fix(deploy): bind MySQL/Redis to localhost and switch CubeProxy to host networking #269
+204
−15
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,181 @@ | ||
| user root; | ||
| worker_processes 12; | ||
|
Collaborator
There was a problem hiding this comment. As a template, it's best not to hard-code it; use |
||
| worker_cpu_affinity auto; | ||
| worker_rlimit_nofile 100000; | ||
|
|
||
| error_log /data/log/cube-proxy/error.log notice; | ||
| daemon off; | ||
|
|
||
| events { | ||
| use epoll; | ||
| worker_connections 100000; | ||
| } | ||
|
|
||
| http { | ||
| include mime.types; | ||
| lua_package_path "/usr/local/openresty/nginx/lua/?.lua;;"; | ||
| default_type application/octet-stream; | ||
|
|
||
| # do NOT change log format | ||
| log_format access '$access_time||$host||-||$http_X_Real_IP||$http_x_forwarded_for||$server_addr||' | ||
| '$http_x_forwarded_proto||$request_method||$request_uri||$args||$server_protocol||$uri||' | ||
| '$status||$body_bytes_sent||$request_time||$connection_requests||' | ||
| '$upstream_addr||$upstream_status||$upstream_response_time||$http_user_agent||' | ||
| '$http_x_cube_request_id||$http_x_cube_instance_id||$cube_retcode||$backend_ip||$cache_free_space||' | ||
| '-||-||-||$http_x_cube_business'; | ||
|
|
||
| access_log /data/log/cube-proxy/access.log access; | ||
|
|
||
| server_tokens off; | ||
| server_names_hash_bucket_size 512; | ||
|
|
||
| sendfile on; | ||
| tcp_nopush on; | ||
| tcp_nodelay on; | ||
|
|
||
| keepalive_timeout 75; | ||
| keepalive_requests 10000; | ||
|
|
||
| add_header Vary Accept-Encoding; | ||
|
|
||
| ssi off; | ||
| ssi_silent_errors on; | ||
| ssi_types text/xml application/javascript application/atom+xml application/rss+xml; | ||
|
|
||
| gzip on; | ||
| gzip_vary on; | ||
| gzip_http_version 1.0; | ||
| gzip_min_length 1000; | ||
| gzip_proxied any; | ||
| gzip_buffers 4 64k; | ||
| gzip_comp_level 3; | ||
| gzip_types text/plain text/css text/xml application/x-javascript application/xml application/json; | ||
| gzip_disable "MSIE [1-6]\."; | ||
|
|
||
| output_buffers 16 64k; | ||
| postpone_output 1460; | ||
|
|
||
| log_subrequest on; | ||
|
|
||
| large_client_header_buffers 4 512k; | ||
| client_body_buffer_size 1M; | ||
| client_max_body_size 256M; | ||
| proxy_buffering on; | ||
| proxy_buffer_size 16k; | ||
| proxy_buffers 8 64k; | ||
| proxy_busy_buffers_size 128k; | ||
| proxy_intercept_errors on; | ||
|
|
||
| proxy_temp_file_write_size 128k; | ||
| proxy_temp_path /data/; | ||
| proxy_cache_path /cache levels=2:2 keys_zone=cache:128m max_size=512m inactive=15m; | ||
| proxy_next_upstream_tries 2; | ||
| proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504; | ||
|
|
||
| underscores_in_headers on; | ||
|
|
||
| # the backend may be a hostproxy, or it may be a host | ||
| upstream backend { | ||
| server 0.0.0.1:1234; | ||
| balancer_by_lua_file lua/balancer_phase.lua; | ||
| keepalive 1500; | ||
| keepalive_timeout 80; | ||
| } | ||
|
|
||
| lua_shared_dict local_cache 500m; | ||
| lua_shared_dict faulty_backend 100m; | ||
| init_worker_by_lua_file lua/init_worker_phase.lua; | ||
|
|
||
| server { | ||
| listen __CUBE_PROXY_HTTP_PORT__ reuseport; | ||
| server_name _; | ||
| set $cube_proxy_host_ip ""; | ||
| location / { | ||
| include /usr/local/openresty/nginx/conf/global/global.conf; | ||
| set $cube_retcode "310200"; | ||
| set $garyscale_test "none"; | ||
| set $backend_ip ""; | ||
| set $backend_port ""; | ||
| set $access_time ""; | ||
| set $cache_free_space ""; | ||
| set $host_proxy_port __CUBE_PROXY_HTTP_PORT__; | ||
|
|
||
| proxy_http_version 1.1; | ||
| proxy_set_header Upgrade $http_upgrade; | ||
| proxy_set_header Connection "upgrade"; | ||
|
|
||
| proxy_send_timeout 7206s; | ||
| proxy_read_timeout 7206s; | ||
| proxy_connect_timeout 3s; | ||
| proxy_set_header Host $http_host; | ||
| proxy_set_header X-Real-IP $remote_addr; | ||
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
|
|
||
| rewrite_by_lua_file lua/rewrite_phase.lua; | ||
|
|
||
| proxy_pass http://backend; | ||
|
|
||
| header_filter_by_lua_file lua/header_filter_phase.lua; | ||
|
|
||
| log_by_lua_file lua/log_phase.lua; | ||
| } | ||
| } | ||
|
|
||
| server { | ||
| listen __CUBE_PROXY_HTTPS_PORT__ ssl reuseport; | ||
| server_name _; | ||
| set $cube_proxy_host_ip ""; | ||
| ssl_certificate /usr/local/openresty/nginx/certs/cube.app+3.pem; | ||
| ssl_certificate_key /usr/local/openresty/nginx/certs/cube.app+3-key.pem; | ||
| location / { | ||
| include /usr/local/openresty/nginx/conf/global/global.conf; | ||
| set $cube_retcode "310200"; | ||
| set $garyscale_test "none"; | ||
| set $backend_ip ""; | ||
| set $backend_port ""; | ||
| set $access_time ""; | ||
| set $cache_free_space ""; | ||
| set $host_proxy_port __CUBE_PROXY_HTTPS_PORT__; | ||
|
|
||
| # NOTE(hengqi): Add support for WebSocket | ||
| # | ||
| # The WebSocket Protocol is defined in RFC 6455, it says: | ||
| # Interoperability considerations | ||
| # Use of WebSocket requires use of HTTP version 1.1 or higher. | ||
| # | ||
| # The doc of `proxy_set_header` says: | ||
| # If the value of a header field is an empty string | ||
| # then this field will not be passed to a proxied server | ||
| # | ||
| # So the `proxy_set_header Upgrade $http_upgrade` should have NO side effects. | ||
| # | ||
| # References: | ||
| # - https://datatracker.ietf.org/doc/html/rfc6455 | ||
| # - https://datatracker.ietf.org/doc/html/rfc2616#section-14.10 | ||
| # - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Connection | ||
| # - https://nginx.org/en/docs/http/websocket.html | ||
| # - https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_http_version | ||
| # - https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_set_header | ||
| proxy_http_version 1.1; | ||
| proxy_set_header Upgrade $http_upgrade; | ||
| proxy_set_header Connection "upgrade"; | ||
|
|
||
| proxy_send_timeout 7206s; | ||
| proxy_read_timeout 7206s; | ||
| proxy_connect_timeout 3s; | ||
| # proxy_socket_keepalive may cause frequent vm exit | ||
| # proxy_socket_keepalive on; | ||
| proxy_set_header Host $http_host; | ||
| proxy_set_header X-Real-IP $remote_addr; | ||
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
|
|
||
| rewrite_by_lua_file lua/rewrite_phase.lua; | ||
|
|
||
| proxy_pass http://backend; | ||
|
|
||
| header_filter_by_lua_file lua/header_filter_phase.lua; | ||
|
|
||
| log_by_lua_file lua/log_phase.lua; | ||
| } | ||
| } | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please note that this is for reference only and should not be used directly in a production environment.