AlmaLinux9 nginx リバースプロキシの設定方法

環境
AlmaLinux release 9.2 (Turquoise Kodkod)
nginx

概要
ホスト [www.arkgame.com] の Nginx サーバーで受けた HTTP/HTTPS アクセスを、バックエンドホスト
[node01.arkgame.com] の Nginx サーバーへ転送するよう設定します。

操作方法
1.http用の設定を行います
# vi /etc/nginx/nginx.conf

Plain text
Copy to clipboard
Open code in new window
EnlighterJS 3 Syntax Highlighter
#[server] セクション内を以下のように変更
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name www.arkgame.com;
proxy_redirect off;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
location / {
proxy_pass http://node01.arkgame.com/;
}
}
#[server] セクション内を以下のように変更 server { listen 80 default_server; listen [::]:80 default_server; server_name www.arkgame.com; proxy_redirect off; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $http_host; location / { proxy_pass http://node01.arkgame.com/; } }
#[server] セクション内を以下のように変更
   server {
       listen      80 default_server;
       listen      [::]:80 default_server;
       server_name www.arkgame.com;

       proxy_redirect      off;
       proxy_set_header    X-Real-IP $remote_addr;
       proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_set_header    Host $http_host;

       location / {
           proxy_pass http://node01.arkgame.com/;
       }
   }

2.https用の設定を行います。
# vi /etc/nginx/conf.d/proxy-ssl.conf
# 証明書を置き換え

Plain text
Copy to clipboard
Open code in new window
EnlighterJS 3 Syntax Highlighter
server {
listen 443 ssl http2 default_server;
listen [::]:443 ssl http2 default_server;
server_name www.arkgame.com;
ssl_certificate "/etc/letsencrypt/live/www.arkgame.com/fullchain.pem";
ssl_certificate_key "/etc/letsencrypt/live/www.arkgame.com/privkey.pem";
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 10m;
ssl_ciphers PROFILE=SYSTEM;
ssl_prefer_server_ciphers on;
proxy_redirect off;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
location / {
proxy_pass http://node01.arkgame.com/;
}
}
server { listen 443 ssl http2 default_server; listen [::]:443 ssl http2 default_server; server_name www.arkgame.com; ssl_certificate "/etc/letsencrypt/live/www.arkgame.com/fullchain.pem"; ssl_certificate_key "/etc/letsencrypt/live/www.arkgame.com/privkey.pem"; ssl_session_cache shared:SSL:1m; ssl_session_timeout 10m; ssl_ciphers PROFILE=SYSTEM; ssl_prefer_server_ciphers on; proxy_redirect off; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $http_host; location / { proxy_pass http://node01.arkgame.com/; } }
server {
    listen      443 ssl http2 default_server;
    listen      [::]:443 ssl http2 default_server;
    server_name www.arkgame.com;

    ssl_certificate "/etc/letsencrypt/live/www.arkgame.com/fullchain.pem";
    ssl_certificate_key "/etc/letsencrypt/live/www.arkgame.com/privkey.pem";
    ssl_session_cache shared:SSL:1m;
    ssl_session_timeout  10m;
    ssl_ciphers PROFILE=SYSTEM;
    ssl_prefer_server_ciphers on;

    proxy_redirect      off;
    proxy_set_header    X-Real-IP $remote_addr;
    proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header    Host $http_host;

    location / {
        proxy_pass http://node01.arkgame.com/;
    }
}

3.nginxを再起動します
# systemctl reload nginx

4.SELnux を有効にしている場合は、ブール値を変更します
# setsebool -P httpd_can_network_connect on

5. バックエンド Nginx サーバーで X-Forwarded-For ヘッダーをロギングするよう設定します。

Plain text
Copy to clipboard
Open code in new window
EnlighterJS 3 Syntax Highlighter
# [http] セクション内の [log_format] 設定確認
http {
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
# [server] セクション内に追記
# [set_real_ip_from] は自身の信頼できる内部ネットワークを指定
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name node01.arkgame.com;
root /usr/share/nginx/html;
set_real_ip_from 10.0.0.0/24;
real_ip_header X-Forwarded-For;
# [http] セクション内の [log_format] 設定確認 http { log_format main '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; # [server] セクション内に追記 # [set_real_ip_from] は自身の信頼できる内部ネットワークを指定 server { listen 80 default_server; listen [::]:80 default_server; server_name node01.arkgame.com; root /usr/share/nginx/html; set_real_ip_from 10.0.0.0/24; real_ip_header X-Forwarded-For;
# [http] セクション内の [log_format] 設定確認
http {
        log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                        '$status $body_bytes_sent "$http_referer" '
                        '"$http_user_agent" "$http_x_forwarded_for"';

# [server] セクション内に追記
# [set_real_ip_from] は自身の信頼できる内部ネットワークを指定
    server {
        listen       80 default_server;
        listen       [::]:80 default_server;
        server_name  node01.arkgame.com;
        root         /usr/share/nginx/html;
        set_real_ip_from   10.0.0.0/24;
        real_ip_header     X-Forwarded-For;

nginxを再起動します
# systemctl reload nginx

AlmaLinux 9

Posted by arkgame