День добрый.
При построении архитектуры проекта возникла серьёзная проблема - "моя не знать динамические виртуальные хосты nginx".
Проект имеет следующую стандартную структуру:
балансировщик nginx (их число может расти автоматически, если всё будет плохо) распределяют трафик на 6 нод с тем же nginx.
Структура пользовательских доменов будет выглядеть следующим образом:
/var/www/webroot/ROOT/domain1.ru/site1 должно понимать как site1.domain1.ru
/var/www/webroot/ROOT/domain2.ru/site1 соответственно site1.domain2.ru
и так далее по тому же принципу. Есть конфиги Jelastic из коробки
Конфиг балансировщика:######## HTTP SECTION PROTOTYPE ########
http {
server_tokens off ;
include /etc/nginx/mime.types;
default_type application/octet-stream;
set_real_ip_from 192.168.0.0/16;
set_real_ip_from 10.0.0.0/8;
set_real_ip_from 172.16.0.0/16;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
log_format main
'"$http_x_forwarded_for" - $remote_user [$time_local] '
'"$request" $status $bytes_sent '
'"$http_referer" "$http_user_agent" '
'"$gzip_ratio"';
client_header_timeout 10m;
client_body_timeout 10m;
send_timeout 10m;
client_max_body_size 50m;
connection_pool_size 256;
client_header_buffer_size 1k;
large_client_header_buffers 4 2k;
request_pool_size 4k;
# gzip on;
gzip_min_length 1100;
gzip_buffers 4 8k;
gzip_types text/plain;
output_buffers 1 32k;
postpone_output 1460;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 75 20;
ignore_invalid_headers on;
map $upstream_addr $group {
default "";
### MAPPING FOLLOWS HERE ###
### ~XXX\.XXX\.XXX\.XXX\:XX$ $GROUPNAME; ### MAPPROTO ### This is mappings prototype line, do not remove this!
~10\.50\.14\.57\:80$ common; ~10\.50\.14\.62\:80$ common; ### MAPPROTO for common ###
}
### DEFAULT UPSTREAM FOLLOWS HERE ###
upstream default_upstream{
### server XXX.XXX.XXX.XXX; ### $GROUPNAME ### DEFUPPROTO ###
server 10.50.14.57; server 10.50.14.62; server 10.50.14.54 backup; ### DEFUPPROTO for common ###
sticky path=/; }
### UPSTREAMS LIST FOLLOWS HERE ###
#upstream nodes{ server XXX.XXX.XXX.XXX; server 127.0.0.1:8001 backup # UPSTREAMPROTO # This is upstream prototype line, do not remove this! }
upstream common { server 10.50.14.54 backup; server 10.50.14.57; server 10.50.14.62; sticky path=/; } ### UPSTREAMPROTO for common ###
#GFADMIN
server {
listen *:80;
server_name localhost;
access_log /var/log/nginx/localhost.access_log main;
error_log /var/log/nginx/localhost.error_log info;
proxy_temp_path /var/nginx/tmp/;
proxy_connect_timeout 5s;
error_page 500 502 503 504 /50x.html;
proxy_next_upstream error timeout http_500;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Host $http_host;
proxy_set_header X-Forwarded-For $http_x_forwarded_for;
proxy_set_header X-URI $uri;
proxy_set_header X-ARGS $args;
proxy_set_header Refer $http_refer;
location = /50x.html {
root html;
}
location / {
if ($cookie_SRVGROUP ~ group|common) {
proxy_pass http://$cookie_SRVGROUP;
error_page 500 502 503 504 = @rescue;
}
if ($cookie_SRVGROUP !~ group|common) {
add_header Set-Cookie "SRVGROUP=$group; path=/";
}
proxy_pass http://default_upstream;
add_header Set-Cookie "SRVGROUP=$group; path=/";
}
location @rescue {
proxy_pass http://default_upstream;
add_header Set-Cookie "SRVGROUP=$group; path=/";
}
#USERLOCATIONS
}
server {
listen *:8001;
server_name backup.local;
location / {
proxy_pass http://default_upstream;
add_header Set-Cookie "SRVGROUP=$group; path=/";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Host $http_host;
proxy_set_header X-Forwarded-For $http_x_forwarded_for;
proxy_set_header X-URI $uri;
proxy_set_header X-ARGS $args;
proxy_set_header Refer $http_refer;
}
}
include /etc/nginx/conf.d/*.conf;
}
######## TCP SECTION PROTOTYPE ########
tcp {
server {
listen 825;
proxy_pass common;
access_log /var/log/nginx/tcp_access.log;
}
upstream common {
server 10.50.14.57:825; server 10.50.14.62:825; ### UPSTREAMPROTO for common ###
check interval=3000 rise=2 fall=5 timeout=1000;
#check interval=3000 rise=2 fall=5 timeout=1000 type=ssl_hello;
#check interval=3000 rise=2 fall=5 timeout=1000 type=http;
#check_http_send "GET / HTTP/1.0\r\n\r\n";
#check_http_expect_alive http_2xx http_3xx;
}
}
tcp {
server {
listen 110;
proxy_pass common;
access_log /var/log/nginx/tcp_access.log;
}
upstream common {
server 10.50.14.57:810; server 10.50.14.62:810; ### UPSTREAMPROTO for common ###
check interval=3000 rise=2 fall=5 timeout=1000;
#check interval=3000 rise=2 fall=5 timeout=1000 type=ssl_hello;
#check interval=3000 rise=2 fall=5 timeout=1000 type=http;
#check_http_send "GET / HTTP/1.0\r\n\r\n";
#check_http_expect_alive http_2xx http_3xx;
}
}
tcp {
server {
listen 143;
proxy_pass common;
access_log /var/log/nginx/tcp_access.log;
}
upstream common {
server 10.50.14.57:843; server 10.50.14.62:843; ### UPSTREAMPROTO for common ###
check interval=3000 rise=2 fall=5 timeout=1000;
#check interval=3000 rise=2 fall=5 timeout=1000 type=ssl_hello;
#check interval=3000 rise=2 fall=5 timeout=1000 type=http;
#check_http_send "GET / HTTP/1.0\r\n\r\n";
#check_http_expect_alive http_2xx http_3xx;
}
}
Конфиг ноды:#user nobody;
worker_processes 1;
error_log /var/log/nginx/error.log;
#error_log logs/error.log notice;
#error_log logs/error.log info;
#pid logs/nginx.pid;
events {
worker_connections 1024;
}
http {
server_tokens off;
include mime.types;
default_type application/octet-stream;
log_format main '$http_x_forwarded_for - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
#tcp_nopush on;
#keepalive_timeout 0;
keepalive_timeout 65;
#gzip on;
server {
listen 80;
server_name localhost;
#charset koi8-r;
#access_log logs/host.access.log main;
include /etc/nginx/aliases.conf;
location / {
root /var/www/webroot/ROOT;
index index.html index.htm index.php;
location ~ \.php$ {
location ~ /\. { deny all; access_log off; log_not_found off; }
include /etc/nginx/fastcgi_params;
fastcgi_pass 127.0.0.1:9000;
fastcgi_param SCRIPT_FILENAME /var/www/webroot/ROOT$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_script_name;
fastcgi_param DOCUMENT_ROOT /var/www/webroot/ROOT;
}
}
index index.php index.html index.htm;
#error_page 404 /404.html;
# redirect server error pages to the static page /50x.html
#
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root html;
}
# proxy the PHP scripts to Apache listening on 127.0.0.1:80
#
#location ~ \.php$ {
# proxy_pass http://127.0.0.1;
#}
location ~ /\. { deny all; access_log off; log_not_found off; }
# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
#
#location ~ \.php$ {
# root html;
# fastcgi_pass 127.0.0.1:9000;
# fastcgi_index index.php;
# fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;
# include fastcgi_params;
#}
# deny access to .htaccess files, if Apache's document root
# concurs with nginx's one
#
#location ~ /\.ht {
# deny all;
#}
location ~ \.php$ {
location ~ /\. { deny all; access_log off; log_not_found off; }
include /etc/nginx/fastcgi_params;
fastcgi_pass 127.0.0.1:9000;
fastcgi_param SCRIPT_FILENAME /var/www/webroot$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_script_name;
fastcgi_param DOCUMENT_ROOT /var/www/webroot;
}
}
include /etc/nginx/conf.d/*.conf;
}
Так вот вопрос, как научить nginx работать динамично с поддоменами, да ещё и безопасно?
Сложный
