How to Configure Proxy

In order to ensure that your system does not directly expose service ports to the external network, we strongly recommend that you further configure the Nginx proxy after deploying the system. This step can not only greatly improve the security of the system, but also satisfy users who have certificate requirements. They can refer to relevant documents for configuration. In addition, the Nginx proxy can also provide load balancing and reverse proxy functions, thereby improving system availability and stability.

Nginx deployment

Download nginx installation package

Linux amd64
Linux arm64

wget https://pdpublic.nocoly.com/offline/common/nginx-1.30.4-glibc2.17-amd64.tar.gz

wget https://pdpublic.nocoly.com/offline/common/arm64/nginx---glibc2.17-arm64.tar.gz

Unzip nginx to the installation directory

Linux amd64
Linux arm64

tar -zxvf nginx-1.30.4-glibc2.17-amd64.tar.gz -C /usr/local/

tar -zxvf nginx---glibc2.17-arm64.tar.gz -C /usr/local/

Create nginx system user and directory

useradd -r -s /usr/sbin/nologin nginx
mkdir -p /usr/local/nginx/conf/conf.d /data/logs/weblogs/
chown -R nginx:nginx /data/logs/weblogs

Write nginx main configuration file

cat > /usr/local/nginx/conf/nginx.conf <<\EOF
user  nginx;
worker_processes  auto;
worker_cpu_affinity auto;
worker_rlimit_nofile 204800;
pid        nginx.pid;
events {
    use epoll;
    worker_connections 20480;
}
http {
    include       mime.types;
    default_type  application/octet-stream;
    server_tokens off;

    log_format main "$http_x_forwarded_for | $time_local | $request | $status | $body_bytes_sent | "
                "$request_body | $content_length | $http_referer | $http_user_agent | "
                "$http_cookie | $remote_addr | $hostname | $upstream_addr | $upstream_response_time | $request_time";

    server_names_hash_bucket_size 128;
    client_header_buffer_size 8k;
    client_max_body_size 10M;
    large_client_header_buffers 4 32k;
    sendfile       on;
    tcp_nopush     on;
    tcp_nodelay    on;
    proxy_buffer_size     64k;
    proxy_buffers         4 128k;
    keepalive_timeout  10;
    open_file_cache max=102400 inactive=60s;
    open_file_cache_valid 30s;
    open_file_cache_min_uses 1;
    resolver_timeout     10s;
    underscores_in_headers on;

    gzip  on;
    gzip_proxied any;
    gzip_disable "msie6";
    gzip_vary on;
    gzip_min_length 1024;
    gzip_comp_level 8;
    gzip_buffers 16 8k;
    gzip_types text/plain text/css application/json application/x-javascript application/javascript text/xml application/xml application/xml+rss text/javascript image/jpeg image/gif image/png;
    proxy_http_version 1.1;
    include conf.d/*.conf;
}
EOF

Configure business proxy rules

Create a specific agent configuration file (e.g. hdp.conf) in the /usr/local/nginx/conf/conf.d/ directory. You can execute the following command to start writing the configuration:
```
vi /usr/local/nginx/conf/conf.d/hdp.conf
```

Please refer to the corresponding configuration examples based on your business requirements (HTTP or HTTPS):

Check nginx configuration file format
```
/usr/local/nginx/sbin/nginx -t
```

Write the systemd service file of nginx

cat > /etc/systemd/system/nginx.service  <<'EOF'
[Unit]
Description=NGINX HTTP and reverse proxy server
After=network.target
Wants=network-online.target

[Service]
Type=forking
PIDFile=/usr/local/nginx/nginx.pid
ExecStartPre=/usr/local/nginx/sbin/nginx -t -q
ExecStart=/usr/local/nginx/sbin/nginx
ExecReload=/usr/local/nginx/sbin/nginx -s reload
ExecStop=/usr/local/nginx/sbin/nginx -s quit

Restart=on-failure
LimitNOFILE=65535

[Install]
WantedBy=multi-user.target
EOF

Start nginx and configure auto-start at boot

systemctl daemon-reload
systemctl enable nginx
systemctl start nginx

Nginx log scheduled cutting

In order to prevent the request logs generated by Nginx from occupying too much disk space due to long-term accumulation, it is recommended to configure the automatic cutting and cleaning mechanism of the logs.

Create the required configuration and log storage directories

mkdir -p /usr/local/logrotate-config
mkdir -p /data/logs/weblogs/oldlogs
chown -R nginx:nginx /data/logs/weblogs

Write logrotate cutting rules

cat > /usr/local/logrotate-config/nginx <<\EOF
/data/logs/weblogs/*.log {
create 0640 nginx nginx
daily
dateext
dateformat -%Y-%m-%d
dateyesterday
rotate 180
missingok
ifempty
compress
delaycompress
olddir /data/logs/weblogs/oldlogs
sharedscripts
postrotate
    /bin/kill -USR1 `cat /usr/local/nginx/nginx.pid 2>/dev/null` 2>/dev/null || true
endscript
}
EOF

Manually verify whether the configuration is effective
```
logrotate -d -f /usr/local/logrotate-config/nginx
```

Pay attention to the debug output. If an error is encountered, further processing is required.

Configure crontab to automatically execute tasks regularly

( crontab -l 2>/dev/null; echo '0 0 * * * /usr/sbin/logrotate -f /usr/local/logrotate-config/nginx >/dev/null 2>&1' ) | crontab -

Nginx deployment​

Nginx log scheduled cutting​

Nginx deployment

Nginx log scheduled cutting