Question

我想使用nginx作为Websocket连接的反向代理。

考虑 echo.websocket.org 作为我的后端Websocket服务。作为测试客户端，我使用https://github.com/websockets/wscat中的 wscat 。

有效方法：

客户端<-ws->后端： wscat --connect ws://echo.websocket.org

客户端<-wss-> ：wscat --connect wss://echo.websocket.org

客户端<-ws->代理<-ws->后端：wscat --connect ws://localhost具有以下nginx配置：

events {
}

http {
    server {
        listen 80;

        location / {
            proxy_pass http://echo.websocket.org;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection upgrade;
        }
    }
}

客户端<-wss->代理<-ws->后端：wscat -n --connect wss://localhost，具有以下nginx配置：

events {
}

http {
    server {
        listen 443 ssl;
        ssl_certificate /pki/cert.pem;
        ssl_certificate_key /pki/key.pem;

        location / {
            proxy_pass http://echo.websocket.org;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection upgrade;
        }
    }
}

我想要的和需要帮助的是配置nginx以使用安全的websocket连接到后端。我想要这样的配置：

客户端<-wss->代理<-wss->后端

我尝试将http://echo.websocket.org更改为https://echo.websocket.org，但没有成功。这将导致504网关超时。

Answer 1

这是我的配置upstream，server_name，ssl_certificate，HTTP 301：

server {
    listen 80; # nginx 80
    location / {
        return 301 https://$host$request_uri;
    }
    location ^~ /.well-known/acme-challenge/ {
        # Set correct content type. According to this:
        # https://community.letsencrypt.org/t/using-the-webroot-domain-verification-method/1445/29
        # Current specification requires "text/plain" or no content header at all.
        # It seems that "text/plain" is a safe option.
        default_type "text/plain";
        # This directory must be the same as in /etc/letsencrypt/cli.ini
        # as "webroot-path" parameter. Also don't forget to set "authenticator" parameter
        # there to "webroot".
        # Do NOT use alias, use root! Target directory is located here:
        # /var/www/common/letsencrypt/.well-known/acme-challenge/
        root         /var/www/html;
    }
}
server {
    listen 443 ssl default_server;
    listen [::]:443 ssl default_server;
    ssl_certificate /etc/letsencrypt/live/***0***0.ru/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/***0***0.ru/privkey.pem; # managed by Certbot
    root /var/www/html;
    index index.html index.htm index.nginx-debian.html;
    server_name ***0***0.ru; # server name
    location /sockjs-node/ {
        proxy_pass http://node; # wep application
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
    }
    location / {
    proxy_pass http://node;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection keep-alive;
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }
    location /smpp {
        rewrite /smpp(.*) /$1 break;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        proxy_pass http://smpp;
        proxy_set_header Host $host;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}
upstream smpp {
    server localhost:5001;
}
upstream node {
    server localhost:5000;
}

Answer 2

您需要使用Nginx Docs中指定的proxy_ssl_certificate和proxy_ssl_certificate_key

如何配置nginx反向代理以在上游使用SECURE Websocket？

2 个答案: