折腾nginx + varnish + apache2 https整站小记

原来的配置是varnish + apache2, varnish直接监听80, http传给88的apache2,或者击中缓存,  https不走缓存直接给apache2. http+https很不爽…所以折腾整站https

现在

nginx:80,443

varnish:8888

apache2:8080

下面贴配置

server {
    listen 80;
    server_tokens off; #隐藏响应头中的nginx版本

    root /var/www/www/blog/public_html;

    index index.php index.html index.htm index.nginx-debian.html;

    server_name xn--vkuk.org;

    return 301 https://xn--vkuk.org$request_uri; #强制http请求跳转到https
}

server {
    server_tokens off;
    server_name xn--vkuk.org;
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/xn--vkuk.org/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/xn--vkuk.org/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot


    location / {
        proxy_pass http://127.0.0.1:8888; #varnish监听的地址
        proxy_set_header X-Real-IP  $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Scheme $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
    }
}

backend default {
    .host = "127.0.0.1";
    .port = "8080";
}

backend blog {
    .host = "127.0.0.1";
    .port = "8081";
}

sub vcl_recv {
    if(req.http.host ~ "osteam.win"){
       set req.http.host = "osteam.win";
       set req.backend_hint = default;
    }
    if(req.http.host ~ "xn--vkuk.org"){
       set req.http.host = "xn--vkuk.org";
       set req.backend_hint = blog;
    }

    //set req.http.X-Forwarded-For = client.ip; //把nginx获取的用户ip传给后端
    //https://stackoverflow.com/questions/25558749/varnish-automagically-adding-load-balancer-ip-to-x-forwarded-for-header apache2能读取到ip了,但是后端程序还是还是需要调试下...挖个坑待填
}
#你以为这样两个站点就分开了么? 实际测试重启varnish服务后, 先访问哪个站点,哪个被缓存,再换域名访问,看到的是刚缓存的那个主页... 很崩溃
sub vcl_hash {
  hash_data(req.url); #先校验url
  if(req.http.host){ #如果有host头,就校验host
    hash_data(req.http.host);
  }
  return (lookup);
}
#当然,这个只是部分配置
#原来的配置是参考
#https://leonax.net/p/8243/staticalize-wordpress-via-varnish/
#注意,不同的varnish版本, vcl的语法不同...

接下来,就是apache2了… 这个有坑…原先的配置有监听443,然而忘记了.. 搞得nginx半天起不来…

ServerName 191.101.152.69 #如果启动apache2服务有报apache2不知道servername, 可以设置这个, ip是你的ip, localhost应该也可以
#再001-blog中修改并不会监听8081, ss -l 也没有8081 curl localhost:8081 -v 也是拒绝访问,必须在下面加
NameVirtualHost 127.0.0.1:8080
NameVirtualHost 127.0.0.1:8081
Listen 127.0.0.1:8080
Listen 127.0.0.1:8081
#
#    Listen 443
#
#有关443的全部注释

apache2的站点配置只需要把原来的443的全部删掉就行了
varnish 4.1
apache2 2.2.22
nginx 随意…配置文件语法好像没怎么变过, 还有就是为了安全…万一哪天我这个版本被曝漏洞,凑巧我还没打补丁,再凑巧因为这个被肉鸡了可不好?

嗯, wordpress 最好提前装上个

SSL 不安全内容修复器

因为,改了siteurl homeurl 好像并没有起作用, 主题里的静态文件依然是http, 原来http+https的时候, https好好的… 不知道什么鬼
以为是nginx没有正确的把请求头传给后端, 一顿折腾,有了上面那个配置,依然不行…装上这个, 再好好设置, 然后重启varnish服务,好了…
不知道遇到什么鬼,就重启varnish…缓存太强了….
附一个varnish 4.1 的中文文档
https://jefferywang.gitbooks.io/varnish_4_1_doc_zh/