[email protected] ~]# ./configure --prefix=/usr/local/nginx --user=www --group=www --with-http_stub_status_module --with-http_ssl_module
[[email protected] ~]#make
[[email protected] ~]#make install clean

2)配置nginx

[[email protected] ~]# cd /usr/local/nginx/conf
[[email protected] conf]# vim nginx.conf
 
user nobody;
worker_processes 8;
 
#error_log logs/error.log;
#error_log logs/error.log notice;
#error_log logs/error.log info;
 
events {
worker_connections 65535;
}
 
http {
include mime.types;
default_type application/octet-stream;
charset utf-8;
 
log_format main '$http_x_forwarded_for $remote_addr $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_cookie" $host $request_time';
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
 
fastcgi_connect_timeout 3000;
fastcgi_send_timeout 3000;
fastcgi_read_timeout 3000;
fastcgi_buffer_size 256k;
fastcgi_buffers 8 256k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
fastcgi_intercept_errors on;
 
client_header_timeout 600s;
client_body_timeout 600s;
 
client_max_body_size 100m;
client_body_buffer_size 256k; 
## support more than 15 test environments
server_names_hash_max_size 512;
server_names_hash_bucket_size 128;
gzip on;
gzip_min_length 1k;
gzip_buffers 4 16k;
gzip_http_version 1.1;
gzip_comp_level 9;
gzip_types text/plain application/x-javascript text/css application/xml text/javascript application/x-httpd-php;
gzip_vary on;
 
include vhosts/*.conf;
}
 
[[email protected] conf]# ulimit -n 65535
[[email protected] conf]# mkdir vhosts

接下来手动配置ssl证书
如果自己手动颁发证书的话,那么https是不被浏览器认可的,就是https上面会有一个大红叉

推荐一个免费的网站:https://www.startssl.com/
startssl的操作教程看这个:http://www.freehao123.com/startssl-ssl/

手动颁发证书的操作

[[email protected] ~]# cd /usr/local/nginx/conf/
[[email protected] conf]# mkdir ssl
[[email protected] conf]# cd ssl/
[[email protected]nux-node1 ssl]# openssl genrsa -des3 -out aoshiwei.com.key 1024
Generating RSA private key, 1024 bit long modulus
................................++++++
....................................++++++
e is 65537 (0x10001)
Enter pass phrase for aoshiwei.com.key: #提示输入密码,比如这里我输入123456
Verifying - Enter pass phrase for aoshiwei.com.key: #确认密码,继续输入123456
 
[[email protected] ssl]# ls #查看,已生成CSR(Certificate Signing Request)文件
aoshiwei.com.key
 
[[email protected] ssl]# openssl req -new -key aoshiwei.com.key -out aoshiwei.com.csr
Enter pass phrase for aoshiwei.com.key: #输入123456
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn #国家
State or Province Name (full name) []:beijing #省份
Locality Name (eg, city) [Default City]:beijing #地区名字
Organization Name (eg, company) [Default Company Ltd]:huanqiu #公司名
Organizational Unit Name (eg, section) []:Technology #部门
Common Name (eg, your name or your server's hostname) []:huanqiu #CA主机名
Email Address []:[email protected] #邮箱
 
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456 #证书请求密钥,CA读取证书的时候需要输入密码
An optional company name []:huanqiu #-公司名称,CA读取证书的时候需要输入名称
 
[[email protected] ssl]# ls
aoshiwei.com.csr aoshiwei.com.key
 
[[email protected] ssl]# cp aoshiwei.com.key aoshiwei.com.key.bak
[[email protected] ssl]# openssl rsa -in aoshiwei.com.key.bak -out aoshiwei.com.key
Enter pass phrase for aoshiwei.com.key.bak: #输入123456
writing RSA key
[[email protected] ssl]# openssl x509 -req -days 365 -in aoshiwei.com.csr -signkey aoshiwei.com.key -out aoshiwei.com.crt
Signature ok
subject=/C=cn/ST=beijing/L=beijing/O=huanqiu/OU=Technology/CN=huanqiu/[email protected]
Getting Private key
[[email protected] ssl]# ll
total 24
-rw-r--r-- 1 root root 960 Sep 12 16:01 aoshiwei.com.crt
-rw-r--r-- 1 root root 769 Sep 12 15:59 aoshiwei.com.csr
-rw-r--r-- 1 root root 887 Sep 12 16:01 aoshiwei.com.key
-rw-r--r-- 1 root root 963 Sep 12 16:01 aoshiwei.com.key.bak

然后配置nginx的反向代理

[[email protected] vhosts]# pwd
/usr/local/nginx/conf/vhosts
[[email protected] vhosts]# cat test.xqshijie.com-ssl.conf
upstream 8090 {
server 192.168.1.150:8090 max_fails=3 fail_timeout=30s;;
}
 
server {
listen 443;
server_name testwww.huanqiu.com;
ssl on;
 
### SSL log files ###
access_log logs/ssl-access.log;
error_log logs/ssl-error.log;
 
### SSL cert files ###
ssl_certificate ssl/aoshiwei.com.crt; #由于这个证书是自己手动颁发的,是不受信任的,访问时会有个“大叉”提示,但是不影响访问https://testwww.huanqiu.com
ssl_certificate_key ssl/aoshiwei.com.key; #如果是线上环境,可以购买被信任后的证书,拷贝过来使用。
ssl_session_timeout 5m;
 
location / {
proxy_pass https://8090; #这个一定要是https
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_redirect off;
}
}

重启nginx

[[email protected] ssl]# /usr/local/nginx/sbin/nginx -t
[[email protected] ssl]# /usr/local/nginx/sbin/nginx -s reload
[[email protected] ssl]# lsof -i:443
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
nginx 15755 nobody 24u IPv4 4717921 0t0 TCP *:https (LISTEN)
nginx 15756 nobody 24u IPv4 4717921 0t0 TCP *:https (LISTEN)
nginx 15757 nobody 24u IPv4 4717921 0t0 TCP *:https (LISTEN)
nginx 15758 nobody 24u IPv4 4717921 0t0 TCP *:https (LISTEN)

A服务器要开启防火墙了,则需要在iptables里开通443端口的访问

-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
 
[[email protected] ssl]# /etc/init.d/iptables restart

后端真实服务器(192.168.1.150)上的nginx配置

[[email protected] vhosts]# cat test.xqshijie.com-ssl.conf
server {
listen 8090; #这里后端服务器的https没有采用默认的443端口
 
server_name testwww.huanqiu.com;
root /var/www/vhosts/test.huanqiu.com/httpdocs/main/;
 
ssl on;
ssl_certificate /Data/app/nginx/certificates/xqshijie.cer; #这是后端服务器上的证书,这个是购买的被信任的证书,可以把它的证书拷贝给上面的代理机器使用
ssl_certificate_key /Data/app/nginx/certificates/xqshijie.key; #可以将这两个证书拷给上面192.168.1.8的/usr/loca/nginx/conf/ssl下使用,修改nginx代理配置部分的证书路径即可!
 
ssl_session_timeout 5m;
 
ssl_protocols SSLv2 SSLv3 TLSv1;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
 
access_log /var/www/vhosts/test.huanqiu.com/logs/clickstream_ssl.log main;
 
location / {
try_files $uri $uri/ @router;
index index.php;
}
 
error_page 500 502 503 504 /50x.html;
 
location @router {
rewrite ^.*$ /index.php last;
}
 
location ~ \.php$ {
fastcgi_pass 127.0.0.1:9001;
fastcgi_read_timeout 300;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;
#include fastcgi_params;
include fastcgi.conf;
fastcgi_param HTTPS on; #这个一定要加上,否则访问https时会出现报错:The plain HTTP request was sent to HTTPS port
}
} ##end server
 
[[email protected] vhosts]# lsof -i:8090
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
nginx 24373 root 170u IPv4 849747 0t0 TCP *:8090 (LISTEN)
nginx 25897 nobody 170u IPv4 849747 0t0 TCP *:8090 (LISTEN)
nginx 25898 nobody 170u IPv4 849747 0t0 TCP *:8090 (LISTEN)

最后在浏览器里访问https://testwww.huanqiu.com就能通过192.168.1.8服务器反向代理到192.168.1.150上的8090端口上了~

下面顺便附上一个测试的nginx代理配置(http和https)

[[email protected] vhosts]# cat testhuanqiu.com
upstream 8802 {
server 192.168.1.150:8802 max_fails=3 fail_timeout=30s;
}
upstream 8803 {
server 192.168.1.150:8803 max_fails=3 fail_timeout=30s;
}
upstream 8804 {
server 192.168.1.150:8804 max_fails=3 fail_timeout=30s;
}
upstream 8805 {
server 192.168.1.150:8805 max_fails=3 fail_timeout=30s;
}
 
server {
listen 80;
server_name test10erp.fangfull.com;
location / {
proxy_store off;
proxy_redirect off;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $http_host;
proxy_pass http://8802;
}
}
 
server {
listen 80;
server_name test10www.fangfull.com;
location / {
proxy_store off;
proxy_redirect off;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $http_host;
proxy_pass http://8803;
}
}
 
server {
listen 443;
server_name test10fanghu.xqshijie.com;
ssl on;
 
### SSL cert files ###
ssl_certificate ssl/xqshijie.cer;
ssl_certificate_key ssl/xqshijie.key;
ssl_session_timeout 5m;
 
location / {
proxy_pass https://8804;
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_redirect off;
}
}
 
server {
listen 443;
server_name test10www.xqshijie.com;
ssl on;
 
### SSL cert files ###
ssl_certificate ssl/xqshijie.cer;
ssl_certificate_key ssl/xqshijie.key;
ssl_session_timeout 5m;
 
location / {
proxy_pass https://8805;
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_redirect off;
}
}
****************************************************************************************

上面的情况是:nginx代理层和后端服务器上都有ssl证书。
如果是nginx+tomcat+https在本机部署(即没有代理层),可以参考:https://pan.baidu.com/share/init?surl=jHPPMK2 提取密码:j7s4

转载请注明:风为裳 » Nginx反向代理+负载均衡简单实现(https方式)

发表我的评论
取消评论

表情

Hi,您需要填写昵称和邮箱!

  • 昵称 (必填)
  • 邮箱 (必填)
  • 网址