我有一个Node.js支持的网站,我在Amazon Elastic Beanstalk上运行.
我的Node.js应用程序侦听端口8080,我在我的EB应用程序中使用nginx弹性负载均衡器配置,在端口80和443上侦听HTTP和HTTPS.
但是,我只想接受通过HTTPS发送的应用中的流量.
我可以在应用程序中安装一些东西来解决这个问题,但是我有兴趣让负载均衡器通过HTTPS将所有HTTP请求重定向到我的站点.
经过亚马逊付费支持的几次虚假启动后,他们最终确实通过了.您可以通过以下方式配置环境以响应端口80和443.然后在主Node.js应用程序文件夹中创建一个名为的文件夹.ebextensions
,并在其中放置一个名为的文件00_nginx_https_rw.config
,并将此文本作为内容:
files: "/tmp/45_nginx_https_rw.sh": owner: root group: root mode: "000644" content: | #! /bin/bash CONFIGURED=`grep -c "return 301 https" /etc/nginx/conf.d/00_elastic_beanstalk_proxy.conf` if [ $CONFIGURED = 0 ] then sed -i '/listen 8080;/a \ if ($http_x_forwarded_proto = "http") { return 301 https://$host$request_uri; }\n' /etc/nginx/conf.d/00_elastic_beanstalk_proxy.conf logger -t nginx_rw "https rewrite rules added" exit 0 else logger -t nginx_rw "https rewrite rules already set" exit 0 fi container_commands: 00_appdeploy_rewrite_hook: command: cp -v /tmp/45_nginx_https_rw.sh /opt/elasticbeanstalk/hooks/appdeploy/enact 01_configdeploy_rewrite_hook: command: cp -v /tmp/45_nginx_https_rw.sh /opt/elasticbeanstalk/hooks/configdeploy/enact 02_rewrite_hook_perms: command: chmod 755 /opt/elasticbeanstalk/hooks/appdeploy/enact/45_nginx_https_rw.sh /opt/elasticbeanstalk/hooks/configdeploy/enact/45_nginx_https_rw.sh 03_rewrite_hook_ownership: command: chown root:users /opt/elasticbeanstalk/hooks/appdeploy/enact/45_nginx_https_rw.sh /opt/elasticbeanstalk/hooks/configdeploy/enact/45_nginx_https_rw.sh
亚马逊的支持团队解释说:这个配置创建了一个部署钩子,它将重写规则添加到/etc/nginx/conf.d/00_elastic_beanstalk_proxy.conf.
(之前他们曾经提供过.config,它将单独的文件复制到/etc/nginx/conf.d中,但是由于某种原因,这些文件要么没有效果,要么更糟糕,似乎覆盖或优先于默认的nginx配置.)
如果您想要撤消此操作,即删除挂钩,则需要删除此ebextension并发出命令以删除它创建的文件.您可以手动执行此操作,也可以通过临时安装的ebextensions命令执行此操作:
/opt/elasticbeanstalk/hooks/appdeploy/enact/45_nginx_https_rw.sh /opt/elasticbeanstalk/hooks/configdeploy/enact/45_nginx_https_rw.sh
我没有试过这个,但可能这样的东西可以删除它们并撤消这个改变:
container_commands: 00_undochange: command: rm /opt/elasticbeanstalk/hooks/appdeploy/enact/45_nginx_https_rw.sh 01_undochange: command: rm /opt/elasticbeanstalk/hooks/configdeploy/enact/45_nginx_https_rw.sh
希望这可以在将来帮助别人.
我在AWS Elastic Beanstalk上运行'Ruby2 Puma'环境,可能与上面的配置略有不同.在我的环境中,我需要使用'listen 80'而不是'listen 8080'.
sslredirect.config基于elloworld111的回答:
files: "/etc/nginx/conf.d/000_my_config.conf": mode: "000755" owner: root owner: root content: | server { listen 80; return 301 https://$host$request_uri; }
接受的答案对我来说不再适用.默认端口是另一个端口.此外,配置文件的位置已更改.我正在使用Puma设置Ruby On Rails应用程序.
我谈到付费支持,我们通过在运行的实例上手动运行命令来解决这个问题.然后我能够找出以下解决方案.只需登录并重新启动nginx即可.
files: "/tmp/45_nginx_https_rw.sh": owner: root group: root mode: "000644" content: | #! /bin/bash CONFIGURED=`grep -c "return 301 https" /opt/elasticbeanstalk/support/conf/webapp_healthd.conf` if [ $CONFIGURED = 0 ] then sed -i '/listen 80;/a \ if ($http_x_forwarded_proto = "http") { return 301 https://$host$request_uri; }\n' /opt/elasticbeanstalk/support/conf/webapp_healthd.conf logger -t nginx_rw "https rewrite rules added" exit 0 else logger -t nginx_rw "https rewrite rules already set" exit 0 fi container_commands: 00_appdeploy_rewrite_hook: command: cp -v /tmp/45_nginx_https_rw.sh /opt/elasticbeanstalk/hooks/appdeploy/enact 01_configdeploy_rewrite_hook: command: cp -v /tmp/45_nginx_https_rw.sh /opt/elasticbeanstalk/hooks/configdeploy/enact 02_rewrite_hook_perms: command: chmod 755 /opt/elasticbeanstalk/hooks/appdeploy/enact/45_nginx_https_rw.sh /opt/elasticbeanstalk/hooks/configdeploy/enact/45_nginx_https_rw.sh 03_rewrite_hook_ownership: command: chown root:users /opt/elasticbeanstalk/hooks/appdeploy/enact/45_nginx_https_rw.sh /opt/elasticbeanstalk/hooks/configdeploy/enact/45_nginx_https_rw.sh
请注意我是如何更改端口号和配置文件的位置的.
您可以通过Node.js应用程序处理重定向.
亚马逊发送的X-Forwarded-Proto
标头等于http
客户端不安全连接的时间.
应在初始化之后Express
和定义路由之前立即插入以下中间件,以自动将客户端重定向到相应的HTTPS端点:
// Redirect to HTTPS app.use(function (req, res, next) { // Insecure request? if (req.get('x-forwarded-proto') == 'http') { // Redirect to https:// return res.redirect('https://' + req.get('host') + req.url); } next(); });
我能够通过一个稍微简单的解决方案来解决这个问题.
请注意,这是一个部署了SINGLE实例的弹性beanstalk,没有加载balenced.
这是我添加的ebextension.
files: "/etc/nginx/conf.d/000_my_config.conf": mode: "000755" owner: root owner: root content: | server { listen 8080; return 301 https://$host$request_uri; }