Nginx:proxy_pass和try_files 301跳转带了端口

场景描述:

公司有一台腾讯云服务器和一台阿里云服务器,域名在阿里云备案,腾讯云打不开,直接拦截了

考虑到迁移成本有点高,不想迁移代码,所以,需要将域名指向阿里云服务器,通过反向代理到腾讯云服务器

域名 =>  阿里云服务器(服务器A) => 腾讯云服务器(服务器B)

www.example.com => 192.168.0.1 => 192.168.0.2

原来的配置

服务器A 192.168.0.1

server {
  listen 80;

  server_name www.example.com;

  # 转发到服务器B
  location / {
    proxy_pass         http://192.168.0.2:8000/;
    proxy_redirect     off;

    proxy_set_header    X-NginX-Proxy        true;
    proxy_set_header    X-Real-IP            $remote_addr;
    proxy_set_header    X-Forwarded-For      $proxy_add_x_forwarded_for;
    proxy_set_header    X-Forwarded-Proto    $scheme;
 }
}

服务器B 192.168.0.2

server {
    listen 8000;
    server_name localhost;

    index index.html index.htm index.php;
    
    # 管理后台
    location ^~ /admin {
      alias "/data/wwwroot/www.example.com";
      try_files $uri $uri/ /admin/index.html;
    }
}

遇到的状况1:

刚开始发现访问域名: https://www.example.com/admin,自动跳转到了: http://192.168.0.1:8000/admin

如果访问域名:https://www.example.com/admin/,没有跳转

此时能正常打开

解决方式:

添加参数

proxy_set_header    Host  $host;

遇到的状况2:

刚开始发现访问域名: https://www.example.com/admin,自动跳转到了: http://www.example.com:8000/admin

如果访问域名:https://www.example.com/admin/,没有跳转

发现响应头是这样的

GET https://www.example.com/admin

location: https://www.example.com:8000/admin/

解决方式

proxy_redirect     http://$host:8000/ /;

proxy_redirect的作用

proxy_redirect 该指令用来修改被代理服务器返回的响应头中的Location头域和Refresh头域。

最终版本

服务器A

server {
  listen 80;

  server_name www.example.com;

  # 转发到服务器B
  location / {
    proxy_pass         http://192.168.0.1:8000/;
    proxy_redirect     http://$host:8000/ /;

    proxy_set_header    X-NginX-Proxy        true;
    proxy_set_header    Host                 $host;
    proxy_set_header    X-Real-IP            $remote_addr;
    proxy_set_header    X-Forwarded-For      $proxy_add_x_forwarded_for;
    proxy_set_header    X-Forwarded-Proto    $scheme;
 }
}

参考

user nginx; worker_processes auto; error_log /var/log/nginx/error.log; pid /run/nginx.pid; include /usr/share/nginx/modules/*.conf; events { worker_connections 1024; } http { client_max_body_size 200m; # 开启gzip压缩 gzip on; gzip_min_length 1k; gzip_buffers 16 64K; gzip_http_version 1.1; gzip_comp_level 5; gzip_types text/plain application/x-javascript text/css application/xml application/javascript; gzip_vary on; gzip_disable "MSIE [1-6]\\."; log_format main '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; access_log /var/log/nginx/access.log main; sendfile on; tcp_nopush on; tcp_nodelay on; keepalive_timeout 65; types_hash_max_size 4096; include /etc/nginx/mime.types; default_type application/octet-stream; include /etc/nginx/conf.d/*.conf; # ===================== 通用 HTTP 重定向到 HTTPS ===================== server { listen 80; server_name dd.segma-digital.com produce.segma-digital.com; # 所有二级域名 return 301 https://$host$request_uri; # 自动跳转到 HTTPS } # ===================== 二级域名 1: dd.segma-digital.com ===================== server { listen 443 ssl http2; # 启用 SSL HTTP/2 server_name dd.segma-digital.com; # 第一个二级域名 # SSL 证书配置 ssl_certificate /etc/nginx/ssl/dd.segma-digital.com.crt; # 证书文件 ssl_certificate_key /etc/nginx/ssl/dd.segma-digital.com.key; # 私钥文件 # SSL 优化配置 ssl_session_cache shared:SSL:10m; ssl_session_timeout 10m; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256; ssl_prefer_server_ciphers on; ssl_stapling on; ssl_stapling_verify on; # 安全头部 add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; add_header X-Content-Type-Options nosniff; add_header X-Frame-Options SAMEORIGIN; add_header X-XSS-Protection "1; mode=block"; charset utf-8; location / { root /home/segma; try_files $uri $uri/ /index.html; index index.html index.htm; } location /prod-api/ { proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header REMOTE-HOST $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; # 添加协议头 proxy_pass http://localhost:8080/; } } # ===================== 二级域名 2: produce.segma-digital.com ===================== server { listen 443 ssl http2; # 启用 SSL HTTP/2 server_name produce.segma-digital.com; # 第二个二级域名 # SSL 证书配置 ssl_certificate /etc/nginx/ssl/produce.segma-digital.com.crt; # 证书文件 ssl_certificate_key /etc/nginx/ssl/produce.segma-digital.com.key; # 私钥文件 # SSL 优化配置(同上) ssl_session_cache shared:SSL:10m; ssl_session_timeout 10m; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256; ssl_prefer_server_ciphers on; ssl_stapling on; ssl_stapling_verify on; # 安全头部 add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; add_header X-Content-Type-Options nosniff; add_header X-Frame-Options SAMEORIGIN; add_header X-XSS-Protection "1; mode=block"; charset utf-8; location / { root /home/segma1; try_files $uri $uri/ /index.html; index index.html index.htm; } location /prod-api/ { proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header REMOTE-HOST $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; # 添加协议头 proxy_pass http://localhost:8081/; } } }使用dd.segma-digital.com域名上传文件,上传到了8081端口的系统程序
最新发布
08-13
# 主服务器配置 - 处理 springboard.hzyzi.com binding.springboard.top 的代理转发 server { listen 80; listen 443 ssl; server_name springboard.hzyzi.com binding.springboard.top; # SSL证书配置 ssl_certificate /etc/nginx/ssl/springboard.hzyzi.com.pem; ssl_certificate_key /etc/nginx/ssl/springboard.hzyzi.com.key; # SSL会话缓存设置 ssl_session_cache shared:SSL:1m; ssl_session_timeout 5m; # 加密套件配置 ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4; ssl_protocols TLSv1.2 TLSv1.3; # 移除了不安全的TLSv1.1 ssl_prefer_server_ciphers on; # 所有请求转发到 mini.mangduo88.com location / { proxy_pass https://mini.mangduo88.com/; proxy_connect_timeout 60s; proxy_read_timeout 120s; proxy_send_timeout 120s; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; } access_log /var/log/nginx/springboard.access.log; } # 配置 h51.springboard88vip.top (SSL证书) server { listen 80; server_name h51.springboard88vip.top; return 301 https://$host$request_uri; # 单独处理HTTP跳转 } server { listen 443 ssl; server_name h51.springboard88vip.top; # SSL证书配置 ssl_certificate /etc/nginx/ssl/fullchain.pem; ssl_certificate_key /etc/nginx/ssl/h51.springboard88vip.top.key; # SSL相关配置 ssl_session_cache shared:SSL:1m; ssl_session_timeout 5m; ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4; ssl_protocols TLSv1.2 TLSv1.3; ssl_prefer_server_ciphers on; # 静态文件服务 root /usr/local/nginx/html; index index.html; location / { try_files $uri $uri/ /index.html; expires 30d; add_header Cache-Control "public"; } access_log /var/log/nginx/h51.access.log; } # 配置 www.testss55.com (仅HTTP) server { listen 80; server_name www.testss55.com; root /var/www/html; index index.html; location / { try_files $uri $uri/ =404; } access_log /var/log/nginx/testss55.access.log; }为啥访问https://h51.springboard88vip.top/还是提示我不安全
08-08
评论 1
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值