Question

我有当前和遗留应用程序的nginx配置，其中两个块之间的唯一区别是特定于DNS的条目和根路径。如何将配置的特定部分放在变量或其他内容中，然后在两个服务器配置块中调用该变量？

server {
  listen                0.0.0.0:443 ssl;
  server_name           mysite.com;
  ssl_certificate       /etc/ssl/server.crt;
  ssl_certificate_key   /etc/ssl/server.key;
  ssl_protocols         SSLv3 TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers           RC4:HIGH:!aNULL:!MD5;
  ssl_session_cache     shared:SSL:15m;
  ssl_session_timeout   15m;

  root /home/deployer/apps/myapp/current/public;

  if ($request_method !~ ^(GET|HEAD|POST)$ ) {
       return 444;
  }

  if ($http_user_agent ~* LWP::Simple|BBBike|wget) {
      return 403;
  }

  if ($http_user_agent ~* (spider|AcoiRobot|msnbot|scrapbot|catall|wget) ) {
      return 403;
  }

  location ^~ /assets/ {
    gzip_static on;
    gzip_vary on;
    expires max;
    add_header Cache-Control public;
  }
  location ~ \.(gif|png|jpe?g|JPE?G|GIF|PNG {
      valid_referers none blocked mysite.com *.mysite.com;
      if ($invalid_referer) {
        return   403;
      }
  }
  location /evil/ {
     valid_referers none blocked mysite.com *.mysite.com;
     if ($invalid_referer) {
        return   403;
    }
  }

  try_files $uri/index.html $uri @puma;
  location @puma {
    proxy_set_header  X-Real-IP       $remote_addr;
    proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header  X-Forwarded-Proto https;
    proxy_set_header  Host $http_host;
    proxy_redirect    off;
    proxy_pass        http://puma;
  }

  error_page 500 502 503 504 /500.html;
  client_max_body_size 4G;
  keepalive_timeout 10;
}

如何干掉root行以下的所有内容？

Answer 1

您可以使用map根据$host定义要使用的应用根目录：

map $host $app_root {
    default /home/deployer/apps/myapp/current/public;
    legacy.mysite.lv /home/deployer/apps/myapp/legacy/public;
}

添加另一个server_name指令以匹配您的旧应用（在地图中使用相同的名称）。然后在root指令中使用该变量：

root $app_root;

Answer 2

时间证明了Alexey Ten关于使用include成为正确方法的评论。

我们在生产中使用它：

/etc/nginx

中的文件结构

nginx.conf
sites-enabled/app_config
modules/shared_serve
modules/shared_ssl_settings

在/etc/nginx/sites-enabled/app_config：

upstream puma {
  server unix:/tmp/puma.socket fail_timeout=1;
}

server {
  server_name example.com;
  ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

  include modules/shared_ssl_settings;

  include modules/shared_serve;
}

在/etc/nginx/modules/shared_ssl_settings：

listen                443 ssl;
listen                [::]:443;
ssl                   on;
ssl_protocols         TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers On;

ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';

ssl_session_timeout  1d;
ssl_session_cache    shared:SSL:30m;
ssl_stapling         on;
ssl_stapling_verify  on;
add_header           Strict-Transport-Security max-age=15768000;

在/etc/nginx/modules/shared_serve：

location ~ \.(php|aspx|asp|myadmin)$ { return 444; log_not_found off; }

root /home/deployer/apps/example_app/current/public;

try_files $uri/index.html $uri @puma;

location @puma {
  proxy_set_header  X-Real-IP       $remote_addr;
  proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header  X-Forwarded-Proto https;
  proxy_set_header  Host $http_host;
  proxy_redirect    off;
  proxy_pass        http://puma;
}

error_page 500 502 503 504 /500.html;
client_max_body_size 4G;
keepalive_timeout 10;

唯一的问题是您的部署脚本必须确保/etc/nginx中的文件结构。当然，您可以将模块目录命名为其他任何名称。您甚至可以将包含文件保留在/etc/nginx中，而不包含子目录。

如何干燥nginx配置

2 个答案: