堆棧內存溢出
  簡體   English   中英

Odoo 的 CI/CD Nginx 配置

[英]Nginx configuration for CI/CD for Odoo

 原文  2020-03-29 16:08:44  6   1    nginx/ continuous-integration/ odoo/ continuous-deployment

問題描述

我正在為運行 Odoo 的 Web 服務器配置 nginx。 我的第一個 nginx 服務器（以 root 身份運行）的配置是：

#odoo server
upstream runbot_odoo {
 server 127.0.0.1:8080;
}
upstream odoo {
 server 127.0.0.1:8069;
}
upstream odoochat {
 server 127.0.0.1:8072;
}

# http -> https
server {
   listen 80;
   server_name runbot.mydomain.com;
   rewrite ^(.*) https://$host$1 permanent;
}

server {
 listen 443;
 server_name runbot.mydomain.com;
 proxy_read_timeout 720s;
 proxy_connect_timeout 720s;
 proxy_send_timeout 720s;

 # Add Headers for odoo proxy mode
 proxy_set_header X-Forwarded-Host $host;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_set_header X-Forwarded-Proto $scheme;
 proxy_set_header X-Real-IP $remote_addr;

 # SSL parameters
 ssl on;
 ssl_certificate /etc/ssl/nginx/server.crt;
 ssl_certificate_key /etc/ssl/nginx/server.key;
 ssl_session_timeout 30m;
 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
 ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
 ssl_prefer_server_ciphers on;

 # log
 access_log /var/log/nginx/odoo.access.log;
 error_log /var/log/nginx/odoo.error.log;

 # Redirect longpoll requests to odoo longpolling port
 location /longpolling {
 proxy_pass http://odoochat;
 }

 # Redirect requests to odoo backend server
 location / {
   proxy_redirect off;
   proxy_pass http://odoo;
 }

 # common gzip
 gzip_types text/css text/scss text/plain text/xml application/xml application/json application/javascript;
 gzip on;
}

基本上它是將 80 重定向到 443，然后反向代理以更正端口 8069 和 8072

然后我有另一個 nginx 服務器（以普通用戶身份運行），配置如下：

pid /home/odoo/src/runbot/runbot/static/nginx/nginx.pid;
error_log /home/odoo/src/runbot/runbot/static/nginx/error.log;
worker_processes  1;
events { worker_connections  1024; }
http {
include /etc/nginx/mime.types;
server_names_hash_max_size 512;
server_names_hash_bucket_size 256;
client_max_body_size 10M;
index index.html;
log_format full '$remote_addr - $remote_user [$time_local] '
                '"$request" $status $body_bytes_sent '
                '"$http_referer" "$http_user_agent" $request_time';
access_log /home/odoo/src/runbot/runbot/static/nginx/access.log full;
error_log /home/odoo/src/runbot/runbot/static/nginx/error.log;
client_body_temp_path /home/odoo/src/runbot/runbot/static/nginx;
fastcgi_temp_path /home/odoo/src/runbot/runbot/static/nginx;

autoindex on;

gzip on;
gzip_types text/css text/plain application/xml application/json application/javascript;

proxy_temp_path /home/odoo/src/runbot/runbot/static/nginx;
proxy_read_timeout 600;
proxy_connect_timeout 600;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header Host $host;

server {
    listen 8080 default;
    location / { proxy_pass http://127.0.0.1:8069; }
    location /longpolling/im/poll { return 404; }
    location /longpolling/poll { return 404; }
    location /runbot/static/ {
       alias /home/odoo/src/runbot/runbot/static/;
       autoindex off;
       location ~ /runbot/static/build/[^/]+/(logs|tests)/ {
          autoindex on;
       }
    }
}

server {
    # this is for testing master branch
    # you can see it in the server_name
    # the first part 00058 is the incremental number of the build, so this is the 58'th build
    # the second part master-d9d6e8 is the name of the branch, and I think a random number
    # the last part runbot.mydomain.com, is the domain.
    listen 8080;
    server_name ~^00058\-master\-d9d6e8(-[a-z0-9]+)?\.runbot\.mydomain\.com$;
    location / { proxy_pass http://127.0.0.1:2000; }
    location /longpolling { proxy_pass http://127.0.0.1:2001; }
}

server {
    # another build
    listen 8080;
    server_name ~^00057\-dev\-hr\-operations\-d64c8d(-[a-z0-9]+)?\.runbot\.mydomain\.com$;
    location / { proxy_pass http://127.0.0.1:2003; }
    location /longpolling { proxy_pass http://127.0.0.1:2004; }
}

server {
    # another build
    listen 8080;
    server_name ~^00056\-dev\-returns\-68ca49(-[a-z0-9]+)?\.runbot\.mydomain\.com$;
    location / { proxy_pass http://127.0.0.1:2006; }
    location /longpolling { proxy_pass http://127.0.0.1:2007; }
}

server {
    # another build
    listen 8080;
    server_name ~^00055\-dev\-56c2e4(-[a-z0-9]+)?\.runbot\.mydomain\.com$;
    location / { proxy_pass http://127.0.0.1:2009; }
    location /longpolling { proxy_pass http://127.0.0.1:2010; }
}

server {
    # another build
    listen 8080;
    server_name ~^00054\-master\-06503a(-[a-z0-9]+)?\.runbot\.mydomain\.com$;
    location / { proxy_pass http://127.0.0.1:2012; }
    location /longpolling { proxy_pass http://127.0.0.1:2013; }
}

server {
    listen 8080;
    server_name ~.+\.runbot\.mydomain\.com$;
    location / { return 404; }
}
}

關於第二個配置文件的說明：

第一個服務器塊是默認的，它反向代理到主服務器。 除最后一個之外的其他服務器塊用於要測試的每個構建。 每個構建都在 docker 容器上運行，並公開兩個 http 端口（例如：2012 和 2013）。

一張圖來幫助理解我的結構： 在此處輸入圖片說明

我的問題是如何使用像 *.runbot.mydomain.com 這樣的域的所有請求，例如 build-01.runbot.mydomain.com 正確地“代理”到端口 8080 上的第二個 nginx 服務器，該服務器會將它們代理到正確的端口取決於子域名。 我已經有第二個 nginx 服務器正確重定向子域，但我無法讓第一個 nginx（以 root 身份運行）代理到第二個。

我最好的嘗試是將以下配置添加到主 nginx 中：

upstream runbot_odoo {
 #this upstream is the second nginx server
 server 127.0.0.1:8080;
}


 ......


server {
 # a copy from the first config file above with few edits (not the entire file just the 443 server block)
 # 1. changed server_name to *.runbot.gsk-erp.com I inteded to catch all subdomains and proxy them to 8080 which can then proxy them to then correct port (2012 for example)
 # 2. the location block which now proxy to 8080 instead of 8069
 listen 443;
 server_name *.runbot.gsk-erp.com;
 proxy_read_timeout 720s;
 proxy_connect_timeout 720s;
 proxy_send_timeout 720s;

 # Add Headers for odoo proxy mode
 proxy_set_header X-Forwarded-Host $host;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_set_header X-Forwarded-Proto $scheme;
 proxy_set_header X-Real-IP $remote_addr;

 # SSL parameters
 ssl on;
 ssl_certificate /etc/ssl/nginx/server.crt;
 ssl_certificate_key /etc/ssl/nginx/server.key;
 ssl_session_timeout 30m;
 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
 ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
 ssl_prefer_server_ciphers on;

 # log
 access_log /var/log/nginx/instances.odoo.access.log;
 error_log /var/log/nginx/instances.odoo.error.log;

 # Redirect requests to runbot config file
 location / { proxy_pass http://runbot_odoo; }

 # common gzip
 gzip_types text/css text/scss text/plain text/xml application/xml application/json application/javascript;
 gzip on;
}

當寫入http://00058-master-d9d6e8.runbot.mydomain.com 時，請求由運行在 8069 上的主服務器處理，而不是 8080，這意味着第一個 443 服務器塊仍在處理請求而不是新的一個帶有 *.runbot.mydomain.com 的 server_name

另一個嘗試：

我在第一個之前用 *.runbot.mydomain.com 移動了 443 服務器塊。 現在它正在處理子域請求，但瀏覽器上的 url 更改為https://runbot_odoo （它正在重定向而不是反向代理）

1 個解決方案

解決方案1
 1 已采納  2020-03-29 23:24:44

在此答案中找到了解決方案。

將此行添加到位置塊

proxy_set_header HOST $host;

完整的 nginx 配置文件：主 nginx（以 root 身份運行）

#odoo server
upstream odoorunbot {
 server 127.0.0.1:8080;
}
upstream odoo {
 server 127.0.0.1:8069;
}
upstream odoochat {
 server 127.0.0.1:8072;
}

# http -> https
server {
   listen 80;
   server_name runbot.mydomain.com;
   rewrite ^(.*) https://$host$1 permanent;
}

# runbot build instances
server {
 listen 443;
 server_name *.runbot.mydomain.com;
 proxy_read_timeout 720s;
 proxy_connect_timeout 720s;
 proxy_send_timeout 720s;

 # Add Headers for odoo proxy mode
 proxy_set_header X-Forwarded-Host $host;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_set_header X-Forwarded-Proto $scheme;
 proxy_set_header X-Real-IP $remote_addr;

 # SSL parameters
 ssl on;
 ssl_certificate /etc/ssl/nginx/server.crt;
 ssl_certificate_key /etc/ssl/nginx/server.key;
 ssl_session_timeout 30m;
 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
 ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
 ssl_prefer_server_ciphers on;

 # log
 access_log /var/log/nginx/instances.odoo.access.lo full;
 error_log /var/log/nginx/instances.odoo.error.log;

 # Redirect requests to runbot config file
 #location / { proxy_pass http://odoorunbot; }
 location /longpolling {
   proxy_pass http://odoorunbot;
 }

 # Redirect requests to odoo backend server
 location / {
   #proxy_redirect off;
   proxy_pass http://odoorunbot;
   proxy_set_header HOST $host;
 }

 # common gzip
 gzip_types text/css text/scss text/plain text/xml application/xml application/json application/javascript;
 gzip on;
}

server {
 listen 443;
 server_name runbot.mydomain.com;
 proxy_read_timeout 720s;
 proxy_connect_timeout 720s;
 proxy_send_timeout 720s;

 # Add Headers for odoo proxy mode
 proxy_set_header X-Forwarded-Host $host;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_set_header X-Forwarded-Proto $scheme;
 proxy_set_header X-Real-IP $remote_addr;

 # SSL parameters
 ssl on;
 ssl_certificate /etc/ssl/nginx/server.crt;
 ssl_certificate_key /etc/ssl/nginx/server.key;
 ssl_session_timeout 30m;
 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
 ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
 ssl_prefer_server_ciphers on;

 # log
 access_log /var/log/nginx/odoo.access.log;
 error_log /var/log/nginx/odoo.error.log;

 # Redirect longpoll requests to odoo longpolling port
 location /longpolling {
 proxy_pass http://odoochat;
 }

 # Redirect requests to odoo backend server
 location / {
   proxy_redirect off;
   proxy_pass http://odoo;
 }

 # common gzip
 gzip_types text/css text/scss text/plain text/xml application/xml application/json application/javascript;
 gzip on;
}

其他 nginx 以普通用戶（runbot 用戶）身份運行

pid /home/odoo/src/runbot/runbot/static/nginx/nginx.pid;
error_log /home/odoo/src/runbot/runbot/static/nginx/error.log;
worker_processes  1;
events { worker_connections  1024; }
http {
include /etc/nginx/mime.types;
server_names_hash_max_size 512;
server_names_hash_bucket_size 256;
client_max_body_size 10M;
index index.html;
log_format full '$remote_addr - $remote_user [$time_local] '
                '"$request" $status $body_bytes_sent '
                '"$http_referer" "$http_user_agent" $request_time';
access_log /home/odoo/src/runbot/runbot/static/nginx/access.log full;
error_log /home/odoo/src/runbot/runbot/static/nginx/error.log;
client_body_temp_path /home/odoo/src/runbot/runbot/static/nginx;
fastcgi_temp_path /home/odoo/src/runbot/runbot/static/nginx;
autoindex on;

gzip on;
gzip_types text/css text/plain application/xml application/json application/javascript;

proxy_temp_path /home/odoo/src/runbot/runbot/static/nginx;
proxy_read_timeout 600;
proxy_connect_timeout 600;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header Host $host;

server {
    listen 8081 default;
    location / { proxy_pass http://127.0.0.1:8069; }
    location /longpolling/im/poll { return 404; }
    location /longpolling/poll { return 404; }
    location /runbot/static/ {
       alias /home/odoo/src/runbot/runbot/static/;
       autoindex off;
       location ~ /runbot/static/build/[^/]+/(logs|tests)/ {
          autoindex on;
       }
    }
}

server {
    listen 8080;
    server_name ~^00066\-master\-d9d6e8(-[a-z0-9]+)?\.runbot\.mydomain\.com$;
    location / { proxy_redirect off; proxy_pass  http://127.0.0.1:2000; }
    location /longpolling { proxy_pass http://127.0.0.1:2001; }
}

server {
    listen 8080;
    server_name ~.+\.runbot\.mydomain\.com$;
    location / { return 404; }
}
}

在另一個文件中，我只將第一個服務器塊更改為偵聽 8081 而不是 8080，因為我認為它會導致問題，但可能不是。 所以我建議保持 runbot 的 nginx 文件不變。

暫無
暫無

聲明:本站的技術帖子網頁，遵循CC BY-SA 4.0協議，如果您需要轉載，請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.

相關問題 如何更改 odoo 的 nginx 配置上下文 URI 帶有 Odoo 配置的 Nginx：在上游找不到主機 如何在CI＆CD VSTS中使用kubernetes和Nginx中的環境變量替換angular config.json的字段值 Nginx重寫odoo 8 Nginx配置 Nginx配置 NGINX配置： Gitlab CI - 注冊表和 nginx Gitlab CI/CD - 用戶和權限最佳實踐 docker nginx letsencrypt odoo錯誤
相關標簽
 
粵ICP備18138465號  © 2020-2024 STACKOOM.COM