Warm tip: This article is reproduced from serverfault.com, please click

其他-Nginx Lua Openresty变量范围

(其他 - Nginx lua openresty variable scope)

发布于 2020-11-28 10:02:46

这是openresty nginx.conf文件的工作示例。在此示例中,我多次请求重做。如你所见,我首先从Redis请求数据,以检查域是否可以获取SSL,然后再次检查以向代理请求的后端获取内容,然后添加了S3代理,因此我需要再次从Redis请求数据。我是OpenResty和Lua的新手,我想知道是否可以一次从redis获取数据并在脚本中多次使用它吗?

user www-data;
worker_processes  auto;
pid /run/openresty.pid;

events {
    worker_connections  1024;
}

error_log /var/log/openresty/error.log debug;

http {
    resolver 127.0.0.53 ipv6=off;
    lua_shared_dict acme 16m;

    init_by_lua_block {
        require("resty.acme.autossl").init({
            tos_accepted = true,
            staging = true,
            account_key_path = "/etc/openresty/account.key",
            account_email = "didnt@forgot.removing",
            domain_whitelist_callback = function(domain)
                local redis = require "resty.redis"
                local rds = redis:new()

                local ok, err = rds:connect("127.0.0.1", 6379)
                if not ok then
                    ngx.log(ngx.ERR, "failed to connect to redis: ", err)
                    return ngx.exit(500)
                end

                local res, err = rds:exists(domain)

                if res == 1 then
                    return true
                end
                if res == 0 then
                    return false
                end
            end
        })
    }

    init_worker_by_lua_block {
        require("resty.acme.autossl").init_worker()
    }

    server {
        access_log /var/log/openresty/access.log;

        listen 80;
        listen 443 ssl;
        server_name _;

        location / {
            set $backend '';
            set $tenant '';

            access_by_lua '
                local domain = ngx.req.get_headers()["Host"]
                local key = "site:" .. domain

                if not domain then
                ngx.log(ngx.ERR, "message 404 missing")
                return ngx.exit(404)
                end

                local redis =  require "resty.redis"
                local rds = redis:new()

                local ok, err = rds:connect("127.0.0.1", 6379)
                if not ok then
                    ngx.log(ngx.ERR, "failed to connect to redis: ", err)
                    return ngx.exit(500)
                end

                local all, err = rds:hgetall(key)
                if not all then
                    ngx.log(ngx.ERR, "no komprende: ", err)
                    return ngx.exit(505)
                end

                if all == ngx.null then
                    ngx.log(ngx.ERR, "no host found for key ", key)
                    return ngx.exit(404)
                end

                local result = {}
                    for i = 1, #all, 2 do
                    result[all[i]] = all[i+1]
                end

                ngx.var.backend = result["backend"]
                ngx.var.tenant = result["tenantID"]

                ngx.log(ngx.ERR, "uhm: ", ngx.var.backend)
            ';

            add_header X-TenantID $tenant always;
            proxy_pass http://$backend;

        }

        location ~* ^/static/(.*) {
            resolver               127.0.0.53 valid=300s;
            resolver_timeout       10s;
            set $s3_bucket        'drasha.ams3.digitaloceanspaces.com';
            set $url_full         '$1';
            proxy_http_version     1.1;
            proxy_set_header       Host $s3_bucket;
            proxy_set_header       Authorization '';
            proxy_hide_header      x-amz-id-2;
            proxy_hide_header      x-amz-request-id;
            proxy_hide_header      Set-Cookie;
            proxy_ignore_headers   "Set-Cookie";
            proxy_buffering        off;
            proxy_intercept_errors on;
            proxy_pass             http://$s3_bucket/AYAYA/$url_full;
        }

        lua_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
        lua_ssl_verify_depth 2;
        ssl_certificate /etc/openresty/default.pem;
        ssl_certificate_key /etc/openresty/default.key;
        ssl_certificate_by_lua_block {
            require("resty.acme.autossl").ssl_certificate()
        }

        location /.well-known {
            content_by_lua_block {
                require("resty.acme.autossl").serve_http_challenge()
            }
        }
    }
}
Questioner
toHo
Viewed
11
Alexander Altshuler 2020-12-01 22:52:23

OpenResty在沙盒中运行Lua钩子,因此无法使用全局变量共享数据。

你应在Nginx Worker中使用数据共享。 通常的做法是在Lua模块级别上缓存任何内容,如果可以更改Redis中存储的数据,则可能在合理的有效期限内进行缓存。

顺便说一句-不要使用XXX_by_lua指令-你应该注意nginx转义规则,请使用XXX_by_lua_block。

附加示例:

local redis = require"resty-redis"

-- the module
local _M = {}

local hgetall_results = {}
_M.hgetall = function(key)
  if hgetall_results[key] then
    return hgetall_results[key]
  end
  local rds = redis:new()
  local ok, err = rds:connect("127.0.0.1", 6379)
  local all, err = rds:hgetall(key)
  local result = {}
  for i = 1, #all, 2 do
     result[all[i]] = all[i+1]
  end
  -- cache 
  hgetall_results[key] = result
  return result
end

return _M

上面的示例仅说明了常规的模块作用域缓存模式。错误处理由你自己决定。