Nginx 限制没有冗余配置的HTTP谓词_Nginx

Nginx 限制没有冗余配置的HTTP谓词

nginx

Nginx 限制没有冗余配置的HTTP谓词,nginx,Nginx,我有一个Elasticsearch集群加上Logstash和Kibana，我只想在索引中公开一个只读窗口，索引Kibana int除外，这样可以保存仪表盘我找到了一个合适的ES代理配置，并对其进行了修改，使其使用limit_，但不允许写入/修改其他索引，但配置中的许多内容都是不必要的重复。有没有更清晰的方法来定义这一点 upstream elasticsearch { server es-01.iad.company.com:9200; server es-02.iad.com

我有一个Elasticsearch集群加上Logstash和Kibana，我只想在索引中公开一个只读窗口，索引Kibana int除外，这样可以保存仪表盘

我找到了一个合适的ES代理配置，并对其进行了修改，使其使用limit_，但不允许写入/修改其他索引，但配置中的许多内容都是不必要的重复。有没有更清晰的方法来定义这一点

upstream elasticsearch {
    server es-01.iad.company.com:9200;
    server es-02.iad.company.com:9200;
}

server {
    listen 9200;
    server_name elasticsearch.proxy;
    client_max_body_size 50m;

    location / {
        limit_except GET POST HEAD OPTIONS {
            deny all;
        }
        proxy_pass http://elasticsearch;
        proxy_redirect off;
        proxy_set_header Connection "";
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $http_host;
        proxy_pass_header Access-Control-Allow-Origin;
        proxy_pass_header Access-Control-Allow-Methods;
        proxy_hide_header Access-Control-Allow-Headers;
        add_header Access-Control-Allow-Headers 'X-Requested-With, Content-Type';
        add_header Access-Control-Allow-Credentials true;
    }
    location /kibana-int/ {
        proxy_pass http://elasticsearch;
        proxy_redirect off;
        proxy_set_header Connection "";
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $http_host;
        proxy_pass_header Access-Control-Allow-Origin;
        proxy_pass_header Access-Control-Allow-Methods;
        proxy_hide_header Access-Control-Allow-Headers;
        add_header Access-Control-Allow-Headers 'X-Requested-With, Content-Type';
        add_header Access-Control-Allow-Credentials true;
    }
}

有几种方法：

解决方案1 您可以将重复配置放在文件中并包含它

您的配置：

upstream elasticsearch {
    server es-01.iad.company.com:9200;
    server es-02.iad.company.com:9200;
}

server {
    listen 9200;
    server_name elasticsearch.proxy;
    client_max_body_size 50m;

    location / {
        limit_except GET POST HEAD OPTIONS {
            deny all;
        }
        include proxy.inc;
    }

    location /kibana-int/ {
        include proxy.inc;
    }
}

proxy.inc：

proxy_pass http://elasticsearch;
proxy_redirect off;
proxy_set_header Connection "";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_hide_header Access-Control-Allow-Headers;
add_header Access-Control-Allow-Headers 'X-Requested-With, Content-Type';
add_header Access-Control-Allow-Credentials true;

解决方案2 另一种方法是使用nginx的指令继承

upstream elasticsearch {
    server es-01.iad.company.com:9200;
    server es-02.iad.company.com:9200;
}

server {
    listen 9200;
    server_name elasticsearch.proxy;
    client_max_body_size 50m;

    proxy_redirect off;
    proxy_set_header Connection "";
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_hide_header Access-Control-Allow-Headers;
    add_header Access-Control-Allow-Headers 'X-Requested-With, Content-Type';
    add_header Access-Control-Allow-Credentials true;

    location / {
        limit_except GET POST HEAD OPTIONS {
            deny all;
        }
        proxy_pass http://elasticsearch;
    }

    location /kibana-int/ {
        proxy_pass http://elasticsearch;
    }
}

顺便说一句，您的proxy\u pass\u头指令是不必要的。默认情况下，Nginx代理几乎所有的头。