这是我的nginx
配置(作为 docker 容器运行,以防万一):
events {
worker_connections 4096; ## Default: 1024
}
http {
server {
server_name registry.mydomain;
listen 80;
listen 443 ssl;
client_max_body_size 0; # Disables checking, to avoid "request entity too large"
ssl_certificate /etc/nginx/certs/registry.crt;
ssl_certificate_key /etc/nginx/certs/registry.key;
location / {
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://registry:5000;
}
}
}
我遇到的问题是,nginx
即使对其他域的请求,该网站也提供服务。这是预期的:
$ http http://registry.mydomain/v2/_catalog?n=100
HTTP/1.1 200 OK
Connection: keep-alive
Content-Length: 20
Content-Type: application/json; charset=utf-8
Date: Thu, 05 Apr 2018 12:43:21 GMT
Docker-Distribution-Api-Version: registry/2.0
Server: nginx/1.13.11
X-Content-Type-Options: nosniff
{
"repositories": []
}
但这并不是我们所期望的:
$ http http://localhost/v2/_catalog?n=100
HTTP/1.1 200 OK
Connection: keep-alive
Content-Length: 20
Content-Type: application/json; charset=utf-8
Date: Thu, 05 Apr 2018 12:39:57 GMT
Docker-Distribution-Api-Version: registry/2.0
Server: nginx/1.13.11
X-Content-Type-Options: nosniff
{
"repositories": []
}
这是为什么?我怎样才能知道nginx
不要向未定义的服务器提供请求?
答案1
nginx
始终有一个默认服务器。如果没有任何server
块明确标记为default_server
,nginx
则将使用具有匹配指令的第一个服务器listen
。
您可以定义一个 catch-allserver
块来处理任何与您的值不匹配的主机名server_name
。
例如:
server {
listen 80 default_server;
listen 443 ssl default_server;
ssl_certificate /path/to/some/other/cert.pem;
ssl_certificate_key /path/to/some/other/key.pem;
return 444;
}
当然,通过浏览器https
连接总是nginx
在处理请求之前对证书提出投诉。
看这个文件了解更多信息。