wjf8882300/openresty repository overview

    upstream apiServer {
        server 172.19.115.15 weight=1;
        server 172.19.115.50 weight=1;
    }
 
    server{
        listen       80;
        server_name  xxx;

        location ^~ /actuator/ {
            deny all;
        }

        location ^~ /null/ {
           deny all;
        }

        location / {
            access_by_lua_file /etc/nginx/lua/check_realip.lua;

			if ( $http_origin ~ (https?://(.+\.)?(xxx|localhost)(\.(?:cn|net|com))?(:[0-9]+)?$)){
				 set $allow_url $http_origin;
			}
			#CORS(Cross Orign Resource-Sharing)跨域控制配置
			#是否允许请求带有验证信息
			add_header Access-Control-Allow-Credentials true;
			#允许跨域访问的域名,可以是一个域的列表，也可以是通配符*
			add_header Access-Control-Allow-Origin $allow_url;
			#允许脚本访问的返回头
			add_header Access-Control-Allow-Headers 'Content-Type, Accept, X-Requested-With, remember-me, clienttype, x-auth-token, websource, custtype, appsource';
			#允许使用的请求方法，以逗号隔开
			add_header Access-Control-Allow-Methods 'POST,GET,OPTIONS,PUT,DELETE';
			#允许时长
			add_header Access-Control-Max-Age '3600';

			if ($request_method = 'OPTIONS') {
				return 204;
		    }

            client_max_body_size 10m;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_pass http://apiServer/;
            proxy_ignore_client_abort on;
        }

        error_page 404 /404.html;
            location = /40x.html {
        }

        error_page 500 502 503 504 /50x.html;
            location = /50x.html {
        }
    }

FROM openresty/openresty:1.17.8.2-alpine

# 解决容器时间和宿主主机时间不一致问题
RUN apk update && apk add tzdata curl
ENV TZ Asia/Shanghai
RUN /bin/cp /usr/share/zoneinfo/${TZ} /etc/localtime && echo '${TZ}' >/etc/timezone

# 复制文件
COPY lua /etc/nginx/lua
COPY nginx.conf /usr/local/openresty/nginx/conf/nginx.conf

# nginx.conf  --  docker-openresty
#
# This file is installed to:
#   `/usr/local/openresty/nginx/conf/nginx.conf`
# and is the file loaded by nginx at startup,
# unless the user specifies otherwise.
#
# It tracks the upstream OpenResty's `nginx.conf`, but removes the `server`
# section and adds this directive:
#     `include /etc/nginx/conf.d/*.conf;`
#
# The `docker-openresty` file `nginx.vh.default.conf` is copied to
# `/etc/nginx/conf.d/default.conf`.  It contains the `server section
# of the upstream `nginx.conf`.
#
# See https://github.com/openresty/docker-openresty/blob/master/README.md#nginx-config-files
#

user  nobody;
worker_processes  auto;

error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

#pid        logs/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

    lua_shared_dict ip_blacklist 4m;

    log_format  main  '{"@timestamp":"$time_iso8601",'
                  '"@source":"$server_addr",'
                  '"hostname":"$hostname",'
                  '"ip":"$remote_addr",'
                  '"client":"$remote_addr",'
                  '"request_method":"$request_method",'
                  '"scheme":"$scheme",'
                  '"domain":"$server_name",'
                  '"referer":"$http_referer",'
                  '"request":"$request_uri",'
                  '"args":"$args",'
                  '"size":$body_bytes_sent,'
                  '"status": $status,'
                  '"responsetime":$request_time,'
                  '"upstreamtime":"$upstream_response_time",'
                  '"upstreamaddr":"$upstream_addr",'
                  '"http_user_agent":"$http_user_agent",'
                  '"https":"$https"'
                  '}';

    access_log  logs/access.log  main;


    # See Move default writable paths to a dedicated directory (#119)
    # https://github.com/openresty/docker-openresty/issues/119
    client_body_temp_path /var/run/openresty/nginx-client-body;
    proxy_temp_path       /var/run/openresty/nginx-proxy;
    fastcgi_temp_path     /var/run/openresty/nginx-fastcgi;
    uwsgi_temp_path       /var/run/openresty/nginx-uwsgi;
    scgi_temp_path        /var/run/openresty/nginx-scgi;

    sendfile        on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;

    gzip  on;
    gzip_min_length 1k;
    gzip_comp_level 9;
    gzip_types text/plain application/javascript application/x-javascript text/css application/xml text/javascript application/x-httpd-php image/jpeg image/gif image/png;
    gzip_vary on;
    gzip_disable "MSIE [1-6]\.";

    client_max_body_size 10m;

    include /etc/nginx/conf.d/*.conf;
}

if ngx.shared.ip_blacklist:get(ngx.var.remote_addr) then
    return ngx.exit(ngx.HTTP_FORBIDDEN);
end

if ngx.shared.ip_blacklist:get(ngx.var.remote_addr) then
    return ngx.exit(ngx.HTTP_FORBIDDEN);
end
[root@iZuf68hd83envxn4tbktylZ lua]# cat get_ipblacklist_info.lua 
-- 调用URL查看黑名单信息
-- 1万IP消耗不到1.5M ngx.shared内存
-- 获取所有KEY会堵塞别的正常请求对ngx.shared内存的访问，因此只能取少数key展示
require "resty.core.shdict"
ngx.say("total space: " .. ngx.shared.ip_blacklist:capacity() .. "<br/>");
ngx.say("free space: " .. ngx.shared.ip_blacklist:free_space() .. "<br/>");
ngx.say("last update time: " .. os.date("%Y%m%d_%H:%M:%S",ngx.shared.ip_blacklist:get("last_update_time")) .. "<br/>");
ngx.say("first 100 keys: <br/>");
ngx.say("--------------------------<br/>");
ip_blacklist = ngx.shared.ip_blacklist:get_keys(100);
for key, value in pairs(ip_blacklist) do
    ngx.say(key .. ": " .. value .. "<br/>");
end

local mysql_host = "172.19.115.8"
local mysql_port = 3306
local database   = "xxx"
local username   = "xxx"
local password   = "xxx"
 
-- update ip_blacklist from mysql once every cache_ttl seconds
local cache_ttl     = 1
local mysql_connection_timeout = 1000
 
local client_ip        = ngx.var.real_ip
local ip_blacklist     = ngx.shared.ip_blacklist
local last_update_time = ip_blacklist:get("last_update_time");
 
if last_update_time == nil or last_update_time < ( ngx.now() - cache_ttl ) then
 
  local mysql = require "resty.mysql";
  local red = mysql:new();
 
  red:set_timeout(mysql_connect_timeout);
  
  local ok, err, errcode, sqlstate = red:connect{
                    host = mysql_host,
                    port = mysql_port,
                    database = database,
                    user = username,
                    password = password,
                    charset = "utf8",
                    max_packet_size = 1024 * 1024,
                }
  if not ok then
    ngx.log(ngx.ERR, "mysql connection error while retrieving ip_blacklist: " .. err);
  else
    new_ip_blacklist, err, errcode, sqlstate = red:query("select ip_addr from uip_t_blacklist where is_delete = 0 order by create_date desc limit 10000", 100)
    if not new_ip_blacklist then
      ngx.log(ngx.ERR, "bad result. errcode: " .. errcode .. " sqlstate: " .. sqlstate .. " err: " .. err);
      return
    end
 
    ip_blacklist:flush_all();
    for k1, v1 in pairs(new_ip_blacklist) do
      for k2, v2 in pairs(v1) do
        ip_blacklist:set(v2,true);
      end
    end
 
    ip_blacklist:set("last_update_time", ngx.now());
  end
end
 
ngx.say("sync successful");