Hero Image
Hero Image
Hero Image
Nginx HTTPS with Basic Auth reverse proxy for VMware ESXi 6.5 fixed VMRC /screen

Nginx HTTPS with Basic Auth reverse proxy for VMware ESXi 6.5 fixed VMRC /screen server { listen 80; server_name esxi.hackion.com; return 301 https://$server_name$request_uri; } server { listen 443 ssl; server_name esxi.hackion.com; ssl_certificate /mycert.crt; ssl_certificate_key /mykey.key; location / { auth_basic "Restricted Content"; auth_basic_user_file /etc/nginx/.htpasswd; proxy_set_header Upgrade $http_upgrade; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Origin ''; proxy_set_header Authorization ''; #Don't pass the Nginx Basic Auth to ESXi or it will break VMRC. proxy_pass_header X-XSRF-TOKEN; proxy_pass https://esxi_server; proxy_send_timeout 300; proxy_read_timeout 300; send_timeout 300; client_max_body_size 1000m; # enables WS support proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; } } server { listen 443 ssl http2; # ssl_certificate and ssl_certificate_key are required ssl_certificate /etc/letsencrypt/live/myletsencryptdomain/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/myletsencryptdomain/privkey.pem; include /etc/nginx/snippets/ssl-params.conf; # removed DH params as my ssl-params.conf specifies to only use ECDHE key exchange. server_name fqdn.extern; location / { proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr; proxy_ssl_verify off; # No need on isolated LAN proxy_pass https://vcenter.ip; # esxi IP Address proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_buffering off; client_max_body_size 0; proxy_read_timeout 36000s; proxy_redirect https://fqdn.local/ https://fqdn.extern/; # read comment below # replace vcenter-hostname with your actual vcenter's hostname, and esxi with your nginx's server_name. } location /websso/SAML2 { proxy_set_header Host fqdn.local; # your actual vcenter's hostname proxy_set_header X-Real-IP $remote_addr; proxy_ssl_verify off; # No need on isolated LAN proxy_pass https://vcenter.ip; # esxi IP Address proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_buffering off; client_max_body_size 0; proxy_read_timeout 36000s; proxy_ssl_session_reuse on; proxy_redirect https://fqdn.local/ https://fqdn.extern/; # read comment below # replace vcenter-hostname with your actual vcenter's hostname, and esxi with your nginx's server_name. } }

Hero Image
nginx 添加第三方nginx_upstream_check_module 模块实现健康状态检测

nginx 添加第三方 nginx_upstream_check_module 模块实现健康状态检测 nginx_upstream_check_module Health check HTTP servers inside an upstream nginx.conf http { upstream cluster { # simple round-robin server 192.168.0.1:80; server 192.168.0.2:80; check interval=5000 rise=1 fall=3 timeout=4000; #check interval=3000 rise=2 fall=5 timeout=1000 type=ssl_hello; #check interval=3000 rise=2 fall=5 timeout=1000 type=http; #check_http_send "HEAD / HTTP/1.0\r\n\r\n"; #check_http_expect_alive http_2xx http_3xx; } ... check syntax: *check interval=milliseconds [fall=count] [rise=count] [timeout=milliseconds] [default_down=true|false] [type=tcp|http|ssl_hello|mysql|ajp|fastcgi]* 默认配置:interval=3000 fall=5 rise=2 timeout=1000 default_down=true type=tcp* ... interval: 检测间隔 3 秒 fall: 连续检测失败次数 5 次时,认定 relaserver is down rise: 连续检测成功 2 次时,认定 relaserver is up timeout: 超时 1 秒 default_down: 初始状态为 down,只有检测通过后才为 up type: 检测类型方式 tcp tcp :tcp 套接字,不建议使用,后端业务未 100%启动完成,前端已经放开访问的情况 ssl_hello: 发送 hello 报文并接收 relaserver 返回的 hello 报文 http: 自定义发送一个请求,判断上游 relaserver 接收并处理 mysql: 连接到 mysql 服务器,判断上游 relaserver 是否还存在 ajp: 发送 AJP Cping 数据包,接收并解析 AJP Cpong 响应以诊断上游 relaserver 是否还存活(AJP tomcat 内置的一种协议) fastcgi: php 程序是否存活 example

Hero Image
Nginx请求处理流程你了解吗?

Nginx 请求处理流程你了解吗? 11 个处理阶段 1)NGX_HTTP_POST_READ_PHASE: 接收到完整的 HTTP 头部后处理的阶段,它位于 uri 重写之前,实际上很少有模块会注册在该阶段,默认的情况下,该阶段被跳过。 2)NGX_HTTP_SERVER_REWRITE_PHASE: URI 与 location 匹配前,修改 URI 的阶段,用于重定向,也就是该阶段执行处于 server 块内,location 块外的重写指令,在读取请求头的过程中 nginx 会根据 host 及端口找到对应的虚拟主机配置。 3)NGX_HTTP_FIND_CONFIG_PHASE: 根据 URI 寻找匹配的 location 块配置项阶段,该阶段使用重写之后的 uri 来查找对应的 location,值得注意的是该阶段可能会被执行多次,因为也可能有 location 级别的重写指令。 4)NGX_HTTP_REWRITE_PHASE: 上一阶段找到 location 块后再修改 URI,location 级别的 uri 重写阶段,该阶段执行 location 基本的重写指令,也可能会被执行多次。 5)NGX_HTTP_POST_REWRITE_PHASE: 防止重写 URL 后导致的死循环,location 级别重写的后一阶段,用来检查上阶段是否有 uri 重写,并根据结果跳转到合适的阶段。 6)NGX_HTTP_PREACCESS_PHASE: 下一阶段之前的准备,访问权限控制的前一阶段,该阶段在权限控制阶段之前,一般也用于访问控制,比如限制访问频率,链接数等。 7)NGX_HTTP_ACCESS_PHASE: 让 HTTP 模块判断是否允许这个请求进入 Nginx 服务器,访问权限控制阶段,比如基于 ip 黑白名单的权限控制,基于用户名密码的权限控制等。 8)NGX_HTTP_POST_ACCESS_PHASE: 访问权限控制的后一阶段,该阶段根据权限控制阶段的执行结果进行相应处理,向用户发送拒绝服务的错误码,用来响应上一阶段的拒绝。 9)NGX_HTTP_TRY_FILES_PHASE: 为访问静态文件资源而设置,try_files 指令的处理阶段,如果没有配置 try_files 指令,则该阶段被跳过。 10)NGX_HTTP_CONTENT_PHASE: