CentOS体系怎样设置Nginx反向署理教程

摇滚辣辣妹

一、反向署理及演示情况形貌
1、反向署理
在盘算机网络中，反向署理是一种署理服务器，代表客户端从一个或多个服务器检索资源。然后将这些资源返回给客户机，就像它们源自Web服务器自己一样。与正向署理相反，正向署理是与其关联的客户端接洽任何服务器的中介，反向署理是任何客户端与其关联的服务器举行接洽的中介。
有关正向署理可参考：基于CentOS 7设置Nginx正向署理
2、本演示中的几个服务器

二、通例反向署理设置
1、后端服务器设置(Apache)
后端Apache服务器主机名及IP
# hostname
centos7-web.example.com
# more /etc/redhat-release
CentOS Linux release 7.2.1511 (Core)
# ip addr|grep inet|grep global
inet 172.24.8.128/24 brd 172.24.8.255 scope global eno16777728
# systemctl start httpd.service
# echo "This is a httpd test page.">/var/www/html/index.html
# curl http://localhost
This is a httpd test page.2、前端Nginx反向署理服务器设置
前端Nginx服务器主机名及IP
# hostname
centos7-router
# more /etc/redhat-release
CentOS Linux release 7.2.1511 (Core)
# ip addr |grep inet|grep global
inet 172.24.8.254/24 brd 172.24.8.255 scope global eno16777728
inet 192.168.1.175/24 brd 192.168.1.255 scope global dynamic eno33554960Nginx版本
# nginx -V
nginx version: nginx/1.10.2添加一个新的设置文件用作反向署理
# vim /etc/nginx/conf.d/reverse_proxy.conf
server {
listen 8090;
server_name localhost;
location / {
proxy_pass http://172.24.8.128; ###反向署理焦点指令
proxy_buffers 256 4k;
proxy_max_temp_file_size 0;
proxy_connect_timeout 30;
proxy_cache_valid 200 302 10m;
proxy_cache_valid 301 1h;
proxy_cache_valid any 1m;
}
}
# systemctl reload nginx
# ss -nltp|grep nginx|grep 8090
LISTEN 0 128 *:8090 *:* users:(("nginx",pid=78023,fd=8),("nginx",pid=78021,fd=8))
# curl http://localhost:8090 ##基于当地测试
This is a httpd test page.检察Apache服务器日记
# more /var/log/httpd/access_log ##哀求IP地点为172.24.8.254，当从其他呆板哀求时也是172.24.8.254这个IP
172.24.8.254 - - [30/Oct/2017:14:02:38 +0800] "GET / HTTP/1.0" 200 27 "-" "curl/7.29.0"3、反向署理服务器及后端服务器日记格式设置
为Nginx服务器添加proxy_set_header指令，修改后如下
# grep proxy_set_header -B2 /etc/nginx/conf.d/reverse_proxy.conf
location / {
proxy_pass http://172.24.8.128;
proxy_set_header X-Real-IP $remote_addr;
}
# systemctl reload nginx.service后端服务器Apache日记格式设置
# vim /etc/http/conf/httpd.conf
# LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined #解释此行，添加下一行
LogFormat "%{X-Real-IP}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined #关键形貌 {X-Real-IP}i
# ip addr|grep inet|grep global #从1.132主机访问
inet 192.168.1.244/24 brd 192.168.1.255 scope global eth0
# curl http://192.168.1.175:8090 #从1.244主机访问
This is a httpd test page
#再次检察apache访问日记，如下，不再是署理服务器IP地点，此时表现为1.244
192.168.1.244 - - [30/Oct/2017:15:49:07 +0800] "GET / HTTP/1.0" 200 27 "-" "curl/7.19.7 (x86_64-redhat-linux-gnu)
libcurl/7.19.7 NSS/3.14.0.0 zlib/1.2.3 libidn/1.18 libssh2/1.4.2"二、基于目次匹配反向署理
后端服务器接纳Nginx的设置
# more /etc/redhat-release ##os平台及ip地点
CentOS release 6.7 (Final)
# ip addr|grep eth0|grep global
inet 192.168.1.132/24 brd 192.168.1.255 scope global eth0
# nginx -v ##nginx版本
nginx version: nginx/1.10.2
# mkdir -pv /usr/share/nginx/html/images ##创建图片目次
mkdir: created directory `/usr/share/nginx/html/images'
# cp /usr/share/backgrounds/nature/*.jpg /usr/share/nginx/html/images/. ##复制图片文件
# cp /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/default.conf.bk
# vim /etc/nginx/conf.d/default.conf ##此处直接修改缺省设置文件
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _;
root /usr/share/nginx/html;
# Load configuration files for the default server block.
include /etc/nginx/default.d/*.conf;
location / {
}
location /images {
alias /usr/share/nginx/html/images; ##此处设置了别名
}
error_page 404 /404.html;
location = /40x.html {
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
}
}
# /etc/init.d/nginx reload
Reloading nginx: [ OK ]前端Nginx设置
# vim /etc/nginx/conf.d/reverse_proxy.conf
server {
listen 8090;
server_name localhost;
location / {
proxy_pass http://172.24.8.128;
proxy_set_header X-Real-IP $remote_addr;
}
location /images { ##将images目次下的文件署理至192.168.1.132
proxy_pass http://192.168.1.132;
proxy_set_header X-Real-IP $remote_addr;
}
}
# systemctl reload nginx验证署理环境，在ip为192.168.1.244测试对images目次下的jpg文件哀求
# ip addr|grep inet|grep global
inet 192.168.1.244/24 brd 192.168.1.255 scope global eth0
# curl -I http://192.168.1.175:8090/images/Garden.jpg
HTTP/1.1 200 OK
Server: nginx/1.12.2
Date: Tue, 31 Oct 2017 01:48:18 GMT
Content-Type: image/jpeg
Content-Length: 264831
Connection: keep-alive
Last-Modified: Mon, 30 Oct 2017 08:21:28 GMT
ETag: "59f6e108-40a7f"
Accept-Ranges: bytes三、基于特定文件范例的反向署理设置
php服务器端设置(ip 192.168.1.132)
# ss -nltp|grep php
LISTEN 0 128 192.168.1.132:9000 *:* users:(("php-fpm",7147,8),("php-fpm",7148,0),("php-fpm",7149,0))
# mkdir -pv /data ###存放php代码
# echo "/data 192.168.1.0/24(rw)" >/etc/exports
# /etc/init.d/rpcbind start
# /etc/init.d/nfslock start
# /etc/init.d/nfs start
# echo "< ?php phpinfo();?>" > /data/index.phpNginx署理端设置(ip 192.168.1.175)
# mkdir /data
# mount -t nfs 192.168.1.132:/data /data
# ls /data
index.php
# vim /etc/nginx/conf.d/reverse_proxy.conf
server {
listen 8090;
server_name localhost;
location / {
proxy_pass http://172.24.8.128;
proxy_set_header X-Real-IP $remote_addr;
}
location /images {
proxy_pass http://192.168.1.132;
proxy_set_header X-Real-IP $remote_addr;
}
location ~ \.php$ {
root /data;
fastcgi_pass 192.168.1.132:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;
include fastcgi_params;
}
}
# systemctl restart nginx测试反向署理至php
[root@ydq05 ~]# ip addr|grep inet|grep global
inet 192.168.1.244/24 brd 192.168.1.255 scope global eth0
[root@ydq05 ~]# curl -I http://192.168.1.175:8090/index.php
HTTP/1.1 200 OK
Server: nginx/1.12.2
Date: Tue, 31 Oct 2017 03:22:59 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/5.6.0四、基于upstream 设置反向署理至tomcat
Nginx upstream指令也可以将哀求署理到后端服务器 如下示例，联合upstream指令演示将其署理到tomcat
# vim /etc/nginx/conf.d/tomcat.conf
upstream app {
server localhost:8080;
keepalive 32;
}
server {
listen 80;
server_name localhost;
location / {
proxy_set_header Host $host;
proxy_set_header x-for $remote_addr;
proxy_set_header x-server $host;
proxy_set_header x-agent $http_user_agent;
proxy_pass http://app;
}
}
[root@node132 conf.d]# ss -nltp|grep java
LISTEN 0 1 ::ffff:127.0.0.1:8005 :::* users:(("java",39559,45))
LISTEN 0 100 :::8009 :::* users:(("java",39559,43))
LISTEN 0 100 :::8080 :::* users:(("java",39559,42))
tomcat版本
[root@node132 conf.d]# /usr/local/tomcat/bin/catalina.sh version
Using CATALINA_BASE: /usr/local/tomcat
Using CATALINA_HOME: /usr/local/tomcat
....
Server version: Apache Tomcat/7.0.69
Server built: Apr 11 2016 07:57:09 UTC
Server number: 7.0.69.0
OS Name: Linux
OS Version: 2.6.32-573.el6.x86_64
Architecture: amd64
JVM Version: 1.7.0_79-b15
JVM Vendor: Oracle Corporation
验证效果
# curl http://localhost
< !DOCTYPE html>
......五、proxy模块指令形貌
proxy模块的可用设置指令非常多，它们分别用于界说proxy模块工作时的诸多属性，如毗连超时时长、署理时利用http协议版本等。下面临常用的指令做一个简朴阐明。

• proxy_connect_timeout   nginx将一个哀求发送至upstream server之前等候的最大时长；
  

• proxy_cookie_domain   将upstream server通过Set-Cookie首部设定的domain属性修改为指定的值，其值可以为一个字符串、正则表达式的模式或一个引用的变量；
  

• proxy_cookie_path    将upstream server通过Set-Cookie首部设定的path属性修改为指定的值，其值可以为一个字符串、正则表达式的模式或一个引用的变量；
  

• proxy_hide_header   设定发送给客户端的报文中必要隐蔽的首部；
  

• proxy_pass   指定将哀求署理至upstream server的URL路径；
  

• proxy_set_header   将发送至upsream server的报文的某首部举行重写；
  

• proxy_redirect   重写location并革新从upstream server收到的报文的首部；
  

• proxy_send_timeout   在毗连断开之前两次发送至upstream server的写操纵的最大隔断时长；
  

• proxy_read_timeout    在毗连断开之前两次从吸收upstream server吸收读操纵的最大隔断时长；
  

如下面的一个示例：
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
client_max_body_size 10m;
client_body_buffer_size 128k;
proxy_connect_timeout 30;
proxy_send_timeout 15;
proxy_read_timeout 15;