玩转NAS | 打造一个动态网关，部署OpenResty - Nginx与Lua的强强联合

worker_processes  1;
error_log logs/error.log;
events {
    worker_connections 1024;
}
http {
    server {
        listen 8080;
        location / {
            default_type text/html;
            content_by_lua_block {
                ngx.say("<p>hello, world</p>")
            }
        }
    }
}

# 创建持久化目录，包含 静态资源 www, 证书目录 cert, 以及配置文件目录 conf.d
mkdir -vp /share/Container/gateway-web/{www,cert,conf.d}

# Nginx 基础配置文件
tee /share/Container/gateway-web/nginx.conf << EOF
# nginx.conf  --  docker-openresty
# See https://github.com/openresty/docker-openresty/blob/master/README.md#nginx-config-files

#user  nobody;
#worker_processes 1;

# Enables the use of JIT for regular expressions to speed-up their processing.
pcre_jit on;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

#pid  logs/nginx.pid;

events {
worker_connections  1024;
}


http {
  include       mime.types;
  default_type  application/octet-stream;

  # Enables or disables the use of underscores in client request header fields.
  # When the use of underscores is disabled, request header fields whose names contain underscores are marked as invalid and become subject to the ignore_invalid_headers directive.
  # underscores_in_headers off;

  #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
  #                  '$status $body_bytes_sent "$http_referer" '
  #                  '"$http_user_agent" "$http_x_forwarded_for"';

  #access_log  logs/access.log  main;

      # Log in JSON Format
      # log_format nginxlog_json escape=json '{ "timestamp": "$time_iso8601", '
      # '"remote_addr": "$remote_addr", '
      #  '"body_bytes_sent": $body_bytes_sent, '
      #  '"request_time": $request_time, '
      #  '"response_status": $status, '
      #  '"request": "$request", '
      #  '"request_method": "$request_method", '
      #  '"host": "$host",'
      #  '"upstream_addr": "$upstream_addr",'
      #  '"http_x_forwarded_for": "$http_x_forwarded_for",'
      #  '"http_referrer": "$http_referer", '
      #  '"http_user_agent": "$http_user_agent", '
      #  '"http_version": "$server_protocol", '
      #  '"nginx_access": true }';
      # access_log /dev/stdout nginxlog_json;

  # See Move default writable paths to a dedicated directory (#119)
  # https://github.com/openresty/docker-openresty/issues/119
  client_body_temp_path /var/run/openresty/nginx-client-body;
  proxy_temp_path       /var/run/openresty/nginx-proxy;
  fastcgi_temp_path     /var/run/openresty/nginx-fastcgi;
  uwsgi_temp_path       /var/run/openresty/nginx-uwsgi;
  scgi_temp_path        /var/run/openresty/nginx-scgi;

  sendfile        on;
  #tcp_nopush     on;

  #keepalive_timeout  0;
  keepalive_timeout  65;

  #gzip  on;

  include /etc/nginx/conf.d/*.conf;

  # Don't reveal OpenResty version to clients.
  # server_tokens off;
}
EOF

tee /share/Container/gateway-web/conf.d/default.conf <<'EOF'
server {
  listen       80;
  server_name  localhost;
  #charset koi8-r;
  #access_log  /var/log/nginx/host.access.log  main;
  location / {
    root   /usr/local/openresty/nginx/html;
    index  index.html index.htm;
  }
  error_page  500 502 503 504  /50x.html;
  location = /50x.html {
    root   /usr/local/openresty/nginx/html;
  }
}
EOF

# 创建一个测试页面，用于验证部署成功
echo "<b>docker openresty Test.</b>" >> /share/Container/gateway-web/www/index.html

# 建议创建一个 bridge 网络，避免容器间相互影响，后续需要OpenResty代理的，都安装部署的应用都加入到该网络中。
docker network create --driver bridge --subnet 172.25.0.0/24 --gateway 172.25.0.1 appnet
  # 7be4b7f26e819c17eb8ba8c19aeb3423d741d5003697f322907530cf898c7f82

# 资源清单文件，根据实际物理目录修改映射目录哟！
tee /share/Container/gateway-web/docker-compose.yaml  <<'EOF'
version: '3.9'
services:
  gateway-web:
    container_name: openresty
    image: registry.cn-hangzhou.aliyuncs.com/weiyigeek/openresty:1.25.3.1-4-alpine-apk
    ports:
      - 80:80
      - 443:443
    environment:
      - TZ=Asia/Shanghai
    volumes:
      - /share/Container/gateway-web/nginx.conf:/usr/local/openresty/nginx/conf/nginx.conf
      - /share/Container/gateway-web/conf.d:/etc/nginx/conf.d
      - /share/Container/gateway-web/cert:/etc/nginx/cert
      - /share/Container/gateway-web/www:/usr/local/openresty/nginx/html
    networks:
      - appnet

networks:
  appnet:
    external: true
EOF

# 使用 ssh 或者 QNAP QTS 系统平台，上传证书到NAS中容器证书配置映射目录
cp -a weiyigeek.top.* /share/Container/gateway-web/cert/

# 增加 SSL 配置，
tee /share/Container/gateway-web/default.conf <<'EOF'
server {
  listen       80;
  listen       443 ssl;
  http2 on;
  server_name  nas.weiyigeek.top;

  charset utf-8;
  
  # SSL
  ssl_certificate      /etc/nginx/cert/weiyigeek.top.cer;
  ssl_certificate_key  /etc/nginx/cert/weiyigeek.top.key;
  ssl_session_cache    shared:MozSSL:10m;
  ssl_session_timeout  1d;
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
  ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE:ECDH:AES:HIGH:EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:!NULL:!aNULL:!eNULL:!EXPORT:!PSK:!ADH:!DH:!DES:!MD5:!RC4;
  ssl_prefer_server_ciphers  on;
  
  # HSTS ( http 转 https )
  # add_header Strict-Transport-Security "max-age=15768000;includeSubDomains;preload" always;
  
  # CORS
  add_header Access-Control-Allow-Origin 'https://blog.weiyigeek.top';
  add_header Access-Control-Allow-Methods 'GET,POST,OPTIONS';
  add_header Access-Control-Allow-Headers 'DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization';
  
  # XXS-Protection
  add_header X-XSS-Protection "1; mode=block";
   

  #access_log  /var/log/nginx/host.access.log  main;
  location / {
    root   /usr/local/openresty/nginx/html;
    index  index.html index.htm;
  }
  error_page  500 502 503 504  /50x.html;
  location = /50x.html {
    root   /usr/local/openresty/nginx/html;
  }
}
EOF

/ # nginx -s reload
2024/06/26 01:31:39 [notice] 56#56: signal process started