jakciehan
113 lines
3.5 KiB
Nginx Configuration File
113 lines
3.5 KiB
Nginx Configuration File
#
|
|
# Edge reverse proxy: 42.194.185.163
|
|
# Forwards public 80/443 traffic (L4 passthrough) to the K8s worker nodes
|
|
# that run the warmcheck/nginx DaemonSet (hostNetwork hostPort 80/443).
|
|
#
|
|
# Worker public IPs (cross-VPC, so we must use public addresses):
|
|
# - vm-0-6-opencloudos / 10.1.0.6
|
|
# - vm-32-10-tencentos / 172.16.32.10
|
|
# - vm-32-16-tencentos / 172.16.32.16
|
|
#
|
|
# Master (43.139.80.61 / 172.16.16.16) is excluded — DaemonSet nodeAffinity
|
|
# skips control-plane nodes, so it does NOT listen on :80/:443.
|
|
#
|
|
|
|
user nginx;
|
|
worker_processes auto;
|
|
worker_rlimit_nofile 65535;
|
|
|
|
error_log /var/log/nginx/error.log notice;
|
|
pid /run/nginx.pid;
|
|
|
|
# Load dynamic modules (stream module ships as a dynamic module on
|
|
# OpenCloudOS 9 / RHEL 9 and lives in /usr/share/nginx/modules/).
|
|
include /usr/share/nginx/modules/*.conf;
|
|
|
|
events {
|
|
worker_connections 8192;
|
|
use epoll;
|
|
multi_accept on;
|
|
}
|
|
|
|
# ============================================================
|
|
# L4 stream passthrough (HTTP 80 + HTTPS 443 + WSS)
|
|
# ============================================================
|
|
stream {
|
|
log_format basic '$remote_addr [$time_local] '
|
|
'$protocol $status $bytes_sent $bytes_received '
|
|
'$session_time "$upstream_addr" '
|
|
'"$upstream_bytes_sent" "$upstream_bytes_received" '
|
|
'"$upstream_connect_time"';
|
|
|
|
access_log /var/log/nginx/stream-access.log basic buffer=32k flush=5s;
|
|
|
|
# ---- HTTP upstream (80) ----
|
|
upstream k8s_http {
|
|
# 3 workers; passive health check via max_fails/fail_timeout.
|
|
server 10.1.0.6:80 max_fails=3 fail_timeout=30s;
|
|
server 172.16.32.10:80 max_fails=3 fail_timeout=30s;
|
|
server 172.16.32.16:80 max_fails=3 fail_timeout=30s;
|
|
}
|
|
|
|
# ---- HTTPS upstream (443, SNI passthrough) ----
|
|
upstream k8s_https {
|
|
server 10.1.0.6:443 max_fails=3 fail_timeout=30s;
|
|
server 172.16.32.10:443 max_fails=3 fail_timeout=30s;
|
|
server 172.16.32.16:443 max_fails=3 fail_timeout=30s;
|
|
}
|
|
|
|
# ---- Listeners ----
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
proxy_pass k8s_http;
|
|
proxy_connect_timeout 5s;
|
|
proxy_timeout 300s; # long enough for WS keep-alive
|
|
proxy_socket_keepalive on;
|
|
}
|
|
|
|
server {
|
|
listen 443;
|
|
listen [::]:443;
|
|
proxy_pass k8s_https;
|
|
proxy_connect_timeout 5s;
|
|
proxy_timeout 300s; # long enough for WSS keep-alive
|
|
proxy_socket_keepalive on;
|
|
}
|
|
}
|
|
|
|
# ============================================================
|
|
# Local-only HTTP block for status / health probing on :8080
|
|
# (bound to 127.0.0.1 so it doesn't clash with stream :80)
|
|
# ============================================================
|
|
http {
|
|
include /etc/nginx/mime.types;
|
|
default_type application/octet-stream;
|
|
|
|
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
|
'$status $body_bytes_sent "$http_referer" '
|
|
'"$http_user_agent" "$http_x_forwarded_for"';
|
|
|
|
access_log /var/log/nginx/access.log main;
|
|
|
|
sendfile on;
|
|
tcp_nopush on;
|
|
tcp_nodelay on;
|
|
keepalive_timeout 65;
|
|
types_hash_max_size 4096;
|
|
|
|
server {
|
|
listen 127.0.0.1:8080;
|
|
server_name _;
|
|
|
|
location = /edge-health {
|
|
return 200 "edge-ok\n";
|
|
add_header Content-Type text/plain;
|
|
}
|
|
|
|
location / {
|
|
return 404;
|
|
}
|
|
}
|
|
}
|