Методические материалы Лохтурова Вячеслава

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Сервис HTTP ======

  * [[http://ru.wikipedia.org/wiki/HTTP|HyperText Transfer Protocol — протокол передачи гипертекста]]

===== URL =====

  * [[http://ru.wikipedia.org/wiki/URL|Uniform Resource Locator, URL — единообразный локатор (определитель местонахождения) ресурса]]

<code>
<схема>://<логин>:<пароль>@<хост>:<порт>/<URL‐путь>?<параметры>#<якорь>
</code>

===== Пример HTTP диалога =====
<code>
# nc -C ya.ru 80

# telnet ya.ru 80
</code><code>
GET / HTTP/1.1
Host: ya.ru
Accept-Encoding: gzip, deflate
</code>

===== Примеры HTML =====

==== Статический документ =====
<code>
# cat /var/www/html/index.html
</code><code>
<HTML>
  <HEAD>
    <META HTTP-EQUIV="Refresh" CONTENT="4;URL=http://google.ru">
    <META HTTP-EQUIV="Content-Type" CONTENT="text/html;charset=UTF-8">
  </HEAD>
  <BODY text="blue">
    <!--
      THis is comment
    -->
    <PRE>
text
  as
    is
    </PRE>
    <H1>Go to Google</H1>
    <A HREF=https://freebsd.org/>
    <IMG SRC=https://www.freebsd.org/logo/logo-full.png>
    </A> 
  </BODY>
</HTML>
</code>

==== Форма ====

  * [[http://server.corpX.un/asterisk/]]

<code>
# mkdir /var/www/html/asterisk/

# cat /var/www/html/asterisk/index.html
</code><code>
<html>
<body>
  <h1>Enter phone number</h1>
  <form action=call.php>
    <input name=phone>
    <input value="Call me" type=submit>
  </form>
</body>
</html>
</code>
===== Установка и запуск сервера Apache =====

==== Debian/Ubuntu ====
<code>
root@server:~# apt install apache2
</code>

==== FreeBSD ====
<code>
[server:~] # pkg install apache24

[server:~] # sysrc apache24_enable=yes

[server:~] # service apache24 start
</code>

==== CentOS ====

  * Сервис Firewall [[Сервис Firewall#CentOS 7]]

<code>
[root@server ~]# yum install httpd

[root@server ~]# systemctl status httpd
</code>
==== Windows ====

  * [[http://httpd.apache.org/docs/current/platform/windows.html|Using Apache HTTP Server on Microsoft Windows]]
  * [[http://www.apachefriends.org/en/xampp.html|XAMPP Apache + MariaDB + PHP + Perl]]

===== Базовая конфигурация =====

==== Управление кодировкой ====

<code>
# cat /etc/apache2/sites-available/000-default.conf
</code><code>
...
        AddDefaultCharset utf-8
...
</code>

==== Изменение порта ====

  * [[https://www.tecmint.com/change-apache-port-in-linux/|How to Change Apache HTTP Port in Linux]]
==== Свойство Indexes каталогов ====

  * [[http://www.corpX.un/]]
  * [[http://www.corpX.un/hosts]]

=== FreeBSD ===
<code>
[server:~] # rm /usr/local/www/apache24/data/index.html

[server:~] # cp /etc/hosts /usr/local/www/apache24/data/

[server:~] # rcsdiff /usr/local/etc/apache24/httpd.conf
389c389
</code>

=== Debian/Ubuntu ===
<code>
root@server:~# DOCROOT='/var/www/html'

root@server:~# rm $DOCROOT/index.html

root@server:~# cp /etc/hosts $DOCROOT

root@server:~# rcsdiff /etc/apache2/sites-available/default

root@server:~# rcsdiff /etc/apache2/sites-available/*default.conf
11c11
</code>

=== FreeBSD/Ubintu ===
<code>
<     Options Indexes FollowSymLinks 
---
>     Options FollowSymLinks 
</code>

==== Использование алиасов ====

<code>
Alias /share "/usr/share/"

<Directory "/usr/share/">
  Options Indexes FollowSymLinks
  AllowOverride All
  Require all granted
  Allow from all
</Directory>
</code>

  * [[http://www.corpX.un/share]]

=== FreeBSD ===
<code>
[server:~] # cat /usr/local/etc/apache24/httpd.conf
</code><code>
...
Include etc/apache24/extra/httpd-manual.conf
...
</code>

http://www.corpX.un/manual/

=== Debian/Ubuntu ===
<code>
root@server:~# cat /etc/apache2/sites-available/default

root@server:~# cat /etc/apache2/sites-available/*default.conf
</code><code>
...
    Alias /doc/ "/usr/share/doc/"
    <Directory "/usr/share/doc/">
        Options Indexes MultiViews FollowSymLinks
        AllowOverride None
#        Order deny,allow
#        Deny from all
#        Allow from 127.0.0.0/255.0.0.0 ::1/128
    </Directory>
... 
</code>

  * [[http://www.corpX.un/doc]]
==== Использование домашних каталогов ====

  * [[http://www.corpX.un/~user1/]]

=== Debian/Ubuntu ===
<code>
root@server:~# a2enmod userdir

root@server:~# service apache2 restart
</code>



=== Debian/Ubuntu===
<code>
server# mkdir ~user1/public_html/

server# cat ~user1/public_html/index.html
</code><code>
<h1>Hello World from user1</h1>
</code><code>
server# chown -R user1 ~user1/public_html/
</code>

===== Использование виртуальных хостов =====

  * [[http://user1.corpX.un/]]

==== Debian/Ubuntu ====

<code>
root@server:~# cat /etc/apache2/sites-available/mail.conf
</code><code>
<VirtualHost *:80>
     ServerName mail.corpX.un
#    ServerAlias www.mail.corpX.un
     DocumentRoot /var/lib/roundcube
</VirtualHost>
</code><code>
root@server:~# a2ensite mail

root@server:~# apachectl -t
</code>

<code>
root@server:~# cat /etc/apache2/sites-available/user1.conf
</code><code>
<VirtualHost *:80>
     ServerName user1.corpX.un
#    ServerAlias www.user1.corpX.un
     DocumentRoot /home/user1/public_html
</VirtualHost>
</code><code>
root@server:~# a2ensite user1

root@server:~# apachectl -t
</code>

==== FreeBSD ====
<code>
[server:~] # cat /usr/local/etc/apache24/extra/httpd-vhosts.conf
</code><code>
<VirtualHost *>
    DocumentRoot /usr/local/www/apache24/data/
</VirtualHost>

<VirtualHost *>
    ServerName user1.corpX.un
#    ServerAlias www.user1.corpX.un
    DocumentRoot /home/user1/public_html/
</VirtualHost>
</code>

<code>
[server:~] # cat /usr/local/etc/apache24/httpd.conf
</code><code>
...
LoadModule vhost_alias_module libexec/apache24/mod_vhost_alias.so
...
Include etc/apache24/extra/httpd-vhosts.conf
...
</code>

===== Использование директивы Redirect =====

  * [[http://www.yolinux.com/TUTORIALS/ApacheRedirect.html|List of methods used to redirect a web site using Apache]]

==== Debian/Ubuntu ====
<code>
root@lan:~# cat /etc/apache2/sites-available/000-default.conf
</code><code>
#...
  Redirect permanent / https://www.corpX.un/
#... 
</code>

==== FreeBSD ====
<code>

</code>

===== Сокрытие версии сервиса =====

  * [[http://nxlinuxadmin.blogspot.com/2011/01/how-to-hide-apache-version-server-info.html|
How to hide Apache Version | Server Info | Signature | Header Information | Httpd Php Version]]

==== Debian/Ubuntu ====
<code>
# cat /etc/apache2/conf-enabled/security.conf
</code><code>
...
ServerTokens Prod
...
ServerSignature Off
...
</code><code>
/etc/init.d/apache2 restart
</code>
==== FreeBSD ====
<code>
# cat /usr/local/etc/apache24/extra/httpd-default.conf
</code><code>
...
ServerTokens Prod
...
ServerSignature Off
...
</code><code>
# cat /usr/local/etc/apache24/httpd.conf
</code><code>
...
Include etc/apache22/extra/httpd-default.conf
...
</code><code>
# /usr/local/etc/rc.d/apache24 restart
</code>
===== SSI интерфейс сервера =====

  * [[https://httpd.apache.org/docs/current/mod/mod_include.html|Apache Module mod_include]]

==== Debian/Ubuntu ====
<code>
# a2enmod include

# cat /etc/apache2/sites-available/000-default.conf
</code><code>
...
        <Directory /var/www/html/asterisk/>
             Options +Includes
             DirectoryIndex index.shtml
...
        </Directory>
...
</code><code>
# cat /var/www/html/asterisk/index.shtml
</code><code>
...
  <h1>Your ip address: <!--#echo var="REMOTE_ADDR" --><h1>
  <h1>Your login is: <!--#echo var="REMOTE_USER" --><h1>
<!--#if expr='-R "172.16.48.0/22"' -->
...
<!--#endif -->
...
</code>
===== CGI интерфейс сервера =====

  * [[http://lectureswww.readthedocs.io/5.web.server/cgi.html|CGI — Основы Веб-программирования]]
  * [[http://httpd.apache.org/docs/1.3/howto/cgi.html|Dynamic Content with CGI]]
  * [[http://www.cgi101.com/book/ch3/text.html|CGI Environment Variables]]
==== ScriptAlias ====

=== Debian/Ubuntu ===
<code>
root@server:~# a2enmod cgid

root@server:~# cd /usr/lib/cgi-bin/
</code>

=== FreeBSD ===
<code>
[server:~] # cat /usr/local/etc/apache24/httpd.conf
</code><code>
...
LoadModule mpm_prefork_module libexec/apache24/mod_mpm_prefork.so
...
<IfModule mpm_prefork_module>
        LoadModule cgi_module libexec/apache24/mod_cgi.so
</IfModule>
...
</code><code>
[server:~] # cd /usr/local/www/apache24/cgi-bin/
</code>

=== Пример скрипта CGI ===
<code>
server# cat test-cgi
</code><code>
#!/bin/sh

echo Content-type: text/plain
echo

echo Hello $REMOTE_ADDR
echo You type: $QUERY_STRING

env
</code><code>

server# chmod 755 test-cgi
</code>

  * [[http://server.corpX.un/cgi-bin/test-cgi]]
  * [[http://server.corpX.un/cgi-bin/test-cgi?qwerty]]

==== Свойство ExecCGI каталогов ====

=== FreeBSD ===
<code>
[server:~] # rcsdiff /usr/local/etc/apache24/extra/httpd-userdir.conf
18c18,19
<     Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
---
>     Options ExecCGI MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
>     AddHandler cgi-script .cgi
</code>

=== Ubuntu ===
<code>
root@server:~# rcsdiff /etc/apache2/sites-available/default
11c11,12
<               Options FollowSymLinks MultiViews
---
>               Options ExecCGI FollowSymLinks MultiViews
>               AddHandler cgi-script .cgi .pl

</code>

=== FreeBSD/Ubuntu ===
<code>
server# cd ~user1/public_html/

server# cat test.cgi
</code><code>
#!/bin/sh

echo Content-type: text/plain
echo

echo Hello $REMOTE_ADDR
echo You type: $QUERY_STRING
</code><code>

server# chmod +x test.cgi
</code>

  * Язык программирования Perl [[Язык программирования Perl#Пример 6]]

=== Проверки ===

  * http://server.corpX.un/test.cgi
  * http://server.corpX.un/hosts
  * http://server.corpX.un/
  * http://server.corpX.un/hello.pl?name=ivanov

===== Управление модулями http сервера =====

<code>
# apachectl -t -D DUMP_MODULES
</code>
===== Модуль php =====

==== Debian/Ubuntu ====
<code>
root@server:~# apt install libapache2-mod-php

root@server:~# ls /etc/apache2/mods-enabled/ | grep php
...

root@server:~# cd /var/www/html
</code>

==== FreeBSD ====

<code>
[server:~] # pkg install mod_php56 php56
</code>

  * Язык программирования PHP ([[Язык программирования PHP#Настройка]])

<code>
[server:~] # cat /usr/local/etc/apache24/httpd.conf
</code><code>
...
LoadModule php5_module        libexec/apache2?/libphp5.so
...
<IfModule dir_module>
    DirectoryIndex index.html index.php
...
<IfModule mime_module>
    AddType application/x-httpd-php .php
...
</code><code>
[server:~] # service apache24 restart

[server:~] # cd /usr/local/www/apache24/data/
</code>

==== Windows ====

=== Вариант 1 ===

[[http://www.apachefriends.org/en/xampp.html]]

=== Вариант 2 ===

[[http://windows.php.net/download/]]

  * Модуль Apache только в много поточной версии
  * Версия Apache должна совпадать

<code>
C:\>notepad++ Apache22\conf\httpd.conf
</code><code>
...
LoadModule php5_module C:\php\php5apache2_2.dll
...
<IfModule dir_module>
    DirectoryIndex index.html index.php
...
<IfModule mime_module>
    AddType application/x-httpd-php .php
...
</code>

=== Настройка ===

  * Язык программирования PHP ([[Язык программирования PHP#Настройка]])

==== FreeBSD/Ubuntu/Windows ====

  * Пример WEB скрипта ([[Язык программирования PHP#Использование phpinfo]])

===== Поддержка протокола HTTPS =====

  * [[Letsencrypt Certbot]]
  * [[https://stackoverflow.com/questions/31370454/sslcertificatechainfile-is-obsolete|SSLCertificateChainFile is now obsolete, and any intermediate certificates are supposed to be included in the server certificate file]]
==== Debian/Ubuntu ====
<code>
# a2enmod ssl

# cat /etc/apache2/sites-available/default-ssl*
</code><code>
...
       SSLCertificateFile    /root/www.crt
       SSLCertificateKeyFile /root/www.key
...
       # SSLProtocol All -SSLv2 -SSLv3
...
</code><code>
# a2ensite default-ssl

# service apache2 restart
</code>

==== Редирект HTTP на HTTPS ====
<code>
# a2enmod rewrite

# cat /etc/apache2/sites-available/000-default.conf
</code><code>
<VirtualHost *:80>
...
    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
...
</code><code>
# service apache2 restart
</code>
==== FreeBSD ====
<code>
# cat /usr/local/etc/apache24/httpd.conf
</code><code>
...
LoadModule socache_shmcb_module libexec/apache24/mod_socache_shmcb.so
...
LoadModule ssl_module libexec/apache24/mod_ssl.so
...
Include etc/apache24/extra/httpd-ssl.conf
...
</code><code>
# cat /usr/local/etc/apache24/extra/httpd-ssl.conf
</code><code>
...
ServerName www.corpX.un:443
ServerAdmin noc@corpX.un
...
#SSLProtocol All -SSLv2 -SSLv3
...
SSLCertificateFile "/root/www.crt"
...
SSLCertificateKeyFile "/root/www.key"
...
</code> 



===== Управление доступом к HTTP серверу =====


==== Управление доступом к HTTP серверу на основе сетевых адресов ====

  * [[https://httpd.apache.org/docs/current/upgrading.html|Upgrading to 2.4 from 2.2]]

=== Debian/Ubuntu ===
<code>
root@server:~# cat /etc/apache2/sites-available/000-default*
</code><code>
...
        <Directory /var/www/html>
                #Order Deny,Allow
                #Deny from all
                #Allow from 192.168.X.0/24
                #Allow from 127.0.0.1
                Require ip 127.0.0.1 192.168.X.0/24
        </Directory>

...
</code>

=== FreeBSD ===
<code>
[server:~] # cat /usr/local/etc/apache24/httpd.conf
</code><code>
...
DocumentRoot "/usr/local/www/apache24/data"
<Directory "/usr/local/www/apache24/data">
        Order Deny,Allow
        Deny from all
        Allow from 192.168.X.0/24
        Allow from 127.0.0.1
...
</code>

==== Управление доступом к HTTP серверу на основе Basic аутентификации ====

=== Debian/Ubuntu/FreeBSD ===
<code>
# touch /etc/http_passwd

# htpasswd /etc/http_passwd user1
New password: password1
...

# htpasswd /etc/http_passwd 401
New password: password1
...

# cat /etc/http_passwd
...

# cat /etc/http_group
</code><code>
group1: user1 user2
</code><code>
# htpasswd -D /etc/http_passwd user1
</code>

=== Debian/Ubuntu ===
<code>
root@server:~# cat /etc/apache2/sites-available/000-default.conf
</code><code>
...
        <Directory /var/www/html/phoneconf>
#            AllowOverride AuthConfig

#            AuthType Basic
#            AuthName "Require Auth"
#            AuthUserFile /etc/http_passwd
#            Require valid-user
#            Require user user1 user2
#            AuthGroupFile /etc/http_group
#            Require group group1
        </Directory>
...
</code>

=== FreeBSD ===
<code>
[server:~] # cat /usr/local/etc/apache24/extra/httpd-vhosts.conf
</code><code>
...
    <Directory /usr/local/www/apache24/data/asterisk>
#            AllowOverride AuthConfig

#            AuthType Basic
#            AuthName "Require Auth"
#            AuthUserFile /etc/http_passwd
#            Require valid-user
#            Require user user1 user2
#            AuthGroupFile /etc/http_group
#            Require group group1
    </Directory>
...
</code>

=== Debian/Ubuntu/FreeBSD ===

<code>
# cat asterisk/.htaccess
</code><code>
AuthType Basic
AuthName "Require Auth"
AuthUserFile /etc/http_passwd
Require user 401 402
</code>
==== Управление доступом к HTTP серверу на основе сертификатов ====

  * [[http://www.garex.net/apache/|Client certificates with apache]]
  * [[Пакет OpenSSL#Интерактивное подключение по ssl]]

=== Debian/Ubuntu ===
<code>
# cat /etc/apache2/sites-available/default-ssl*
</code><code>
...
       DocumentRoot /var/www/html
       <Directory /var/www/html/>
#               SSLRequire %{SSL_CLIENT_S_DN_CN}  in {"user1","user2"}
#               SSLRequire %{SSL_CLIENT_S_DN_OU}  eq "group1"
       </Directory> 
...
       SSLCertificateFile /root/www.crt
       SSLCertificateKeyFile /root/www.key
...
       SSLCACertificateFile /root/ca.crt
...
       #SSLCARevocationFile /root/ca.crl
...
       SSLVerifyClient require 
... 
</code>

=== FreeBSD ===
<code>
# cat /usr/local/etc/apache24/extra/httpd-ssl.conf
</code><code>
...
<Directory "/usr/local/www/apache24/data">
#               SSLRequire %{SSL_CLIENT_S_DN_CN}  in {"user1","user2"}
#               SSLRequire %{SSL_CLIENT_S_DN_OU}  eq "group1"
</Directory>
...
SSLCertificateFile "/root/www.crt"
...
SSLCertificateKeyFile "/root/www.key"
...
SSLCACertificateFile "/root/ca.crt"
...
#SSLCARevocationFile "/root/ca.crl"
...
SSLVerifyClient require
...
</code>

==== Управление доступом к HTTP серверу с использованием GSSAPI аутентификации ====

  * [[http://modauthkerb.sourceforge.net/configure.html|Kerberos Moduse for Apache]]
  * [[http://port25.technet.com/archive/2008/01/25/technical-analysis-apache-with-mod-auth-kerb-and-windows-server.aspx|echnical Analysis: Apache with mod_auth_kerb and Windows Server]]
  * Регистрация принципала: [[Аутентификация доступа к SQUID#Kerberos GSSAPI аутентификация]]

=== Ubuntu ===
<code>
# apt-get install libapache2-mod-auth-kerb

# cat /etc/apache2/sites-available/default
</code><code>
...
        <Directory />
                AuthType Kerberos
                KrbMethodK5Passwd off
                KrbMethodNegotiate on
                Require valid-user
...
</code>

=== FreeBSD ===
<code>
# pkg_add -r mod_auth_kerb2
</code>
или
<code>
# cd /usr/ports/www/mod_auth_kerb2/

# make configure

# cat work/mod_auth_kerb-5.4/Makefile
</code><code>
...
#KRB5_LDFLAGS = -L/usr/lib -lgssapi -lheimntlm -lkrb5 -lhx509 -lcom_err -lcrypto -lasn1 -lroken -lcrypt
KRB5_LDFLAGS = -L/usr/lib -lgssapi_krb5 -lgssapi -lheimntlm -lkrb5 -lhx509 -lcom_err -lcrypto -lasn1 -lroken -lcrypt

# make install clean

# cat /usr/local/etc/apache22/httpd.conf
</code><code>
...
LoadModule auth_kerb_module    modules/mod_auth_kerb.so
...
<Directory />
    AuthType Kerberos
    KrbMethodK5Passwd off
    KrbMethodNegotiate on
    Require valid-user
...
</code>

=== Firefox ===

[[http://grolmsnet.de/kerbtut/firefox.html]]

==== Управление доступом к HTTP серверу с использованием OpenID аутентификации ====

  * [[https://github.com/zmartzone/mod_auth_openidc/wiki/GitLab-OAuth2]]
  * [[Инструмент GitLab#Сервер OpenID]] из GitLab
  * [[Сервис Keycloak]]

  * [[https://www.janua.fr/using-apache2-mod_auth_openidc-module-with-keycloak-openid-connect/|Using apache2 mod_auth_openidc module with Keycloak (OpenID Connect)]]

<code>
gate# apt install libapache2-mod-auth-openidc
</code><code>
# cat /etc/apache2/conf-available/serve-cgi-bin.conf
</code><code>
...
        <IfDefine ENABLE_USR_LIB_CGI_BIN>

                ## GitLab
                OIDCSSLValidateServer Off
                OIDCProviderMetadataURL https://server.corpX.un/.well-known/openid-configuration
                OIDCRedirectURI http://gate.corpX.un/cgi-bin/test-cgi
                OIDCClientID e...............................................4         #Application ID
                OIDCClientSecret 7.................................................4   #Secret
                OIDCCryptoPassphrase anystring

                ## Keycloak
                OIDCSSLValidateServer Off
                OIDCProviderMetadataURL https://keycloak.corpX.un/realms/corpX/.well-known/openid-configuration
                OIDCRedirectURI http://gate.corpX.un/cgi-bin/test-cgi
                #OIDCClientID test-cgi
                OIDCClientID any-client
                OIDCCryptoPassphrase anystring
...
                        #Require all granted
                        AuthType openid-connect
                        Require valid-user
...
</code><code>
# a2enmod auth_openidc
</code><code>
Проверка: http://gate.corpX.un/cgi-bin/test-cgi/    !!! Последний / обязательно !!!
</code>

===== Протокол WebDAV =====

==== Ubuntu ====

  * [[https://www.digitalocean.com/community/tutorials/how-to-configure-webdav-access-with-apache-on-ubuntu-14-04|How To Configure WebDAV Access with Apache on Ubuntu 14.04]]
  * [[http://stackoverflow.com/questions/29379321/webdav-a-directory-per-user|webdav: a directory per-user]]

<code>
# a2enmod dav

# a2enmod dav_fs

# mkdir /var/www/share
# chown www-data /var/www/share

# cat /etc/apache2/sites-available/default
</code><code>
...
Alias /share /var/www/share

<Directory /var/www/share>
    Options Indexes
    DAV On
    Order allow,deny
    allow from all
</Directory>
...
</code><code>
# service apache2 restart
</code>

===== NGINX =====

  * [[https://mail.bmstu.ru:9100/~val/Mastering%20NGINX%20RUS.pdf]]
  * [[https://blog.sefdar.ru/nginx-%D0%BF%D0%B5%D1%80%D0%B5%D0%BD%D0%B0%D0%BF%D1%80%D0%B0%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F-proxy_redirect-%D0%B8-redirect/|NGINX перенаправления proxy_redirect и redirect]]

<code>
gate# apt install nginx
</code>
==== Прокси "красивого" URL в приложение (пример 1) ====
<code>
gate# cat /etc/nginx/sites-available/user1
</code><code>
server {
        listen 80;
        server_name server.corpX.un corpX.un;
        location / {
                proxy_pass http://server.corpX.un/~user1/;
        }
}
</code>
=== Подключение, тестирование, применение и мониторинг конфигурации ===
<code>
# ln -s /etc/nginx/sites-available/user1 /etc/nginx/sites-enabled/user1

# service nginx configtest
# tail /var/log/nginx/error.log
  или
# nginx -t #-c /etc/nginx/nginx.conf
  или
# nginx -T

# service nginx restart

# tail -f /var/log/nginx/access.log -f /var/log/nginx/error.log
</code><code>
gate.isp.un$ wget -O - -q http://server.corpX.un
</code>

==== Прокси с балансировкой (пример 2) ====

<code>
# cat /etc/nginx/sites-available/myapp1
</code><code>
    upstream myapp1 {
        server server.corpX.un;
        server server2.corpX.un;
    }

    server {
        listen 80;
        server_name server.corpX.un corpX.un;

        location / {
            proxy_pass http://myapp1;
        }
    }
</code>

  * [[#Подключение, тестирование, применение и мониторинг конфигурации]]

==== Прокси "красивого" URL в приложение (пример 3) ====

<code>
# host mail
# host webd
# host www
# host autoconfig
# host corpX.un

... has address 192.168.X.10

root@server# cat /var/opt/gitlab/nginx/conf/corpX.conf
</code><code>
    server {
        listen 80;
        server_name webd.corpX.un;

        location / {
            proxy_pass http://192.168.49.2:30111/;
        }
    }
    server {
        listen 80;
        server_name mail.corpX.un;
        return 301 http://server.corpX.un:81/mail;
#        return 301 http://gate.corpX.un:81/mail;
    }
    server {
        listen 80;
        server_name corpX.un www.corpX.un;

        location / {
            proxy_pass http://server.corpX.un:81/;
        }
    }
#    server {
#        listen 80;
#        server_name autoconfig.corpX.un;
#        location / {
#            proxy_pass http://gate.corpX.un:81/;
#        }
#    }
</code><code>
# cat /etc/gitlab/gitlab.rb
</code><code>
...
nginx['custom_nginx_config'] = "include /var/opt/gitlab/nginx/conf/corpX.conf;"
...
</code>
  * [[Инструмент GitLab#Проверка конфигурации и перезапуск]]
<code>
root@server# less /var/opt/gitlab/nginx/conf/nginx.conf
</code><code>
...
  include /var/opt/gitlab/nginx/conf/corpX.conf;
}
</code><code>
root@server# /opt/gitlab/embedded/sbin/nginx -p /var/opt/gitlab/nginx -t
</code><code>
root@server# gitlab-ctl restart nginx
</code>

==== HTTPS Прокси (пример 4) ====

<code>
gate1.corp13.un:~# cat /etc/nginx/sites-available/gowebd
</code><code>
    server {
        listen 80;
        server_name gowebd.corp13.un;
        return 301 https://gowebd.corp13.un$request_uri;
    }

    server {
        listen 443 ssl;
        server_name gowebd.corp13.un;
        ssl_certificate /root/gowebd.crt;
        ssl_certificate_key /root/gowebd.key;

        location / {
            proxy_pass http://192.168.13.64;

#            proxy_set_header Host            $host;
#            proxy_set_header X-Forwarded-For $remote_addr;

#            proxy_set_header X-Forwarded-Proto $scheme;
#            proxy_set_header X-Forwarded-Port $server_port;
        }
    }
</code>


  * [[#Подключение, тестирование, применение и мониторинг конфигурации]]
Методические материалы Лохтурова Вячеслава

User Tools

Site Tools

Page Tools
