[nginx] 參考寫法


ustream beta-admin {
## Default load balancing: round-robin
#least_conn; # Load balancing: by least connections
#ip_hash; # Load balancing: by ip_hash
sticky;
server xxx.xxx.xxx.xxx:8080;
keepalive 1000;
check interval=2000 rise=1 fall=2 timeout=2000 type=http;
check_keepalive_requests 5;
check_http_send "HEAD /admin HTTP/1.0\r\nConnection: keep-alive\r\n\r\n";
check_http_expect_alive http_2xx http_3xx;
}


server {
listen *:80;
server_name beta-admin.style.me;
return 301 https://$host$request_uri;
}


server {
listen 443 ssl http2;
server_name beta-admin.style.me;
underscores_in_headers on;
include conf.d/include/deny_hidden_files_filter;
include conf.d/include/stats_params;
include conf.d/include/drop_params;
include conf.d/include/testcookie_params;
include conf.d/include/ssl_params;
ssl on;
ssl_certificate /etc/ssl/style.me/STAR_style_me.crt;
ssl_certificate_key /etc/ssl/style.me/style.me.key;
ssl_trusted_certificate /etc/ssl/style.me/COMODORSAAddTrustCA.crt;
# iframe, prevent clickjacking
#add_header X-Frame-Options "SAMEORIGIN";
# prevent xss attack
#add_header X-XSS-Protection "1; mo1Gde=block";
# it prevents the browser from doing MIME-type sniffing
#add_header X-Content-Type-Options nosniff;
# client side - for debugging
#add_header X-Proxy-Cache $upstream_cache_status always;
#add_header X-Upstream $upstream_addr always;
#error_page 404 @error_page;
#keepalive_timeout 3; # ~2 seconds is often enough for most
access_log logs/access-beta-admin.style.me.log main;
error_log logs/error-beta-admin.style.me.log warn;
## rewrite root path to admin and match next rules ##
location = / {
rewrite '^/*' https://$host/admin;
}
location /admin {
try_files $uri @proxy;
}
location @proxy {
proxy_redirect off;
proxy_buffering on;
proxy_intercept_errors on;
proxy_next_upstream error timeout http_502 http_503 http_504; # disable error 500, in case of bad coding
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Scheme $scheme;
proxy_redirect http:// $scheme://;
proxy_pass http://beta-admin;
proxy_set_header Connection "";
}
}