限制HTTP动词而不进行冗余配置

Question

我有一个Elasticsearch集群加上Logstash和Kibana，我只想在索引中公开一个只读窗口，但索引kibana-int除外，这样就可以保存仪表板。

我找到了合适的ES代理配置，并且我已将其修改为使用limit_except禁止对其他索引进行写入/修改，但大部分配置都是不必要的重复。是否有更清晰的方法来定义它？

upstream elasticsearch {
    server es-01.iad.company.com:9200;
    server es-02.iad.company.com:9200;
}

server {
    listen 9200;
    server_name elasticsearch.proxy;
    client_max_body_size 50m;

    location / {
        limit_except GET POST HEAD OPTIONS {
            deny all;
        }
        proxy_pass http://elasticsearch;
        proxy_redirect off;
        proxy_set_header Connection "";
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $http_host;
        proxy_pass_header Access-Control-Allow-Origin;
        proxy_pass_header Access-Control-Allow-Methods;
        proxy_hide_header Access-Control-Allow-Headers;
        add_header Access-Control-Allow-Headers 'X-Requested-With, Content-Type';
        add_header Access-Control-Allow-Credentials true;
    }
    location /kibana-int/ {
        proxy_pass http://elasticsearch;
        proxy_redirect off;
        proxy_set_header Connection "";
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $http_host;
        proxy_pass_header Access-Control-Allow-Origin;
        proxy_pass_header Access-Control-Allow-Methods;
        proxy_hide_header Access-Control-Allow-Headers;
        add_header Access-Control-Allow-Headers 'X-Requested-With, Content-Type';
        add_header Access-Control-Allow-Credentials true;
    }
}

Answer 1

有几种方法：

解决方案1 ​​

您可以将重复配置放入文件和include。

您的配置：

upstream elasticsearch {
    server es-01.iad.company.com:9200;
    server es-02.iad.company.com:9200;
}

server {
    listen 9200;
    server_name elasticsearch.proxy;
    client_max_body_size 50m;

    location / {
        limit_except GET POST HEAD OPTIONS {
            deny all;
        }
        include proxy.inc;
    }

    location /kibana-int/ {
        include proxy.inc;
    }
}

proxy.inc：

proxy_pass http://elasticsearch;
proxy_redirect off;
proxy_set_header Connection "";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_hide_header Access-Control-Allow-Headers;
add_header Access-Control-Allow-Headers 'X-Requested-With, Content-Type';
add_header Access-Control-Allow-Credentials true;

---

解决方案2

其他方式是使用nginx的指令继承。

upstream elasticsearch {
    server es-01.iad.company.com:9200;
    server es-02.iad.company.com:9200;
}

server {
    listen 9200;
    server_name elasticsearch.proxy;
    client_max_body_size 50m;

    proxy_redirect off;
    proxy_set_header Connection "";
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_hide_header Access-Control-Allow-Headers;
    add_header Access-Control-Allow-Headers 'X-Requested-With, Content-Type';
    add_header Access-Control-Allow-Credentials true;

    location / {
        limit_except GET POST HEAD OPTIONS {
            deny all;
        }
        proxy_pass http://elasticsearch;
    }

    location /kibana-int/ {
        proxy_pass http://elasticsearch;
    }
}

---

顺便说一下，你的proxy_pass_header指令是不必要的。 Nginx默认代理几乎所有标题。