NGINX 反向代理配置不起作用

Question 1

罪魁祸首很可能是 SELinux，因为它默认限制服务的网络操作。

作为记录您可以使用这两个命令永久启用 nginx 的网络访问：

setsebool httpd_can_network_connect 1 -P
# or
setsebool httpd_can_network_relay 1 -P

^{如果你只想暂时启用它（出于测试目的），请省略-P}

因为httpd_can_network_relay您很可能需要使用来扩展http_port_t端口列表semanage port，如文档中所示。我更喜欢这个选项，因为它减少了整个安装的攻击面。

Answer

罪魁祸首很可能是 SELinux，因为它默认限制服务的网络操作。

作为记录您可以使用这两个命令永久启用 nginx 的网络访问：

setsebool httpd_can_network_connect 1 -P
# or
setsebool httpd_can_network_relay 1 -P

^{如果你只想暂时启用它（出于测试目的），请省略-P}

因为httpd_can_network_relay您很可能需要使用来扩展http_port_t端口列表semanage port，如文档中所示。我更喜欢这个选项，因为它减少了整个安装的攻击面。

Question 2

（应该是评论但空间有限/没有格式）

我收到这个红色站点 500 警报，提示“站点暂时不可用”。

嗯。文件是 /usr/share/nginx/html/500.html 吗？你检查过日志了吗？

您应该做的第一件事是确定错误是由代理还是原始主机报告的。

我怀疑代理可能工作正常 - 但你的docker应用程序不喜欢你发送的流量。

Answer

（应该是评论但空间有限/没有格式）

我收到这个红色站点 500 警报，提示“站点暂时不可用”。

嗯。文件是 /usr/share/nginx/html/500.html 吗？你检查过日志了吗？

您应该做的第一件事是确定错误是由代理还是原始主机报告的。

我怀疑代理可能工作正常 - 但你的docker应用程序不喜欢你发送的流量。

Question 3

我找到了这篇文章，他也遇到了一些 nextcloud 问题并分享了他的配置，希望这对你有所帮助 https://zuckerbude.org/nextcloud-behind-reverse-proxy/

server {
    server_name nc.example.com;
    location / {
    proxy_set_header  Host $host;
    proxy_set_header  X-Real-IP $remote_addr;
    proxy_set_header  X-Forwarded-Proto https;
    proxy_set_header  X-Forwarded-Host $remote_addr;
    proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_pass http://10.10.10.178:80;
    proxy_buffers 16 4k;
    proxy_buffer_size 2k;
    }

    location /.well-known/carddav {
      return 301 $scheme://$host/remote.php/dav;
    }

    location /.well-known/caldav {
      return 301 $scheme://$host/remote.php/dav;
    }

    listen [::]:443 ssl; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/nc.example.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/nc.example.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
}

server {
    if ($host = nc.example.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    server_name nc.example.com;
    listen [::]:80;
    listen 80;
    return 404; # managed by Certbot
}

编辑

您能否启用详细的访问日志并在您的服务器块中包含访问日志

http {
    # ... other http block configurations ...

    log_format detailed '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    server {
        # ... other server block configurations ...

        access_log /var/log/nginx/access.log detailed;
    }
}

然后重启nginx

service nginx restart

Answer

我找到了这篇文章，他也遇到了一些 nextcloud 问题并分享了他的配置，希望这对你有所帮助 https://zuckerbude.org/nextcloud-behind-reverse-proxy/

server {
    server_name nc.example.com;
    location / {
    proxy_set_header  Host $host;
    proxy_set_header  X-Real-IP $remote_addr;
    proxy_set_header  X-Forwarded-Proto https;
    proxy_set_header  X-Forwarded-Host $remote_addr;
    proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_pass http://10.10.10.178:80;
    proxy_buffers 16 4k;
    proxy_buffer_size 2k;
    }

    location /.well-known/carddav {
      return 301 $scheme://$host/remote.php/dav;
    }

    location /.well-known/caldav {
      return 301 $scheme://$host/remote.php/dav;
    }

    listen [::]:443 ssl; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/nc.example.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/nc.example.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
}

server {
    if ($host = nc.example.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    server_name nc.example.com;
    listen [::]:80;
    listen 80;
    return 404; # managed by Certbot
}

编辑

您能否启用详细的访问日志并在您的服务器块中包含访问日志

http {
    # ... other http block configurations ...

    log_format detailed '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    server {
        # ... other server block configurations ...

        access_log /var/log/nginx/access.log detailed;
    }
}

然后重启nginx

service nginx restart

Question 4

谢谢我的反向代理正在工作。

setsebool httpd_can_network_connect 1 -P `setsebool httpd_can_network_relay 1 -P

做了第一个技巧，然后我不得不添加

large_client_header_buffers 4 16k;

所以我的 nginx 配置如下所示

server {
    server_name localhost;
    large_client_header_buffers 4 16k;
    
    
     location /nextcloud {
    proxy_set_header  Host $host;
    proxy_set_header  X-Real-IP $remote_addr;
    proxy_set_header  X-Forwarded-Proto http;
    proxy_set_header  X-Forwarded-Host $remote_addr;
    proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_pass http://10.0.100.6:8080;

    }

     location /wordpress {
    proxy_set_header  Host $host;
    proxy_set_header  X-Real-IP $remote_addr;
    proxy_set_header  X-Forwarded-Proto http;
    proxy_set_header  X-Forwarded-Host $remote_addr;
    proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_pass http://10.0.100.6:8888;
    
    }

    location /.well-known/carddav {
      return 301 $scheme://$host/remote.php/dav;
    }

    location /.well-known/caldav {
      return 301 $scheme://$host/remote.php/dav;
    }

    listen [::]:80;
    listen 80; 
}

以防万一有人遇到困难。我的应用程序仍然需要一些调整。但感谢大家帮助我运行反向代理 :))

Answer