ini 使用lua脚本的简单nginx配置

Posted 2021-05-24

tags:

篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了ini 使用lua脚本的简单nginx配置相关的知识，希望对你有一定的参考价值。

-- lua/render.lua
local template = require "resty.template"
local data = {
    title = 'F5, Demo',
    message = "Hello, World!"
}

template.render([[
<!DOCTYPE html>
<html>
<head>
    <title>{{title}}</title>
</head>
<body>
    <h1>{{message}}</h1>
</body>
</html>
]], data)

-- lua/post.lua
local cjson = require 'cjson'
ngx.req.read_body()
local data = ngx.req.get_body_data()
if not data then
    ngx.say(cjson.encode({ error = 1, message = 'POST data not found' }))
    ngx.exit(ngx.HTTP_OK)
end

ngx.say("BODY DATA : " ..data)
local json = cjson.decode(data)

if not json.username then
    ngx.say(cjson.encode({ error = 1, message = 'Username not found' }))
end

ngx.say('Do signup.')
ngx.say('User info.')
ngx.say(cjson.encode(json))

error_log logs/error.log;
events {
    worker_connections 1024;
}
http {
    proxy_cache_path /data/cache/page levels=1:2 keys_zone=python:10m max_size=1g inactive=5m;
    server {
        access_log logs/access.log;
        listen 8080;
        lua_code_cache  off;

        location / {
            echo "Hello, World";
        }

        location ~ ^/api/v1/(.*)$ {
            # path to lua script
            content_by_lua_file lua/$1.lua;
        }

        location /page/ {
            set $cache_key $scheme$host$uri$is_args$args;
            proxy_cache_key $cache_key;
            proxy_cache_valid 30m;
            proxy_cache python;
            proxy_pass http://127.0.0.1:8004/;
        }

    }
}

ini IVZ：Nginx配置使用Lua作为身份验证模块。您必须使用lua支持安装nginx。请参阅Linux发行版的“openresty”或

--[[
Provides custom authorization for nginx.
See the `nginx_authorize_by_lua.conf` for the Nginx config. This lua file is referenced in the config
See testWebserverAccess.sh for unit tests.

To Run nginx (make sure you have the lua, config and htpasswd file):
$ /usr/local/openresty/nginx/sbin/nginx -c /etc/nginx/conf/nginx_authorize_by_lua.conf

Logs are available at: /usr/local/openresty/nginx/logs/lua.log
To write to the log:
ngx.log(ngx.DEBUG, user) -- Write user to log
]]--

-- Authorization rules
-- This grants rights to a user
-- Usage: $username = "$group"
local userGroups = {
	user = "user",
	dev = "dev",
	admin = "admin",
	bob = "user",
	alice = "user",
	logAdmin = "adminOfLogs"
}

-- Provides group access rights
-- Usage:
-- $GROUP = { ["$URL_REGEX"] = { "$HTTP_METHOD", "$HTTP_METHOD" } }
local restrictions = {
  user = {
	["^/monitor*"]			= { "HEAD", "GET" },
	["^/kibana4*"]			= { "HEAD", "GET" }
  },
  
  dev = {
	["^/monitor*"]			= { "HEAD", "GET", "PUT", "POST" },
	["^/log*"]			= { "HEAD", "GET", "PUT", "POST" },
	["^/kibana4*"]			= { "HEAD", "GET" }
  },

  admin = {
  	["^/*"]               		= { "HEAD", "GET", "POST", "PUT", "DELETE" },
	["^/kibana4*"]			= { "HEAD", "GET" }
  },

  adminOfLogs = {
    ["^/log*"]				= { "HEAD", "GET", "POST", "PUT", "DELETE" }
  }
}

-- Write 403 message function
function write403Message ()
  ngx.header.content_type = 'text/plain'
  ngx.status = 403
  ngx.say("403 Forbidden: You don\'t have access to this resource.")
  return ngx.exit(403)
end

-- get authenticated user as role
local user = ngx.var.remote_user	-- Get user
local role = userGroups[user]		-- Get group

-- exit 403 when no matching role has been found
if restrictions[role] == nil then
  return write403Message()
end

-- get URL
local uri = ngx.var.uri

-- get method
local method = ngx.req.get_method()

local allowed  = false

for path, methods in pairs(restrictions[role]) do
  -- path matched rules?
  local p = string.match(uri, path)

  -- method matched rules?
  local m = nil
  for _, _method in pairs(methods) do
    m = m and m or string.match(method, _method)
  end

  if p and m then
    allowed = true
    break
  end
end

if not allowed then
  return write403Message()
end

admin:8QRvjnvxOmISM
alice:aRoWwFbQFh0ic
bob:qyz8eIFW3uJoo
clare:Lvfja1wClMGnM
dev:CmJO//.L488S2
user:u13.ImIxrC5cU

# Generate passwords:
# You can use an online htpasswd tool, a python script or the openssl package on your distro.
#     $ printf "user:$(openssl password -crypt user)\n"     >> htpasswd
#     $ printf "admin:$(openssl password -crypt admin)\n"   >> htpasswd
#
# Install the Nginx with Lua support ("openresty"):
# To Run nginx (make sure you have the lua, config and htpasswd file):
# $ /usr/local/openresty/nginx/sbin/nginx -c /etc/nginx/conf/nginx_authorize_by_lua.conf
 
worker_processes  1;
 
error_log logs/lua.log notice;
 
events {
  worker_connections 1024;
}
 
http {
  upstream elasticsearch {
    server 127.0.0.1:9200;
    keepalive 15;
  }
 
  server {
    listen 8080;
 
    location / {
      auth_basic           "Protected Elasticsearch";
      auth_basic_user_file "/usr/local/openresty/nginx/auth/htpasswd";
 
      access_by_lua_file '/usr/local/openresty/nginx/conf/authorize.lua';
 
      proxy_pass http://elasticsearch;
      proxy_redirect off;
      proxy_buffering off;
 
      proxy_http_version 1.1;
      proxy_set_header Connection "Keep-Alive";
      proxy_set_header Proxy-Connection "Keep-Alive";
    }
 
  }
}

# Generate passwords:
# You can use an online htpasswd tool, a python script or the openssl package on your distro.
#     $ printf "user:$(openssl password -crypt user)\n"     >> htpasswd
#     $ printf "admin:$(openssl password -crypt admin)\n"   >> htpasswd
#
# Install the Nginx with Lua support ("openresty"):
# To Run nginx (make sure you have the lua, config and htpasswd file):
# $ /usr/local/openresty/nginx/sbin/nginx -c /etc/nginx/conf/nginx_authorize_by_lua.conf
#
# This also includes the kibana endpoints
 
worker_processes  1;
 
error_log logs/lua.log notice;
 
events {
  worker_connections 1024;
}
 
http {
  upstream elasticsearch {
    server 127.0.0.1:9200;
    keepalive 15;
  }
  upstream kibana {
    server 127.0.0.1:5601;
  }
 
  server {
    listen 8080;
 
    # For kibana, re-routes traffic from host:8080/kibana4 to host:5601/
    location ~ ^/kibana4/.* {
      auth_basic           "Protected Elasticsearch";
      auth_basic_user_file "/usr/local/openresty/nginx/auth/htpasswd";
      access_by_lua_file '/usr/local/openresty/nginx/conf/authorize.lua';
      proxy_pass http://kibana;

      rewrite ^/kibana4/(.*) /$1 break;
      proxy_set_header Host $host;
      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
    }
 
    # To allow host:8080/kibana4 (no trailing slash) to work
    location ~ ^/kibana4 {
      rewrite ^([^.]*[^/])$ $1/ permanent;
    }
 
    location / {
      auth_basic           "Protected Elasticsearch";
      auth_basic_user_file "/usr/local/openresty/nginx/auth/htpasswd";
      access_by_lua_file '/usr/local/openresty/nginx/conf/authorize.lua';
 
      proxy_pass http://elasticsearch;
      proxy_redirect off;
      proxy_buffering off;
 
      proxy_http_version 1.1;
      proxy_set_header Connection "Keep-Alive";
      proxy_set_header Proxy-Connection "Keep-Alive";
    }
  }
}

以上是关于ini 使用lua脚本的简单nginx配置的主要内容，如果未能解决你的问题，请参考以下文章

ini Nginx Lua脚本redis基于基本用户身份验证

ini IVZ：Nginx配置使用Lua作为身份验证模块。您必须使用lua支持安装nginx。请参阅Linux发行版的“openresty”或

lua脚本获取request body

openresty+lua做接口调用权限限制

动态扩展Nginx支持Lua功能

Nginx + Lua + redis (转)