重写规则以访问 Nginx 反向代理后面的 Hashicorp Vault答案

【问题标题】：Rewrite rule to access Hashicorp Vault behind Nginx reverse proxy重写规则以访问 Nginx 反向代理后面的 Hashicorp Vault
【发布时间】：2021-06-04 08:04:10
【问题描述】：

我目前正在尝试在我的 Ubuntu 20.04 服务器上托管一个保管库。

这是我的 Nginx 反向代理配置文件：

upstream backend_vault{
        server 172.16.10.8:8200;
}

server {
    listen 443 ssl;
    root /var/www/html;
    
    location /vault {
            include proxy_params;
            proxy_pass http://backend_vault;
    }
}

我想知道如何创建一个重写规则来访问：

https://domainname.com/ui/vault

输入：

https://domainname.com/vault

我试过了：

proxy_pass http://backend_vault/$1

proxy_pass http://backend_vault/vault

proxy_pass http://backend_vault/ui/vault

我越来越糊涂了。

谢谢。

【问题讨论】：

标签： ubuntu nginx url-rewriting nginx-reverse-proxy hashicorp-vault

【解决方案1】：

使用 nginx's Full Example 中的辅助文件，以下 nginx.conf 仅在 HashiCorp Vault UI 中进行了测试。如果你想负载均衡 HashiCorp Vault API，你可以use a different example:

user       www-data www-data;  ## Default: nobody
worker_processes  5;  ## Default: 1
error_log  logs/error.log;
pid        logs/nginx.pid;
worker_rlimit_nofile 8192;

events {
  worker_connections  4096;  ## Default: 1024
}

http {
  include    conf/mime.types;
  include    /etc/nginx/proxy.conf;
  include    /etc/nginx/fastcgi.conf;
  index    index.html index.htm index.php;

  default_type application/octet-stream;
  log_format   main  - []

     ;
  access_log   logs/access.log  main;
  sendfile     on;
  tcp_nopush   on;
  server_names_hash_bucket_size 128; # this seems to be required for some vhosts

upstream vault_backend {
  server 192.168.56.140:8200;
  server 192.168.56.141:8200;
  server 192.168.56.142:8200;
}

server {
  listen 80;
  #server_name animal-control;
  root    /var/tmp/www;

  # pass requests for dynamic content to rails/turbogears/zope, et al
  location / {
    try_files $uri $uri/ $uri.html =404;
    }
    # This location is used to handle redirects send by HA Vault Cluster
    location @handle_vault_standby {
      set $saved_vault_endpoint '$upstream_http_location';
      proxy_pass $saved_vault_endpoint;
  }

  location /vault/ {
    access_log logs/vault_access.log main;
    error_log logs/vault_error.log debug;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $host;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Accept-Encoding "";

    # to proxy WebSockets in nginx
    proxy_pass https://vault_backend/;
    proxy_redirect /ui/ /vault/ui/;
    proxy_redirect /v1/ /vault/v1/;
    proxy_buffering off;
    #rewrite html baseurkl
    sub_filter '<head>' '<head><base href="/vault/">';
    #sub_filter_once on;
    sub_filter '"/ui/' '"ui/';
    sub_filter_once off;
    #sub_filter_types application/javascript text/html;
}
  location /v1/ {
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $host;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Accept-Encoding "";
    proxy_pass https://vault_backend;
    proxy_redirect /v1/ /vault/v1/;
    #rewrite html baseurkl
    sub_filter_once on;
    sub_filter '"/v1/' '"/vault/v1/';
    sub_filter_types application/javascript text/html;}
    proxy_buffering off;
    proxy_no_cache 1;
    proxy_cache_bypass 1;
  }
}

【讨论】：