安装nginx并配置nginxscript(njs)实现请求头验证或者分流

本文以centos为例

nginx+nginxscript

源码安装nginx

安装必要环境

1. 安装gcc环境

   sudo yum -y install gcc gcc-c++
   

2. 安装 pcre,让nginx支持重写功能,代码如下:

   sudo yum -y install pcre pcre-devel
   

3. 安装 zlib,zlib 库提供了很多压缩和解压缩的方式，nginx 使用 zlib 对 http 包内容进行 gzip 压缩,代码如下

   sudo yum -y install zlib zlib-devel
   

4. 安装 openssl,安全套接字层密码库，用于通信加密,代码如下:

   sudo yum -y install openssl openssl-devel
   

解压Nginx安装包并进行安装

下载源码

#下载
wget http://nginx.org/download/nginx-1.16.1.tar.gz
#解压 nginx版本过新可能无法安装
tar -xzf nginx-1.16.1.tar.gz
cd nginx-1.16.1

编译安装

./configure --prefix=/usr/local/nginx  --prefix=后面为安装Nginx安装目录,我这里是的安装目录是/usr/local/nginx
1. make          ##编译
2. make install  ##安装

源码安装nginxscript

克隆源码

hg clone http://hg.nginx.org/njs

从nginx根目录编译并安装njs

./configure --prefix=/usr/local/nginx --add-dynamic-module=/usr/local/nginx/njs/nginx --with-http_stub_status_module --with-http_ssl_module --with-http_realip_module ## njs源码目录
# ./configure --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module --with-http_realip_module
make install  ##重新安装nginx

将nginx配置为系统服务并开机自启

配置系统服务+开启自启

1. 在/usr/lib/systemd/system目录下添加nginx.service,内容如下:

vim /usr/lib/systemd/system/nginx.service

[Unit]
Description=nginx web service
Documentation=http://nginx.org/en/docs/
After=network.target

[Service]
Type=forking
PIDFile=/usr/local/nginx/logs/nginx.pid
ExecStartPre=/usr/local/nginx/sbin/nginx -t -c /usr/local/nginx/conf/nginx.conf
ExecStart=/usr/local/nginx/sbin/nginx
ExecReload=/usr/local/nginx/sbin/nginx -s reload
ExecStop=/usr/local/nginx/sbin/nginx -s stop
PrivateTmp=true

[Install]
WantedBy=default.target

1. 添加完成后如果权限有问题需要进行权限设置

chmod 755 /usr/lib/systemd/system/nginx.service

1. 使用命令

启动: systemctl start nginx
停止: systemctl stop nginx
重启: systemctl restart nginx
重新加载配置文件: systemctl reload nginx
查看nginx状态: systemctl status nginx
开机启动: systemctl enable nginx

enjoy yourself

使用njs实现请求头参数控制

由于这是加载的动态模块所以需要在根下面引入

# 加载njs模块
load_module modules/ngx_http_js_module.so;

在配置文件中(http下面)导入js文件

js_import dreamer from dreamer_header_check.js;

根conf示例

#user  nobody;
worker_processes  1;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

#pid        logs/nginx.pid;
# 加载njs模块
load_module modules/ngx_http_js_module.so;

events {
    worker_connections  1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;

    # 引入js
    js_import dreamer from dreamer_header_check.js;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  logs/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;

    include /opt/conf/nginx/conf/conf.d/*.conf;
}

在具体的配置文件中使用

server {
    listen  80;
    server_name  admin.hnzmr.com;
        location /admin {
        alias   /data/dreamer/admin/dist;
        index  index.html index.htm;
        }

        location /prod-api/ { ## njs层代理
             js_content dreamer.headers_filter;
        }

        location @admin-backend { ## @真实的代理服务
             proxy_set_header Host $http_host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header REMOTE-HOST $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_pass https://adminapi.hnzmr.com;
        }
}

js文件

// 获取header里面的参数

// 认证参数 token
const authorization ='authorization';
// APP ID(程序唯一标识)
const appId='appId';
// 设备类型 android ios wx h5 web
const os='os';
// 应用版本号
const version='version';

function headers_filter(r){
    r.headersOut['Content-Type'] = "application/json; charset=utf-8";
    // 定义要校验的数组
    var arr = [appId,os,version];
    // 循环数组判断有没有缺少参数
    for(var i=0;i<arr.length;i++){
        if(!r.headersIn[arr[i]]){
            var json={
                code:400,
                msg:"请求头校验不通过,缺少'"+arr[i]+"'参数"
            };
            r . return ( 400 ,  JSON.stringify(json) )  ;
            return;
        }
    }
    // 传递下去
    /* r.subrequest(r.uri).then((response) => {
          r.headersOut["Content-Type"] = "application/json;charset=UTF-8";
          r.return(response.status, JSON.stringify(response));
    }); */
    r.internalRedirect('@admin-backend');
}

function dreamer_headers_filter(r){
    r.headersOut['Content-Type'] = "application/json; charset=utf-8";
    // 定义要校验的数组
    var arr = [appId,os,version];
    // 循环数组判断有没有缺少参数
    for(var i=0;i<arr.length;i++){
        if(!r.headersIn[arr[i]]){
            var json={
                code:400,
                msg:"请求头校验不通过,缺少'"+arr[i]+"'参数"
            };
            r . return ( 400 ,  JSON.stringify(json) )  ;
            return;
        }
    }
    // 传递下去
    /* r.subrequest(r.uri).then((response) => {
          r.headersOut["Content-Type"] = "application/json;charset=UTF-8";
          r.return(response.status, JSON.stringify(response));
    }); */
    r.internalRedirect('@dreamer-backend');
}

export default {headers_filter,dreamer_headers_filter};