Nginx 反向代理https

Nginx 反向代理https

一、代理nginx开启80，443端口
############################################################################
# cat /etc/nginx/conf.d/nginx_http.conf
# 设置通过http域名访问的时候直接跳转https
server {
listen 80;
server_name www.meteor-yu.com;
rewrite ^/(.*) https://$server_name/$1 permanent;
}
# 设置不允许IP访问
server {
listen 80 default_server;
server_name _;
return 403;
}
# 设置通过http访问顶级域名meteor-yu.com自动跳转https访问www.meteor-yu.com这个域名
server {
listen 80;
server_name meteor-yu.com;
return 301 https://www.meteor-yu.com$request_uri; }

############################################################################
二、创建自签名证书
# cat /etc/nginx/conf.d/nginx_https.conf
# 创建自签名证书，并添加到配置中
server {
listen 443;
server_name www.meteor-yu.com;

ssl on;
ssl_certificate conf.d/server.crt;
ssl_certificate_key conf.d/server.key;

access_log /var/log/nginx/staff_assessing_system_access.log main;
error_log /var/log/nginx/staff_assessing_system_error.log;
location / {
proxy_next_upstream http_502 http_504 error timeout invalid_header;
proxy_ignore_client_abort on;
proxy_connect_timeout 60s;
proxy_read_timeout 5400s;
proxy_send_timeout 5400s;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://10.10.10.10:84; # 转发到后台的web端口，这里是后台web是84端口，后台访问仍然是http
}
}
# 不允许https直接IP访问
server {
listen 443 default_server;
server_name _;
ssl on;
ssl_certificate /etc/nginx_ssl/server.crt;
ssl_certificate_key /etc/nginx_ssl/server.key;
return 403;
}
# 设置通过https访问顶级域名meteor-yu.com自动跳转到www.meteor-yu.com这个域名
server {
listen 443;
ssl on;
ssl_certificate /etc/nginx_ssl/server.crt;
ssl_certificate_key /etc/nginx_ssl/server.key;
server_name meteor-yu.com;
return 301 https://www.meteor-yu.com$request_uri; }

############################################################################