[Nginx] 写给运维的Nginx秘籍

if ($http_user_agent ~ (Go-http-client/1.1|curl)) {
return 403;
}

map $var1 $var2 { ... }

map $http_user_agent:$arg_key $ban {
~*spider* 1;
~Go-http-client/1.1 1;
~curl;
default 0;
}

if ($ban = 1) {
return 403;
}

deny address | CIDR | unix: | all;

deny 135.125.180.235;

include banip.conf;

deny 135.125.180.235;
deny 135.125.180.1/24;
…

allow 127.0.0.1;
allow 192.168.0.0/18;
allow 110.242.68.66;
…
deny all;

• 全局速率限制100 RPS
• 由User-Agent来限制特定来源(搜索蜘蛛)请求为1RPM。
• 通过API令牌将来自某些可以客户端的请求限制为1RPS。
  

limit_req_zone $binary_remote_addr zone=global:100m rate=100r/s;

map $http_user_agent $crawler {
~*.*( Baiduspider|bot|spider|slurp).* $http_user_agent;
default "";
}
limit_req_zone $crawler zone=crawlers:1M rate=1r/m;

map $http_authorization $eclients {
~.*6d96270004515a0486bb7f76196a72b40c55a47f.* 6d96270004515a0486bb7f76196a72b40c55a47f;
~.*956f7fd1ae68fecb2b32186415a49c316f769d75.* 956f7fd1ae68fecb2b32186415a49c316f769d75;
default "";
}
limit_req_zone $eclients zone=eclients:1M rate=1r/s;

server {
listen 80;
server_name test.show;
limit_req zone=crawlers;
limit_req zone=global;
# ...
}
server {
listen 80;
server_name api.test.show;
# ...
location /heavy/method {
# ...
limit_req zone=eclients;
limit_req zone=global;
# ...
}
# ...
} 
请注意，

• 创建保存速率限制的变量的键。不同键值对应于不同的速率限制区域。
• 空键表示禁用速率限制。
• 使用带限速键的变量来配置限速区域配置。
• 在需要的地方应用速率限制区域limit_req。
• 速率限制将有助于保持系统稳定。
  

http {
limit_conn_zone $binary_remote_addr zone=perip:10m;
limit_conn_zone $server_name zone=perserver:10m;
server {
location / {
limit_conn perip 10;
limit_conn perserver 1000;
}
}
}

http {
# ...
proxy_cache_path /var/cache/nginx/test keys_zone=test:500m max_size=1000m inactive=1d;
# ...
server {
# ...
location /test {
proxy_pass test.show_backend;
proxy_cache test;
proxy_cache_key "$scheme$proxy_host$request_uri $http_customer_token";
proxy_cache_valid 200 302 1d;
proxy_cache_valid 404 400 10m;
}
}
}

proxy_ignore_headers "Cache-Control";

• 设置max_size在 proxy_cache_path限制磁盘的占用。如果nginx需要缓存超过max_size，将从缓存中移除最近最少使用的值
• 设置inactive参数输入proxy_cache_path配置TTL整个缓存区。可以用 proxy_cache_valid指示。
• 最后，添加proxy_cache_valid将指示TTL的指令在给定位置或服务器中缓存项目，这将为缓存设置TTL条目。
  

log_format main '$remote_addr - $remote_user [$time_iso8601] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent - $ssl_client_s_dn $ssl_client_serial $ssl_client_verify" "$http_x_forwarded_for"';

http {
# ...
log_format json escape=json '{'
'"server_name": "test.show",'
'"ts":"$time_iso8601",'
'"remote_addr":"$remote_addr","host":"$host","origin":"$http_origin","url":"$request_uri",'
'"request_id":"$request_id","upstream":"$upstream_addr",'
'"response_size":"$body_bytes_sent","upstream_response_time":"$upstream_response_time","request_time":"$request_time",'
'"status":"$status"'
'"$https_info": "$ssl_client_s_dn $ssl_client_serial $ssl_client_verify"'
'}';
# ...
}

filter {
json {
source => "log"
remove_field => ["log"]
}
}

http {
upstream current {
server backend1;
serverbackend2;
}
upstream new {
server dev.show max_fails=0;
}
split_clients $arg_key $new_api {
5% 1;
* 0;
}
map $new_api:$cookie_app_switch $destination {
~.*:1 new;
~0:.* current;
~1:.* new;
}
server {
# ...
location /api {
proxy_pass $destination/;
}
}
}