「微服务架构」部署NGINX Plus作为API网关，第1部分

api └── warehouse
├── inventory
 └── pricing

etc/ └── nginx/
 ├── api_conf.d/ ....................................... Subdirectory for per-API configuration
 │ └── warehouse_api.conf ...... Definition and policy of the Warehouse API
 ├── api_backends.conf ..................... The backend services (upstreams)
 ├── api_gateway.conf ........................ Top-level configuration for the API gateway server
 ├── api_json_errors.conf ............ HTTP error responses in JSON format
 ├── conf.d/
 │ ├── ...
 │ └── existing_apps.conf
 └── nginx.conf

 include /etc/nginx/api_gateway.conf; # All API gateway configuration
 include /etc/nginx/conf.d/*.conf; # Regular web traffic

log_format api_main '$remote_addr - $remote_user [$time_local] "$request"'
 '$status $body_bytes_sent "$http_referer" "$http_user_agent"'
 '"$http_x_forwarded_for" "$api_name"';
 
include api_backends.conf;
include api_keys.conf;
 
server {
 set $api_name -; # Start with an undefined API name, each API will update this value
 access_log /var/log/nginx/api_access.log api_main; # Each API may also log to a separate file
 
 listen 443 ssl;
 server_name api.example.com;
 
 # TLS config
 ssl_certificate /etc/ssl/certs/api.example.com.crt;
 ssl_certificate_key /etc/ssl/private/api.example.com.key;
 ssl_session_cache shared:SSL:10m;
 ssl_session_timeout 5m;
 ssl_ciphers HIGH:!aNULL:!MD5;
 ssl_protocols TLSv1.1 TLSv1.2;
 
 # API definitions, one per file
 include api_conf.d/*.conf;
 
 # Error responses
 error_page 404 = @400; # Invalid paths are treated as bad requests
 proxy_intercept_errors on; # Do not send backend errors to the client
 include api_json_errors.conf; # API client friendly JSON error responses
 default_type application/json; # If no content-type then assume JSON
}

upstream warehouse_inventory {
 zone inventory_service 64k;
 server 10.0.0.1:80;
 server 10.0.0.2:80;
 server 10.0.0.3:80;
}
 
upstream warehouse_pricing {
 zone pricing_service 64k;
 server 10.0.0.7:80;
 server 10.0.0.8:80;
 server 10.0.0.9:80;
}

# API definition
#
location /api/warehouse/inventory {
 set $upstream warehouse_inventory;
 rewrite ^ /_warehouse last;
}
 
location /api/warehouse/pricing {
 set $upstream warehouse_pricing;
 rewrite ^ /_warehouse last;
}
 
# Policy section
#
location = /_warehouse {
 internal;
 set $api_name "Warehouse";
 
 # Policy configuration here (authentication, rate limiting, logging, more...)
 
 proxy_pass http://$upstream$request_uri;
}

location = /api/warehouse/inventory { # Complete inventory
 set $upstream inventory_service;
 rewrite ^ /_warehouse last;
}
 
location ~ ^/api/warehouse/inventory/shelf/[^/]*$ { # Shelf inventory
 set $upstream inventory_service;
 rewrite ^ /_warehouse last;
}
 
location ~ ^/api/warehouse/inventory/shelf/[^/]*/box/[^/]*$ { # Box on shelf
 set $upstream inventory_service;
 rewrite ^ /_warehouse last;
}
 
location ~ ^/api/warehouse/pricing/[^/]*$ { # Price for specific item
 set $upstream pricing_service;
 rewrite ^ /_warehouse last;
}

# Rewrite rules
#
rewrite ^/api/warehouse/inventory/item/price/(.*) /api/warehouse/pricing/$1;
 
# API definition
#
location /api/warehouse/inventory {
 set $upstream inventory_service;
 rewrite ^(.*)$ /_warehouse$1 last;
}
 
location /api/warehouse/pricing {
 set $upstream pricing_service;
 rewrite ^(.*) /_warehouse$1 last;
}
 
# Policy section
#
location /_warehouse {
 internal;
 set $api_name "Warehouse";
 
 # Policy configuration here (authentication, rate limiting, logging, more...)
 
 rewrite ^/_warehouse/(.*)$ /$1 break; # Remove /_warehouse prefix
 proxy_pass http://$upstream; # Proxy the rewritten URI
}

# Error responses
 error_page 404 = @400; # Invalid paths are treated as bad requests
 proxy_intercept_errors on; # Do not send backend errors to the client
 include api_json_errors.conf; # API client friendly JSON error responses
 default_type application/json; # If no content-type then assume JSON

error_page 400 = @400;
location @400 { return 400 '{"status":400,"message":"Bad request"}\n'; }
 
error_page 401 = @401;
location @401 { return 401 '{"status":401,"message":"Unauthorized"}\n'; }
 
error_page 403 = @403;
location @403 { return 403 '{"status":403,"message":"Forbidden"}\n'; }
 
error_page 404 = @404;
location @404 { return 404 '{"status":404,"message":"Resource not found"}\n'; }

$ curl -i https://api.example.com/foo
HTTP/1.1 400 Bad Request
Server: nginx/1.13.10 
Content-Type: application/json
Content-Length: 39 
Connection: keep-alive
 
{"status":400,"message":"Bad request"}

 openssl rand -base64 18 7B5zIqmRGXmrJTFmKa99vcit

map $http_apikey $api_client_name {
 default "";
 
 "7B5zIqmRGXmrJTFmKa99vcit" "client_one";
 "QzVV6y1EmQFbbxOfRCwyJs35" "client_two";
 "mGcjH8Fv6U9y3BVF9H3Ypb9T" "client_six";
}

# Policy section
#
location = /_warehouse {
 internal;
 set $api_name "Warehouse";
 
 if ($http_apikey = "") {
 return 401; # Unauthorized (please authenticate)
 }
 if ($api_client_name = "") {
 return 403; # Forbidden (invalid API key)
 }
 
 proxy_pass http://$upstream$request_uri;
}

$ curl https://api.example.com/api/warehouse/pricing/item001
{"status":401,"message":"Unauthorized"}
$ curl -H "apikey: thisIsInvalid" https://api.example.com/api/warehouse/pricing/item001
{"status":403,"message":"Forbidden"}
$ curl -H "apikey: 7B5zIqmRGXmrJTFmKa99vcit" https://api.example.com/api/warehouse/pricing/item001
{"sku":"item001","price":179.99}