openresty介绍

在使用nginx时，如果我们想进行开发，开发难度比较大，openresty对nginx核心集成了很多lua三方模块，开发者可以使用lua脚本进行开发，开发者只需了解http协议和lua脚本。openresty你可以理解为支持lua开发的nginx,但是性能比nginx强。

openresty可提供：均衡负载、请求路由、安全认证、服务鉴权、流量控制、日志监控服务等。

根据openresty官网提供的数据表明：openresty在单机上就可以支持1万~100万并发连接。

mac安装oepnresty

安装

 // 使用brew 安装 
  brew install openresty/brew/openresty


// 上面安装完后，执行nginx 提示找不到命令
// 配置环境变量(会话级,关闭这个会话，变量失效)
export PATH = /usr/local/opt/openresty/nginx/sbin:$PATH

安装完成后

 // 启动
sudo nginx -c /usr/local/etc/openresty/nginx/nginx.conf
// 重载配置文件
sudo nginx -s reload -c /usr/local/etc/openresty/nginx/nginx.conf
//检查配置文件语法
sudo nginx -t /usr/local/etc/openresty/nginx/nginx.conf
// 停止
sudo nginx -s stop

卸载

// brew 卸载openresty
brew uninstall --force openresty/brew/openresty

linux安装openresty

// 安装依赖库
apt-get install libreadline-dev libpcre3-dev libssl-dev perl
// 下载
wget https://openresty.org/download/ngx_openresty-1.9.7.1.tar.gz  
// 解压
tar xzvf ngx_openresty-1.9.7.1.tar.gz       
//进入解压后的目录
cd ngx_openresty-1.9.7.1/ 
// 安装
./configure
make 
make install

默认情况下程序会被安装到 /usr/local/openresty, 你可以使用./configure --help查看会更多的配置选项

openresty的lua时序图

init_by_lua

• 用法
  当启动nginx的master进程加载配置文件时可以执行init_by_lua这里定义的lua脚本。
• 语法

  init_by_lua  <lua-script-str>

• 示例

// nginx.conf
location / {
    
init_by_lua 'your code';
}

• init_by_lua_block语法

  init_by_lua_block {
     lua-script }

• init_by_lua_file语法

 init_by_lua_file  <path-lua-script>

init_worker_by_lua

• 用法
  当nginx的master进程启动后，每一个woker进程启动时执行这里定义的脚本。

• 语法

  init_worker_by_lua <lua-script-str>

• 示例

// nginx.conf
location / {
    
init_worker_by_lua  'your code';
}

• init_worker_by_lua_block语法

   init_worker_by_lua_block {
     lua-script}

• init_worker_by_lua_file语法

  init_worker_by_lua_file <lua-file-path>

set_by_lua

• 用法
  执行指定脚本和输入的值返回一个结果
• 语法

set_by_lua $res <lua-script-str> [$arg1 $arg2...]

• 示例

location /foo {
    
 set $diff ''; # we have to predefine the $diff variable here
 set_by_lua $sum '
     local a = 32
     local b = 56
     ngx.var.diff = a - b;  -- write to $diff directly
     return a + b;          -- return the $sum value normally
 ';
 echo "sum = $sum, diff = $diff";
 }

• set_by_lua_block语法

 set_by_lua_block $res [lua-script]

• set_by_lua_file语法

set_by_lua-file $res <path-to-lua-script-file> [$arg1 $arg2...]

rewite_by_lua

• 用法
  执行Lua脚本重写每一个请求，注意这个处理器的时序必须在标准的 ngx_http_rewrite_module模块之后执行。

• 语法

 rewrite_by_lua <lua-script-styr>

• 示例

  正确执行

location /foo {
    
 set $a 12; # create and initialize $a
 set $b ""; # create and initialize $b
 rewrite_by_lua 'ngx.var.b = tonumber(ngx.var.a) + 1';
 echo "res = $b";
 }
 

没有按照期望执行

location /foo {
    
 ?      set $a 12; # create and initialize $a
 ?      set $b ''; # create and initialize $b
 ?      rewrite_by_lua 'ngx.var.b = tonumber(ngx.var.a) + 1';
 ?      if ($b = '13') {
    
 ?         rewrite ^ /bar redirect;
 ?         break;
 ?      }
 ?
 ?      echo "res = $b";
 ?  }

因为 if 运行在 rewrite_by_lua之前即使代码看起在其后执行.

• rewrite_by_lua_block语法

 rewrite_by_lua_block {lua-script}

• rewrite_by_lua_file语法

rewrite_by_lua_file <path-to-lua-script-file>

access_by_lua

• 用法
  执行Lua脚本可以修改每一个请求头，注意这个处理器的时序必须在标准的 ngx_http_access_module模块之后执行。

• 语法

access_by_lua <lua-script-str>

• 示例

location / {
    
 deny    192.168.1.1;
 allow   192.168.1.0/24;
 allow   10.1.1.0/16;
 deny    all;

 access_by_lua '
     local res = ngx.location.capture("/mysql", { ... })
     ...
 ';

 # proxy_pass/fastcgi_pass/...
 }

• access_by_lua_block语法

access_by_lua_block {lua-script}

• access_by_lua_file语法

// 如果写相对地址，相对于nginx根目录
acess_by_lua_file <path-to-lua-script-file>
// 这里地址推荐使用绝对地址

header_filter_by_lua

• 用法

执行Lua脚本修改每一个请求的响应头信息

• 语法

header_filter_by_lua <lua-script-str>

• 示例

location / {
    
 proxy_pass http://mybackend;
 header_filter_by_lua 'ngx.header.Foo = "blah"';
 }

• header_filter_by_lua_block语法

header_filter_by_lua_block {lus-script}

• header_filter_by_lua_file语法

header_filter_by_lua_file <path-to-lua-script-file>

body_filter_by_lua

• 用法
  执行Lua脚本修改每一个请求的响应body信息
• 语法

body_filter_by_lua <lua-script-str>

• 示例

location / {
    
 proxy_pass http://mybackend;
 body_filter_by_lua 'ngx.arg[1] = string.upper(ngx.arg[1])';
 }

• body_filter_by_lua_block语法

body_filter_by_lua_block {lua-script-str}

• body_filter_by_lua_file语法

body_filter_by_lua_file <path-to-lua-script-file>

修改请求头

如果请求头有 authorization并且他的值包含Bearer,则重写值,我们这里使用access_by_lua_file

nignx.conf

   location / {
    
        access_by_lua_file lua/changeReqHeader.lua;
    }

changeReqHeader.lua

-- 重写请求头 token
-- 如果请求头包含 authorization 并且内容包含  Bearer，则重写请求头
local token = '123456'
if  ngx.req.get_headers()["authorization"] ~= nil and string.find(ngx.req.get_headers()["authorization"], 'Bearer') ~= nil then
  ngx.req.set_header("authorization", "Bearer "..token)
-- ngx.log(ngx.ERR, "token:"..token)
end

修改响应头

如果响应码时401，响应头有authenticate,则修改这个值,我们这里使用 header_filter_by_lua_file

nignx.conf

   location / {
    
           header_filter_by_lua_file lua/changeRrespHeader.lua;
    }

changeRrespHeader.lua

if ngx.status == 401 then
local h = ngx.resp.get_headers()
for k, v in pairs(h) do
    if k == "www-authenticate" then
        ngx.header["www-authenticate"] = "Bearer realm=\"http://xxx-xxx.com.cn/service/token\",service=\"harbor-registry\""
    end
end
end

nginx提供给lua的API

在lua脚本中可以使用下面的API进行开发。

http方法

上下文使用lua时序方法 init_by_lua*, set_by_lua*, rewrite_by_lua*, access_by_lua*, content_by_lua*, header_filter_by_lua*, body_filter_by_lua*, log_by_lua*, ngx.timer., balancer_by_lua, ssl_certificate_by_lua*, ssl_session_fetch_by_lua*, ssl_session_store_by_lua*

 ngx.HTTP_GET
  ngx.HTTP_HEAD
  ngx.HTTP_PUT
  ngx.HTTP_POST
  ngx.HTTP_DELETE

http状态码

上下文使用Lua时序方法init_by_lua*, set_by_lua*, rewrite_by_lua*, access_by_lua*, content_by_lua*, header_filter_by_lua*, body_filter_by_lua*, log_by_lua*, ngx.timer., balancer_by_lua, ssl_certificate_by_lua*, ssl_session_fetch_by_lua*, ssl_session_store_by_lua*

 value = ngx.HTTP_CONTINUE (100) (first added in the v0.9.20 release)
   value = ngx.HTTP_SWITCHING_PROTOCOLS (101) (first added in the v0.9.20 release)
   value = ngx.HTTP_OK (200)
   value = ngx.HTTP_CREATED (201)
   value = ngx.HTTP_ACCEPTED (202) (first added in the v0.9.20 release)
   value = ngx.HTTP_NO_CONTENT (204) (first added in the v0.9.20 release)
   value = ngx.HTTP_PARTIAL_CONTENT (206) (first added in the v0.9.20 release)
   value = ngx.HTTP_SPECIAL_RESPONSE (300)
   value = ngx.HTTP_MOVED_PERMANENTLY (301)
   value = ngx.HTTP_MOVED_TEMPORARILY (302)
   value = ngx.HTTP_SEE_OTHER (303)
   value = ngx.HTTP_NOT_MODIFIED (304)
   value = ngx.HTTP_TEMPORARY_REDIRECT (307) (first added in the v0.9.20 release)
   value = ngx.HTTP_PERMANENT_REDIRECT (308)
   value = ngx.HTTP_BAD_REQUEST (400)
   value = ngx.HTTP_UNAUTHORIZED (401)
   value = ngx.HTTP_PAYMENT_REQUIRED (402) (first added in the v0.9.20 release)
   value = ngx.HTTP_FORBIDDEN (403)
   value = ngx.HTTP_NOT_FOUND (404)
   value = ngx.HTTP_NOT_ALLOWED (405)
   value = ngx.HTTP_NOT_ACCEPTABLE (406) (first added in the v0.9.20 release)
   value = ngx.HTTP_REQUEST_TIMEOUT (408) (first added in the v0.9.20 release)
   value = ngx.HTTP_CONFLICT (409) (first added in the v0.9.20 release)
   value = ngx.HTTP_GONE (410)
   value = ngx.HTTP_UPGRADE_REQUIRED (426) (first added in the v0.9.20 release)
   value = ngx.HTTP_TOO_MANY_REQUESTS (429) (first added in the v0.9.20 release)
   value = ngx.HTTP_CLOSE (444) (first added in the v0.9.20 release)
   value = ngx.HTTP_ILLEGAL (451) (first added in the v0.9.20 release)
   value = ngx.HTTP_INTERNAL_SERVER_ERROR (500)
   value = ngx.HTTP_METHOD_NOT_IMPLEMENTED (501)
   value = ngx.HTTP_BAD_GATEWAY (502) (first added in the v0.9.20 release)
   value = ngx.HTTP_SERVICE_UNAVAILABLE (503)
   value = ngx.HTTP_GATEWAY_TIMEOUT (504) (first added in the v0.3.1rc38 release)
   value = ngx.HTTP_VERSION_NOT_SUPPORTED (505) (first added in the v0.9.20 release)
   value = ngx.HTTP_INSUFFICIENT_STORAGE (507) (first added in the v0.9.20 release)

删除nginx日志级别

上下文使用Lua时序方法init_by_lua*, init_worker_by_lua*, set_by_lua*, rewrite_by_lua*, access_by_lua*, content_by_lua*, header_filter_by_lua*, body_filter_by_lua*, log_by_lua*, ngx.timer., balancer_by_lua, ssl_certificate_by_lua*, ssl_session_fetch_by_lua*, ssl_session_store_by_lua*

//使用 ngx.log（level,  output info）

  ngx.STDERR
   ngx.EMERG
   ngx.ALERT
   ngx.CRIT
   ngx.ERR
   ngx.WARN
   ngx.NOTICE
   ngx.INFO
   ngx.DEBUG

本次请求发起子请求 ngx.location.capture

local  res = ngx.location.capture('/foo/bar?a=3&b=4')
// 子请求响应码不等于200
if res.status ~= 200 then
ngx.log(ngx.ERR, "sub request returned bad status: ",
res.status)
//父请求返回非200，整个请求结束
ngx.exit(res.status)
end

读写当前请求的响应码 ngx.status

上下文使用Lua时序方法set_by_lua*, rewrite_by_lua*, access_by_lua*, content_by_lua*, header_filter_by_lua*, body_filter_by_lua*, log_by_lua*

//在Lua中使用当前请求响应码
local status = ngx.status

设置请求的响应头 ngx.header.HEADER

注意这个是响应头 response header

//注意在lua字符串中 \" 代表一个双引号符号，\' 代表一个单引号(撇号)字符
ngx.header["www-authenticate"] ="Bearer realm=\"http://xxx.paic.com.cn:8443/service/token\",service=\"harbor-registry\""

得到响应的所有头 ngx.resp.get_headers

上下文Lua时序方法 set_by_lua*, rewrite_by_lua*, access_by_lua*, content_by_lua*, header_filter_by_lua*, body_filter_by_lua*, log_by_lua*, balancer_by_lua*

if ngx.status == 401 then
local h = ngx.resp.get_headers()
for k, v in pairs(h) do
    if k == "www-authenticate" then
        ngx.header["www-authenticate"] = "Bearer realm=12121"
    end
end
end

local value = ngx.resp.get_headers()["header name"]

得到请求的所有头 ngx.req.get_headers

上下文lua时序方法set_by_lua*, rewrite_by_lua*, access_by_lua*, content_by_lua*, header_filter_by_lua*, body_filter_by_lua*, log_by_lua*

local h = ngx.req.get_headers()
for k, v in pairs(h) do
    if k == "authorization" then
        ngx.req_set_header("authorization", "basic 1233")
    end
end

local value = ngx.req.get_headers()["authorization"]

设置请求头信息 ngx.req.set_header

上下文Lua时序方法set_by_lua*, rewrite_by_lua*, access_by_lua*, content_by_lua*, header_filter_by_lua*, body_filter_by_lua*

ngx.req_set_header("authorization", "basic 1233")

上传文件nginx报http 413错误

报413错误原因是请求实体太大，nginx的缓存区设置的太小，

http {
    
//  允许用户最大上传数据限制，默认1M，位置可放在http,server,location
client_max_body_size 500M;
client_body_filter_size 200M;
}

nginx中文日志乱码

nginx配置文件log_format增加 escape参数，json或者none都可以。

 log_format  main escape=json  '$remote_addr - $remote_user [$time_local] "$request" '
                  '$status $body_bytes_sent "$http_referer" '
                  '"$http_user_agent" "$http_x_forwarded_for"';

参考

openresty官方

openresty实战：概念和应用场景

浅析openresty

openrestry相关lua解释

lua简单教程

nginx 401处理