tomas's questions

在以下配置中，当上游服务器返回 HTTP 200 OK 响应以外的响应时，对 hostnameb.example.org 的请求缺少 X-custom-server-info 标头。

hostnamea.example.org 响应正确（包括标头）。

知道为什么或如何解决它吗？

worker_processes auto;
worker_rlimit_nofile 8192;
pid /opt/bitnami/nginx/tmp/nginx.pid;
events {
    worker_connections 4096;
}
http {
        include /opt/bitnami/nginx/conf/mime.types;

        add_header X-custom-server-info "someinfo" always;

        proxy_set_header         X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header         Forwarded "";
        proxy_http_version       1.1;
        client_max_body_size     10m;
        client_body_buffer_size  128k;
        proxy_connect_timeout    180;
        proxy_send_timeout       180;
        proxy_read_timeout       180;
        proxy_buffers            32 4k;

        proxy_set_header         Host                $host;
        proxy_set_header         X-Forwarded-Host    $host;
        #proxy_set_header         X-Forwarded-Proto   $scheme;
        #proxy_set_header         X-Forwarded-Port    $server_port;
        proxy_set_header         X-Forwarded-Proto   https;
        proxy_set_header         X-Forwarded-Port    443;

        server_tokens off;
        sendfile on;
        tcp_nopush on;
        tcp_nodelay on;
        keepalive_timeout 65;
        types_hash_max_size 2048;
        server_names_hash_bucket_size 128; # this seems to be required for some vhosts

        default_type application/octet-stream;

        resolver dns-default.openshift-dns.svc.cluster.local valid=300s;


        server {
          listen 8081;
          server_name  hostnamea.example.org;
          set $bff "http://bff.project.svc.cluster.local";

          location / {
            proxy_pass               $bff;
          }
        }

        server {
          listen 8081;
          server_name  hostnameb.example.org;
          set $bff "http://bff.project.svc.cluster.local";


          location / {
            proxy_pass               $bff;
            add_header         Access-Control-Allow-Origin                https://external.example.org always;
            add_header         Access-Control-Allow-Credentials           true always;
          }
        }


        log_format upstreamlog '[$time_local]  "$request" UA:"$http_user_agent"';
        access_log /opt/bitnami/nginx/logs/access.log upstreamlog;
        error_log /opt/bitnami/nginx/logs/error.log;
}

我有将请求转发给代理的工作 httpd 配置（反向代理）：

Listen 443 https

<VirtualHost *:443>
    ServerName  public-dns.example.org
    ServerAlias internal-hostname.internal

    ProxyPreserveHost On

    RewriteEngine On

    #check & block some URLs in target service
    RewriteCond %{REQUEST_URI} ^/service
    RewriteRule /service(/(api(/(([a-zA-Z_-]+)(/|/.*swagger.*)?(\.\.)?)?)?)?)?$ - [F,L]

    <Location "/service/api/">
      ProxyPreserveHost Off
      ProxyErrorOverride Off
    </Location>

    ProxyPass /service/api/ https://services.apps.cloud.example.internal/

    ProxyErrorOverride On

    SSLProxyEngine On
#START - avoid unnecessary checks in internal network - development environment
    SSLProxyVerify none
    SSLProxyCheckPeerCN off
    SSLProxyCheckPeerCN off
    SSLProxyCheckPeerName off
    SSLProxyCheckPeerExpire off
#END - avoid unnecessary checks in internal network - development environment

#START - not relevant part of config (for this question)
    SSLEngine On
    SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
    SSLProtocol All -SSLv2 +TLSv1.2
    SSLCipherSuite HIGH:!aNULL:!MD5
    SSLHonorCipherOrder On

    SSLCompression off
    SSLSessionTickets Off
    SSLCertificateFile      /etc/ssl/certs/apache-selfsigned.crt
    SSLCertificateKeyFile /etc/ssl/private/apache-selfsigned.key
#END - not relevant part of config (for this question)
</VirtualHost>

我想丰富对上游服务器的请求——添加一个查询字符串参数，但我什至在应用 rewriteRule 并将其转发给代理时遇到问题。

由于服务使用另一个查询字符串参数，我发现 mod_rewrite 标志 QSA 应该处理 ?/& 正确...

当我添加这组重写规则时，所有 rewriteRules 尝试都失败并出现相同的 502 代理错误。

根据 error_log，mod_proxy 似乎没有根据上面定义的 ProxyPass 指令转发它。

    #test - adding query parameter to proxy request

    RewriteCond %{REQUEST_URI} ^/service
# attempt 1 failed - match all under the rewriteCond "^/service", add "queryStringParam" and apply flags QSA & P (proxy)
#    RewriteRule ^(.*)$ $1?queryStringParam=example [QSA,P]
# attempt 2 failed - try the same without QSA
#    RewriteRule ^(.*)$ $1 [P]
# attempt 3/4 failed - try absolute url in target url 
#    RewriteRule ^(.*)$ %{REQUEST_SCHEME}://%{HTTP_HOST}$1?queryStringParam=example [QSA,P]
#    RewriteRule ^(.*)$ %{REQUEST_SCHEME}://%{HTTP_HOST}$1 [P]

所有尝试均因代理错误 (http 502) 而失败：

The proxy server received an invalid response from an upstream server. 
The proxy server could not handle the request "GET /services/api/example-service/list/".

你能给我指出正确的方向吗？谢谢