在单个 docker 容器环境中配置 nginx (AWS ElasticBeanstalk)答案

【问题标题】：Configuring nginx in a single docker container environment (AWS ElasticBeanstalk)在单个 docker 容器环境中配置 nginx (AWS ElasticBeanstalk)
【发布时间】：2017-05-30 05:04:57
【问题描述】：

我目前正在 AWS ElasticBeanstalk 中使用 single container docker environment 部署 Django + uWSGI 应用程序。这个环境已经随 nginx 一起提供了，我目前正在尝试配置它。

我正在努力实现以下目标：

在环境的负载平衡器处终止 HTTPS
使用 nginx（环境自带）将 HTTP 请求重定向到 HTTPS
将请求从 nginx 传递到 uwsgi

环境信息：

配置和解决方案堆栈名称：单容器 Docker 1.11 2.3.0 版
AMI：运行 Docker 的 64 位 Amazon Linux 2016.09 v2.3.0 1.11.2 2016.09.0
Docker 版本：1.11.2
代理服务器：nginx 1.10.1

这是我当前的配置：

.ebxtensions/00-loadbalancer-terminatehttps.config

option_settings:
  aws:elb:listener:443:
    ListenerEnabled: true
    ListenerProtocol: HTTPS
    SSLCertificateId: <resource-id-here>
    InstancePort: 443
    InstanceProtocol: HTTP
  aws:elb:listener:80:
    ListenerEnabled: true
    ListenerProtocol: HTTP
    InstancePort: 80
    InstanceProtocol: HTTP

.ebextensions/01-nginx-proxy.config

files:
  "/etc/nginx/sites-available/test.domain.com.conf":
    mode: "000644"
    owner: root
    group: root
    content: |
      server {
        listen 80;
        server_name test.domain.com;
        access_log /var/log/nginx/$server_name.access.log;

        location / {
          return 301 https://$server_name$request_uri;
        }

        location = /status/ {
          access_log /var/log/nginx/$server_name.healthd.log healthd;
          include uwsgi_params;
          uwsgi_pass docker;
          proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Host $host;
          proxy_set_header X-Forwarded-Server $host;
        }

      }

      server {
        listen 443;
        server_name test.domain.com;
        access_log /var/log/nginx/$server_name.access.log;

        location / {
          include uwsgi_params;
          uwsgi_pass docker;
          proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Host $host;
          proxy_set_header X-Forwarded-Server $host;
          client_max_body_size 100m;
        }

        location /static {
            alias /var/www/static;
        }
      }

commands:
   00_enable_site:
    command: 'rm -f /etc/nginx/sites-enabled/* && ln -s /etc/nginx/sites-available/test.domain.com.conf /etc/nginx/sites-enabled/test.domain.com.conf'

.ebextensions/02-healthcheckurl.config

option_settings:
  - namespace:  aws:elasticbeanstalk:application
    option_name:  Application Healthcheck URL
    value:  /status/

application.ini（uwsgi 配置）

[uwsgi]
master = true
socket = :3031
processes = 4
enable-threads = true
threads = 2
chdir = /opt/app/
wsgi-file = test/wsgi.py
logto2 = /var/log/uwsgi.log
callable = application
py-autoreload = 3

现在，在测试配置时：

检查http://test.domain.com/status/ 工作正常

$ wget http://test.domain.com/status/
--2017-01-14 23:00:18--  http://test.domain.com/status/
Resolving test.domain.com... 52.xx.xx.xx, 52.xx.xx.xy
Connecting to test.domain.com|52.xx.xx.xx|:80... connected.
HTTP request sent, awaiting response... 200 OK

检查http://test.domain.com/hello/ 没有按预期工作。它重定向正常，但它会挂起直到请求超时。

$ wget http://test.domain.com/hello/
--2017-01-14 22:59:13--  http://test.domain.com/hello/
Resolving test.domain.com... 52.xx.xx.xx, 52.xx.xx.xy
Connecting to test.domain.com|52.xx.xx.xx|:80... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: https://test.domain.com/hello/ [following]
--2017-01-14 22:59:15--  https://test.domain.com/hello/
Connecting to test.domain.com|52.xx.xx.xx|:443... connected.
HTTP request sent, awaiting response... 408 REQUEST_TIMEOUT
2017-01-14 23:00:17 ERROR 408: REQUEST_TIMEOUT.

【问题讨论】：

登录到 Beanstalk 服务创建的 EC2/ECS 机器后，您是否在日志中看到任何错误？
/var/log/nginx/error.log 没有显示任何内容。 uwsgi.log 仅显示对 /status/ 的 GET 请求。显然，uwsgi 没有收到来自 nginx 的其他路径（即 /hello/ 和 /）的请求。
超时通常暗示安全组不允许某些流量。我对ELB over Elasticbeanstalk不太熟悉，但是“正常”的ELB需要你专门开通443流量。
@deviavir 就是这样！在安全组中，我必须启用从负载均衡器到端口 443 的入站流量。
@blaze 啊 :) 这比我想象的要容易！我添加了一个“答案”，可以让你有一个更简单的 nginx 配置，也可以解决问题（它可以让你在实例上重用相同的端口 80）。

标签： amazon-web-services nginx docker amazon-elastic-beanstalk uwsgi

【解决方案1】：

编辑：

OP 的问题在这里解决了 Configuring nginx in a single docker container environment (AWS ElasticBeanstalk)，为了完整起见，我留下以下信息。

从 nginx 配置中删除端口 443 的“服务器”块，并在 .ebxtensions/00-loadbalancer-terminatehttps.config 中，将 aws:elb:listener:443: 的 InstancePort 设置为 80，并使用 nginx '$http_x_forwarded_proto' 检查 HTTPS。

if ($http_x_forwarded_proto != "https") {
  rewrite ^(.*)$ https://$server_name$1 permanent;
}

为什么？目前，您的 nginx+elb 似乎正在尝试一起终止 HTTPS，但您的 nginx 没有回复任何内容。如果您不打算使用内部 HTTPS，那么只坚持一个 nginx 服务器块并在那里执行所有逻辑会更有意义。

我建议以下配置文件：

.ebxtensions/00-loadbalancer-terminatehttps.config

option_settings:
  aws:elb:listener:443:
    ListenerEnabled: true
    ListenerProtocol: HTTPS
    SSLCertificateId: <resource-id-here>
    InstancePort: 80
    InstanceProtocol: HTTP
  aws:elb:listener:80:
    ListenerEnabled: true
    ListenerProtocol: HTTP
    InstancePort: 80
    InstanceProtocol: HTTP

.ebextensions/01-nginx-proxy.config

files:
  "/etc/nginx/sites-available/test.domain.com.conf":
    mode: "000644"
    owner: root
    group: root
    content: |
      server {
        listen 80;
        server_name test.domain.com;
        access_log /var/log/nginx/$server_name.access.log;

        if ($http_x_forwarded_proto != "https") {
          set $test  http;
        }

        if ($request_uri = /status/) {
          set $test  "${test}+status";
        }

        if ($test = "http") {
          return 301 https://$server_name$request_uri;
        }

        location = /status/ {
          access_log /var/log/nginx/$server_name.healthd.log healthd;
          include uwsgi_params;
          uwsgi_pass docker;
          proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Host $host;
          proxy_set_header X-Forwarded-Server $host;
          client_max_body_size 100m;
        }

        location /static {
            alias /var/www/static;
        }

        location / {
          include uwsgi_params;
          uwsgi_pass docker;
          proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Host $host;
          proxy_set_header X-Forwarded-Server $host;
          client_max_body_size 100m;
        }

      }

commands:
   00_enable_site:
    command: 'rm -f /etc/nginx/sites-enabled/* && ln -s /etc/nginx/sites-available/test.domain.com.conf /etc/nginx/sites-enabled/test.domain.com.conf'

请注意，我绝不是声称这是解决您的问题的最佳解决方案（甚至根本不是解决方案），408 似乎表明一个有点奇怪的问题 - 但是，这应该让您获得一个更简单的配置调试并希望您立即开始。

【讨论】：

谢谢。我有单独的服务器指令，因为the only safe things to be done inside an if directive are "return" and "rewrite"。最后，我创建了一个新文件00-resources.config，在其中创建了一个自定义 SecurityGroup、一个自定义 LoadBalancer 和三个自定义 SecurityGroupIngress 资源。

【解决方案2】：

按照@deviavir 的建议，我需要允许来自负载均衡器的流量进入 EC2 实例。

这是我的最终配置：

   .ebextensions
   |-- 00-resources.config
   |-- 01-nginx-proxy.config

.ebextensions/00-resources.config：

Resources:
  AWSEBSecurityGroup:
    Type: "AWS::EC2::SecurityGroup"
    Properties:
      GroupDescription: "Allow traffic to ports 80 and 443 from the load balancer. Restrict SSH access."
  AWSEBLoadBalancer:
    Type: "AWS::ElasticLoadBalancing::LoadBalancer"
    Properties:
      Listeners:
        - {LoadBalancerPort: 80,
          Protocol: 'HTTP',
          InstancePort: 80,
          InstanceProtocol: 'HTTP'}
        - {LoadBalancerPort: 443,
          Protocol: 'HTTPS',
          InstancePort: 443,
          InstanceProtocol: 'HTTP',
          SSLCertificateId: 'arn:aws:acm:us-east-1:xxxx:certificate/yyyy'}
      HealthCheck:
        Target: HTTP:80/status/
        HealthyThreshold: '3'
        UnhealthyThreshold: '5'
        Interval: '30'
        Timeout: '5'
  Port80SecurityGroupIngress:
    Type: "AWS::EC2::SecurityGroupIngress"
    Properties:
      GroupId: {"Fn::GetAtt" : ["AWSEBSecurityGroup", "GroupId"]}
      IpProtocol: tcp
      ToPort: 80
      FromPort: 80
      SourceSecurityGroupName: {"Fn::GetAtt" : ["AWSEBLoadBalancer" , "SourceSecurityGroup.GroupName"]}
  Port443SecurityGroupIngress:
    Type: "AWS::EC2::SecurityGroupIngress"
    Properties:
      GroupId: {"Fn::GetAtt" : ["AWSEBSecurityGroup", "GroupId"]}
      IpProtocol: tcp
      ToPort: 443
      FromPort: 443
      SourceSecurityGroupName: {"Fn::GetAtt" : ["AWSEBLoadBalancer" , "SourceSecurityGroup.GroupName"]}
  SSHSecurityGroupIngress:
    Type: "AWS::EC2::SecurityGroupIngress"
    Properties:
      GroupId: {"Fn::GetAtt" : ["AWSEBSecurityGroup", "GroupId"]}
      IpProtocol: tcp
      ToPort: 22
      FromPort: 22
      CidrIp: xx.xx.xx.xx/yy

.ebextensions/01-nginx-proxy.config：

files:
  "/etc/nginx/sites-available/test.domain.com.conf":
    mode: "000644"
    owner: root
    group: root
    content: |
      server {
        listen 80;
        server_name test.domain.com;
        access_log /var/log/nginx/$server_name.access.log;

        location / {
          return 301 https://$server_name$request_uri;
        }

        location = /status/ {
          access_log /var/log/nginx/$server_name.status.log;
          uwsgi_pass docker;
          include uwsgi_params;
        }

      }

      server {
        listen 443;
        server_name test.domain.com;
        access_log /var/log/nginx/$server_name.access.log;

        location / {
          uwsgi_pass docker;
          include uwsgi_params;
          client_max_body_size 100m;
        }

        location /static/ {
            root /var/www;
        }
      }

commands:
   00_enable_site:
    command: 'rm -f /etc/nginx/sites-enabled/* && ln -s /etc/nginx/sites-available/test.domain.com.conf /etc/nginx/sites-enabled/test.domain.com.conf'

【讨论】：