nginx - 如何干燥 nginx 配置

Question

我有用于当前和旧应用程序的 nginx 配置，其中两个 block 之间的唯一区别是特定于 DNS 的条目和根路径。如何将配置的特定部分放入变量或其他内容中，然后在两个服务器配置 block 中调用该变量？

server {
  listen                0.0.0.0:443 ssl;
  server_name           mysite.com;
  ssl_certificate       /etc/ssl/server.crt;
  ssl_certificate_key   /etc/ssl/server.key;
  ssl_protocols         SSLv3 TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers           RC4:HIGH:!aNULL:!MD5;
  ssl_session_cache     shared:SSL:15m;
  ssl_session_timeout   15m;

  root /home/deployer/apps/myapp/current/public;

  if ($request_method !~ ^(GET|HEAD|POST)$ ) {
       return 444;
  }

  if ($http_user_agent ~* LWP::Simple|BBBike|wget) {
      return 403;
  }

  if ($http_user_agent ~* (spider|AcoiRobot|msnbot|scrapbot|catall|wget) ) {
      return 403;
  }

  location ^~ /assets/ {
    gzip_static on;
    gzip_vary on;
    expires max;
    add_header Cache-Control public;
  }
  location ~ \.(gif|png|jpe?g|JPE?G|GIF|PNG {
      valid_referers none blocked mysite.com *.mysite.com;
      if ($invalid_referer) {
        return   403;
      }
  }
  location /evil/ {
     valid_referers none blocked mysite.com *.mysite.com;
     if ($invalid_referer) {
        return   403;
    }
  }

  try_files $uri/index.html $uri @puma;
  location @puma {
    proxy_set_header  X-Real-IP       $remote_addr;
    proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header  X-Forwarded-Proto https;
    proxy_set_header  Host $http_host;
    proxy_redirect    off;
    proxy_pass        http://puma;
  }

  error_page 500 502 503 504 /500.html;
  client_max_body_size 4G;
  keepalive_timeout 10;
}

我怎样才能干掉 root下面的所有东西线？

Answer 1

时间证明了 Alexey Ten 关于使用 include 的评论成为正确的方法。

我们在生产中使用它:
/etc/nginx 中的文件结构

nginx.conf
sites-enabled/app_config
modules/shared_serve
modules/shared_ssl_settings

在 /etc/nginx/sites-enabled/app_config :

upstream puma {
  server unix:/tmp/puma.socket fail_timeout=1;
}

server {
  server_name example.com;
  ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

  include modules/shared_ssl_settings;

  include modules/shared_serve;
}

在 /etc/nginx/modules/shared_ssl_settings :

listen                443 ssl;
listen                [::]:443;
ssl                   on;
ssl_protocols         TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers On;

ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';

ssl_session_timeout  1d;
ssl_session_cache    shared:SSL:30m;
ssl_stapling         on;
ssl_stapling_verify  on;
add_header           Strict-Transport-Security max-age=15768000;

在 /etc/nginx/modules/shared_serve :

location ~ \.(php|aspx|asp|myadmin)$ { return 444; log_not_found off; }

root /home/deployer/apps/example_app/current/public;

try_files $uri/index.html $uri @puma;

location @puma {
  proxy_set_header  X-Real-IP       $remote_addr;
  proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header  X-Forwarded-Proto https;
  proxy_set_header  Host $http_host;
  proxy_redirect    off;
  proxy_pass        http://puma;
}

error_page 500 502 503 504 /500.html;
client_max_body_size 4G;
keepalive_timeout 10;

唯一的问题是您的部署脚本必须确保 /etc/nginx 中的文件结构.当然，您可以将模块目录命名为其他任何名称。您甚至可以将可包含的文件保留在 /etc/nginx 中。没有子目录。