Skip to main content

How to Configure Proxy

In order to ensure that your system does not directly expose service ports to the external network, we strongly recommend that you further configure the Nginx proxy after deploying the system. This step can not only greatly improve the security of the system, but also satisfy users who have certificate requirements. They can refer to relevant documents for configuration. In addition, the Nginx proxy can also provide load balancing and reverse proxy functions, thereby improving system availability and stability.

Nginx deployment​

  1. Download nginx installation package

    wget https://pdpublic.mingdao.com/private-deployment/offline/common/nginx-1.30.4-glibc2.17-amd64.tar.gz

  2. Unzip nginx to the installation directory

    tar -zxvf nginx-1.30.4-glibc2.17-amd64.tar.gz -C /usr/local/

  3. Create nginx system user and directory

    useradd -r -s /usr/sbin/nologin nginx
    mkdir -p /usr/local/nginx/conf/conf.d /data/logs/weblogs/
    chown -R nginx:nginx /data/logs/weblogs

  4. Write nginx main configuration file

    cat > /usr/local/nginx/conf/nginx.conf <<\EOF
    user  nginx;
    worker_processes  auto;
    worker_cpu_affinity auto;
    worker_rlimit_nofile 204800;
    pid        nginx.pid;
    events {
        use epoll;
        worker_connections 20480;
    }
    http {
        include       mime.types;
        default_type  application/octet-stream;
        server_tokens off;

        log_format main "$http_x_forwarded_for | $time_local | $request | $status | $body_bytes_sent | "
                    "$request_body | $content_length | $http_referer | $http_user_agent | "
                    "$http_cookie | $remote_addr | $hostname | $upstream_addr | $upstream_response_time | $request_time";

        server_names_hash_bucket_size 128;
        client_header_buffer_size 8k;
        client_max_body_size 10M;
        large_client_header_buffers 4 32k;
        sendfile       on;
        tcp_nopush     on;
        tcp_nodelay    on;
        proxy_buffer_size     64k;
        proxy_buffers         4 128k;
        keepalive_timeout  10;
        open_file_cache max=102400 inactive=60s;
        open_file_cache_valid 30s;
        open_file_cache_min_uses 1;
        resolver_timeout     10s;
        underscores_in_headers on;

        gzip  on;
        gzip_proxied any;
        gzip_disable "msie6";
        gzip_vary on;
        gzip_min_length 1024;
        gzip_comp_level 8;
        gzip_buffers 16 8k;
        gzip_types text/plain text/css application/json application/x-javascript application/javascript text/xml application/xml application/xml+rss text/javascript image/jpeg image/gif image/png;
        proxy_http_version 1.1;
        include conf.d/*.conf;
    }
    EOF

  5. Configure business proxy rules

    Create a specific agent configuration file (e.g. hdp.conf) in the /usr/local/nginx/conf/conf.d/ directory. You can execute the following command to start writing the configuration:

    vi /usr/local/nginx/conf/conf.d/hdp.conf

Please refer to the corresponding configuration examples based on your business requirements (HTTP or HTTPS):

  1. Check nginx configuration file format

    /usr/local/nginx/sbin/nginx -t

  2. Write the systemd service file of nginx

    cat > /etc/systemd/system/nginx.service  <<'EOF'
    [Unit]
    Description=NGINX HTTP and reverse proxy server
    After=network.target
    Wants=network-online.target

    [Service]
    Type=forking
    PIDFile=/usr/local/nginx/nginx.pid
    ExecStartPre=/usr/local/nginx/sbin/nginx -t -q
    ExecStart=/usr/local/nginx/sbin/nginx
    ExecReload=/usr/local/nginx/sbin/nginx -s reload
    ExecStop=/usr/local/nginx/sbin/nginx -s quit

    Restart=on-failure
    LimitNOFILE=65535

    [Install]
    WantedBy=multi-user.target
    EOF

  3. Start nginx and configure auto-start at boot

    systemctl daemon-reload
    systemctl enable nginx
    systemctl start nginx

Nginx log scheduled cutting​

In order to prevent the request logs generated by Nginx from occupying too much disk space due to long-term accumulation, it is recommended to configure the automatic cutting and cleaning mechanism of the logs.

  1. Create the required configuration and log storage directories

    mkdir -p /usr/local/logrotate-config
    mkdir -p /data/logs/weblogs/oldlogs
    chown -R nginx:nginx /data/logs/weblogs

  2. Write logrotate cutting rules

    cat > /usr/local/logrotate-config/nginx <<\EOF
    /data/logs/weblogs/*.log {
    create 0640 nginx nginx
    daily
    dateext
    dateformat -%Y-%m-%d
    dateyesterday
    rotate 180
    missingok
    ifempty
    compress
    delaycompress
    olddir /data/logs/weblogs/oldlogs
    sharedscripts
    postrotate
        /bin/kill -USR1 `cat /usr/local/nginx/nginx.pid 2>/dev/null` 2>/dev/null || true
    endscript
    }
    EOF

  3. Manually verify whether the configuration is effective

    logrotate -d -f /usr/local/logrotate-config/nginx
  • Pay attention to the debug output. If an error is encountered, further processing is required.

  1. Configure crontab to automatically execute tasks regularly

    ( crontab -l 2>/dev/null; echo '0 0 * * * /usr/sbin/logrotate -f /usr/local/logrotate-config/nginx >/dev/null 2>&1' ) | crontab -