Nginx 一些配置
这里记录nginx一些配置：
1. 日志分割
首先定义log format
http {
log_format main '$remote_addr - $remote_user [$time_local] "$request" ''$status $body_bytes_sent "$http_referer" '"$http_user_agent" "$http_x_forwarded_for"';
}
在Server 中定义分割：
server {
if ($time_iso8601 ~ "^(\d{4})-(\d{2})-(\d{2})T(\d{2})")
{
set $year $1;
set $month $2;
set $day $3;
}
access_log /external-storage/logs/nginx/$year-$month-$day-xxxx-access.log main;
error_log /external-storage/logs/nginx/xxxx-error.log error;
}
2. 屏蔽ip
2.1 屏蔽某些ip
1）白名单
server {
allow xxxx.xxx;
deny all;
}
2）黑名单
server {
deny xxxx.xxx;
allow all;
}
2.2 屏蔽某地域IP
借助GEO2 插件。ngx_http_geoip_module安装见 https://github.com/leev/ngx_http_geoip2_module
在http中设置
http {
# Get Country info
geoip2 /usr/share/GeoIP/GeoLite2-Country.mmdb {
auto_reload 5m;
$geoip2_data_country_code country iso_code;
}
# 地理ip白名单
map $remote_addr $whitelist_country {
default 1;
47.74.16.59 0;
}
}
在server中使用
server {
set $disallowed_country "${disallowed_country_con}${whitelist_country}";
location / {
if ($disallowed_country = 11) {
return 403;
}
}
}
2.3 屏蔽云服务商访问
同样采用ngx_http_geoip_module。
http中需要采用geo2lite-asn 来获取ip的asn，通过将asn映射成变量，屏蔽部分ip如云服务商
http{
# Get ASN of ip
geoip2 /usr/share/GeoIP/GeoLite2-ASN.mmdb {
auto_reload 5m;
$geoip_data_asn_code autonomous_system_number;
}
# asn map
# cloud ip
map $geoip_data_asn_code $yun {
default 0;
# Below is Alibaba's ip
34947 1;
37963 1;
45102 1;
45103 1;
45104 1;
59028 1;
59051 1;
59052 1;
59053 1;
59054 1;
59055 1;
134963 1;
211914 1;
# Below is tencent
45090 1;
132203 1;
132591 1;
133478 1;
137876 1;
# Below is huawei
55990 1;
61348 1;
63655 1;
63727 1;
131444 1;
136907 1;
139124 1;
139144 1;
140723 1;
141180 1;
149167 1;
200756 1;
206204 1;
206798 1;
265443 1;
269939 1;
}
map $remote_addr $whitelist {
default 1;
47.74.16.59 0;
}
}
server 和location中使用
server {
set $isyun "${yun}${whitelist}";
location / {
if ($isyun = 11) {
return 403;
}
}
}
2.4 refer合法性
server 中
valid_referers none server_names *.xxx.cn.;
3. WebSocket
location /bideval/ws {
proxy_pass http://127.0.0.1:xxx;
proxy_read_timeout 500s;
proxy_send_timeout 500s;
proxy_connect_timeout 500s;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
}4. 流文件上传
client_max_body_size 0;
5.禁止用ip访问
server {
listen 80 default;
deny all;
}
server {
listen 443 ssl default;
ssl_certificate /usr/local/nginx/keys/y.pem;
ssl_certificate_key /usr/local/nginx/keys/y.key;
ssl_session_timeout 5m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
deny all;
}本文为Lokie.Wang原创文章,转载无需和我联系,但请注明来自lokie博客http://lokie.wang
请先登录后发表评论
- 最新评论
- 总共0条评论
